Problem by unterstanding a simple expression for triggering

[whisky17]

Hi,

I've got some difficulties in understanding a simple expression for triggering a ICMP-Item:

I'd like to get an alert when 48 pings in series fails.
I've set the problem expression for my trigger: {192.168.1.145:icmpping.last(#48)}=0
I think this works fine.

But now we come to my problem:
I'd like to stop the alarm even if only one single ping will success. My recovery expression is:
{192.168.1.145:icmpping.last()}>0

For instance:
40 pings fail --> no trigger
1 ping success
40 pings fail --> no trigger
1 ping success
80 pings fail --> trigger alarm
1 ping success --> trigger resolved

But my triggers don't work as expected. After e.g. 80 failed pings, the alarm is triggered. OK. But even if there are single pings after this, the alarm isn't resolved.


Can anybody tell me, why?
Thanks!!!
whisky

[whisky17]

Hi cyber,
thanks! It looks like a fundamental misunderstanding of "last". Perhaps I should spend more time in reading the doc exactly ;-)
I've tried your suggestion with "sum" and it works! It sounds clear and simple to forego the recovery expression.

[cyber]

last(#48) is 48th value in list, not all of those 48...

last (<sec|#num>,<time_shift>)
The most recent value.	sec (ignored, equals #1) or #num (optional) - the Nth most recent value time_shift (optional) - evaluation point is moved the number of seconds back in time	Supported value types: float, int, str, text, log Take note that #num works differently here than with many other functions. For example: last() is always equal to last(#1) last(#3) - third most recent value (not three latest values)

sum(#48)=0 means that all your last 48 values have been 0. The moment one ping succeeds (value 1) sum is not 0 any more and trigger should go away. No need for recovery also, remember, recovery expression is additional condition, main expression has to be false and recovery true, then trigger goes OK.

Recovery expression

Logical expression (optional) defining additional conditions that have to be met before the problem is resolved, after the original problem expression has already been evaluated as FALSE. Recovery expression is useful for trigger hysteresis. It is not possible to resolve a problem by recovery expression alone if the problem expression is still TRUE.