Understanding the change function in an trigger expression

[brhunt]

Hello,

I am trying to understand how this trigger expression operates: {host:system.uptime.change(0)}<0

This is used to indicate when a server has been rebooted. It works, I just can't figure out how.

I cannot find any reference in the Zabbix documentation that shows the change function as able to accept a parameter. The documentation only states that it will give the difference between the N and N-1 values.

So, what does passing a '0' to the function do? Any why isn't the ability to do this in the documentation?

Thanks.

Bryan Hunt

[Semiadmin]

Hi, brhunt.
It's just a deprecated syntaxis from v2.0 and below. Better use change(). You may see such examples here:
https://www.zabbix.com/documentation...ers/expression

[brhunt]

Semiadmin,

Thanks for the reply.

So does the '0' in this case mean within the last 0 seconds? And is that functionally the same as change() with no parameter? {host:system.uptime.change(0)}<0 is functionally the same as {host:system.uptime.change()}<0 ?

If so, then I am guessing this is how the expression works:

- Assume that the server has been up for 1 hour (3600 seconds) and is rebooted.
- After reboot, the first time the trigger is evaluated (let's say 30 seconds after reboot), the formula would be: last-value - previous-value (from before reboot) = 30 - 3600 = -3570 which is less than zero, so trigger fires.
- The next time the trigger is evaluated (let's say 60 seconds later), the formula would be: last-value - previous-value = 90 - 30 = 60 which is greater than zero, so trigger does not fire.

Does this sound right? Is the previous-value in this case from value before reboot?

Thanks.

Bryan Hunt

[Semiadmin]

Yes, brhunt, your guess is correct.