Flapping alert

[mulbzh]

Hello, (an sorry for my English)

All on my zabbix server work well but i have some trouble the night.

Because of backup the night from servers to NAS, i have alerts like this :
"trigger: Ping loss is too high on NASMB12
1. ICMP loss (NASMB12:icmppingloss): 33.33 %"

so this alert is normal because there is too much traffic on the network and the NAS or orther Equipment can 't respond in time to Zabbix.

so, i added maintenance period to not receive alert the night but i think it is not a good idea. i 'd like to receive alert.

I looked for this article : http://blog.zabbix.com/no-more-flapp...mart-way/1488/

but i dont understand how i can do for this trigger for example who ping my switch. I have alert on all switch the night also because of backup

{ZBX-CISCO-ENVMON:icmpping.avg(600)}>0 and {ZBX-CISCO-ENVMON:icmppingloss.avg(600)}>1

thanks for help

[ArtemK]

What exactly you do not understand?

If you want to use hysteresis to eliminate flapping you need to define:

1. Condition to fire trigger
2. Condition to stay in problem state for trigger

you could probably use smth like this (I'm not tested it)

({TRIGGER.VALUE}=0 & ({ZBX-CISCO-ENVMON:icmpping.max(300)}=0 | {ZBX-CISCO-ENVMON:icmppingloss.avg(600)}>30))
|
({TRIGGER.VALUE}=1 & ({ZBX-CISCO-ENVMON:icmpping.min(600)}=0 | {ZBX-CISCO-ENVMON:icmppingloss.min(600)}>30))

So trigger activates, if host is not responding pings for 5 minutes, or avg loss > 30% for 10 minutes, and stays active until host is always responding ping during 10 minutes and minimum packet loss is less than 30% for 10 minutes. Remember that second part defines condition to stay in problem state. You should test that, I'm not sure that it will work correctly

[mulbzh]

it 's difficult to understand because all article are in English and my English is not very good

[mulbzh]

i tried ti use your trigger but i have this error :

##Incorrect trigger expression. Check expression part starting from " & ({ZBX-CISCO-ENVMON:icmpping.max(300)}=0 | {ZBX-CISCO-ENVMON:icmppingloss.avg(600)}>30))
|
({TRIGGER.VALUE}=1 & ({ZBX-CISCO-ENVMON:icmpping.min(600)}=0 | {ZBX-CISCO-ENVMON:icmppingloss.min(600)}>30))".

[ArtemK]

Zabbix version? And remove newlines, it should be single line...

[Colttt]

whats you main language ?

[mulbzh]

i have zabbix 2.4

my language is French or Breton like you want !

i tried this in a single line

({TRIGGER.VALUE}=0&({ZBX-CISCO-ENVMON:icmpping.max(300)}=0|{ZBX-CISCO-ENVMON:icmppingloss.avg(600)}>30))|({TRIGGER.VALUE }=1&({ZBX-CISCO-ENVMON:icmpping.min(600)}=0|{ZBX-CISCO-ENVMON:icmppingloss.min(600)}>30))

not better

[ArtemK]

AFAIK, in 2.4 "&" and "|" was replaced by "and" and "or"

[Colttt]

i have zabbix 2.4

my language is French or Breton like you want !

so we have a subforum in french

https://www.zabbix.com/forum/forumdisplay.php?f=25