max(#) vs. sum(#) - what is faster and better?

[ShivaS]

Hello!

Our zabbix deployment is very large, and becoming even bigger lately. So we decided to review all our templates and improve/optimize it (we use zabbix since 1.1)

I like the # (hash mark) approach as it finally helps to get rid of relying on frequency of checks by using the exact number of checks you need.

You can monitor some service (better say something that always returns either 0 or 1, a boolean type) with max(#3)=0 or sum(#3)=0 (as an example)

What is the difference between those two in terms of effectiveness and even speed?

In official zabbix template http.service monitored with max(#3)=0 for example and I rarely see sum(#) use actually.

So what's better/faster/stronger and why?

Thanks!

[filipp.sudanov]

Most of resources are consumed so the trigger function will get the values to process. This involves storing the values in the value cache (or in the worst case getting them from the database). So if your trigger function does max(24h) or something like, it will consume some resources.
Once zabbix server process got the values, the difference between max(#3) and sum(#3) is inimportant - both will be calculated by some really efficient C code.

[ShivaS]

Thanks Filipp!
I also consulted few C developers today, and everybody told me the same - there is no big difference. But all mentioned that sum could be a bit (a very tiny bit) faster than max. So I suppose there is no "holywar" between max and sum and either one can be used without affecting anything

thanks!