Trigger for multiple state changes over a period of time?

[StealthJoe]

I have an item that performs a ping check and returns 1 if the ping was successful and 0 if the ping failed. I want to know if the state changed more than 5 times in a hour meaning that the device is sometimes not responding.

Here is an example graph of what the problem looks like.




I tried to use the avg() trigger to say if the average up time is less than 90% over 1 hour. This works but the problem is if a device goes actually goes offline during this period it will falsely trigger because the up time is less than 90%.

I thought if I could count the times it changed from a 1 to a 0 or vice versa I would be able to capture the problem. My other thinking is if the average over 1 hour is <90% and this problem persists the whole day then maybe trigger again?

Does anyone have an idea of how to do this? I've looked at the notes for the count() trigger but it doesn't seem to do what I want.

[StealthJoe]

Bump?

(Sorry for bumping)

[StealthJoe]

Pinging every minute? So sum of values has to be 60 for one hour period, if everything is fine... if sum is less than 55, you have an issue.

Thank you for the suggestion. I tried this too but it is the same result of the avg() trigger I mentioned in my post.

[StealthJoe]

You can add dependent item that will use preprocessing with "Simple change". Next you can use count function in trigger to alarm on to many changes.
Data for dependent will look like: 0 0 -1 1 0 0 0 -1 1 0 0 0 0 -1 0 0 1 0 0 0 -1
value go up 1, value go down -1, and 0 value no change.
Example trigger function: count(60m,1) - number of values for last 60 minutes that equal 1

Yes! Thank you! This is exactly what I need.

[jfpatenaude]

It is to be noted that "Simple change" only returns a value when it's a "positive difference". Anything negative is ignored. (***)

In cases where the transition difference is bigger than 1 and you want to use "count(60m,1)" you could use additional Javascript pre-processing: return (value != 0 ? 1 : 0) which would always return "1" for any non-zero value.



(***) The "Simple change" behaviour toward negative values is related to counter rollovers.

[maria_abr]

You can add dependent item that will use preprocessing with "Simple change". Next you can use count function in trigger to alarm on to many changes.
Data for dependent will look like: 0 0 -1 1 0 0 0 -1 1 0 0 0 0 -1 0 0 1 0 0 0 -1
value go up 1, value go down -1, and 0 value no change.
Example trigger function: count(60m,1) - number of values for last 60 minutes that equal 1

Hi. I like this idea and want to try it. Can you tell me how to create a dependent item? I tried to create one with preprocessing with the same key icmpping, but Zabbix returns an error that Item with key "icmpping" already exists? Should I configure it different?

[cyber]

Pinging every minute? So sum of values has to be 60 for one hour period, if everything is fine... if sum is less than 55, you have an issue.