How to set an alert trigger with a specific delay

[SeviK]

Hello everyone!

I have such a task.

My Zabbix 4.4 is monitoring the certificate file that was created on 01/09/2019.
The certificate is valid for one year - 365 days.
I have set two alarm triggers - one month before the certificate expires and the other one 14 days before expiry day.

1. vfs.file.time[{#FILE}].last()}>335
2. vfs.file.time[{#FILE}].last()}>351

The problem is that the trigger does not work properly. Zabbix threw out the alert immediately. Somewhere I made a mistake but I don't know where.

Can any of you tell me where I am making a mistake?


regards,
Seweryn

[gert.derouck]

vfs.file.time gives the Unix timestamp of the file.
Try the following:

vfs.file.time[{#FILE}].now()} - vfs.file.time[{#FILE}].last()} > 28944000
28944000 = 335 days (365 - 30) * 24h * 60m * 60s

[SeviK]

Thank you very much for your reply.
Unfortunately, alerts are still triggered sooner than they should.

I have created a Discovery rule:



Item prototype:



Settings:



And Triggers expression for trigger due in 14 days (before the end of the year):

1. vfs.file.time[{#FILE}].last()}>28944000

If you can spot something wrong. please let me know.

[gert.derouck]

did you add the whole line in the trigger definition:
vfs.file.time[{#FILE}].now()} - vfs.file.time[{#FILE}].last()} > 28944000

[SeviK]

no gert.derouck

just second part:

vfs.file.time[{#FILE}].last()} > 28944000

but will change it to your example

vfs.file.time[{#FILE}].now()} - vfs.file.time[{#FILE}].last()} > 28944000


thanks

[SeviK]

Thanks gert.derouck

Sorry for not coming back so long with a result.

I set the expression in Trigger prototype according to your example.

However, I had to turn off these triggers because it was bombarded with alerts that I wasn't able to close constantly.

I hope to come back to it again soon and make it in a different way.

Many thanks