Need help adjusting the trigger

[igalsc]

Hello fellow Zabbix users,
I have another question, hope you would be able to help me here.
I'm on Zabbix 5.2
I'm trying to alert whenever our APIs are slow to response (i.e., response time higher than 3 sec).
I have this configuration in the Problem Expression:

{Analytics API 3.x PROD:web.test.time[Analytics API 3.x PROD,Analytics API 3.x PROD,resp].last(#1,1)}>=3

However, I got these alerts as a problem today:
Analytics API 3.x PROD response time is 1s 332ms

According to this post https://www.zabbix.com/forum/zabbix-...-response-time, web.test.time>=3 should be treated as higher or equal to 3 seconds, but I get alerted on a way lower response time

Thanks ahead,
Igal

[igalsc]

Today I got alerts about response time of 1.6sec
can anyone enlighten me, please?

[igalsc]

Why are you using time shift (second parameter for last())? In this case you are triggering one check later and most probably displaying latest value in event? Just out of curiosity... check if the previous value was more than 3sec...

Good question. So, based on what you just asked, I should be doing

{Analytics API 3.x PROD:web.test.time[Analytics API 3.x PROD,Analytics API 3.x PROD,resp].last(#1)}>=3

?

[igalsc]

Yes, if you want it based on last value, then last(#1) or just last().

Thank you, cyber !

[igalsc]

I'm still confused

I have a trigger with the following config:

Name	{HOST.NAME} response code
Operational Data	{HOST.NAME} response code is {ITEM.LASTVALUE}
Problem Expression	{FTR Twitter:web.test.rspcode[FTR Twitter,FTR Twitter].last()}<>200
Recovery expression	{FTR Twitter:web.test.rspcode[FTR Twitter,FTR Twitter].last()}=200

It triggers as Problem: FTR Twitter response code, with Opdata FTR Twitter response code is 200

When I check the trigger, it's state is OK, but it was fired, and it stays "unresolved" in terms of alerts
What is wrong with my trigger configuration?

Thanks ahead
Igal

[yurtesen]

You do not need a recovery expression. Because you are checking if last value is NOT 200. It will recover automatically if last value is 200. Anyway...
Click on the Time index on the unresolved event and open Event Details and check operational data. If it makes no sense, send screenshot.

[igalsc]

You do not need a recovery expression. Because you are checking if last value is NOT 200. It will recover automatically if last value is 200. Anyway...
Click on the Time index on the unresolved event and open Event Details and check operational data. If it makes no sense, send screenshot.

I do want to receive a notification when the issue is resolved, that's why I do put the recovery expression.

As for the trigger - it kind of makes no sense to me. It triggers "problem" with response code 200

[yurtesen]

Your event is resolved. Your screenshot says "Resolved by: Trigger"
Also your screenshot is missing the "Event List [Previous 20]" section
See:https://www.zabbix.com/documentation...iewing_details
If your event was NOT resolved, there would not be a "Resolved by" section.
You said event stays unresolved. Where do you see "unresolved"?

Whether you receive recovery information or not does not depend on the trigger recovery expression. It is just a recovery expression for a trigger. The messages are adjusted from Actions.

https://www.zabbix.com/documentation/current/manual/web_interface/frontend_sections/configuration/actions

[igalsc]

Your event is resolved. Your screenshot says "Resolved by: Trigger"
Also your screenshot is missing the "Event List [Previous 20]" section
See:https://www.zabbix.com/documentation...iewing_details
If your event was NOT resolved, there would not be a "Resolved by" section.
You said event stays unresolved. Where do you see "unresolved"?

Whether you receive recovery information or not does not depend on the trigger recovery expression. It is just a recovery expression for a trigger. The messages are adjusted from Actions.
https://www.zabbix.com/documentation...ration/actions

Thank you for your replies.
When I'm saying the event seem to be not resolved I mean I do not see it in the notifications. Here are two examples of resolved vs unresolved notifications in Slack



I do want to receive the actual response code at the time the alert is triggered.
I also want to receive notification when the response code is back to normal (200 in this case).


As a side note - what does the "(UNKNOWN)" stand for here? What field is it looking for?

[yurtesen]

Well now you did not mention Slack at all before. It is a very different problem than what you explained before.

See Slack related documentation:
https://www.zabbix.com/documentation...ications/media

https://www.zabbix.com/integrations/slack

You can also choose between two notification modes:

• alarm (default)
  • Update messages will be attached as replies to Slack message thread
  • Recovery message from Zabbix will update initial message
• event
  • Recovery and update messages from Zabbix will be posted as new messages

I think you want the 2nd type....

Normally where it says UNKNOWN, there is the IP address of the interface/host. Again, you should check the Slack configuration. All the information you need is there and you can adjust the messages any way you want. See the "script" which is used for Slack media type.

{
title: 'Host',
value: '{0} [{1}]'.format(params.host_name, params.host_ip),
short: true
}

[igalsc]

Thank you for your help, yurtesen !

[cyber]

Why are you using time shift (second parameter for last())? In this case you are triggering one check later and most probably displaying latest value in event? Just out of curiosity... check if the previous value was more than 3sec...

EDIT: My posts here are out of sequence due to human error and restoring of posts, try to fit them between other posts in thread, you should get a bit more clear picture.

[cyber]

Yes, if you want it based on last value, then last(#1) or just last().

[cyber]

Having no recovery expression does not mean, that you are not getting notification when problem is resolved.

You are using {ITEM.LASTVALUE} in Operational data field...
https://www.zabbix.com/documentation...iggers/trigger

Operational data

Operational data allow to define arbitrary strings along with macros. The macros will resolve dynamically to real time data in Monitoring → Problems. While macros in the trigger name (see above) will resolve to their values at the moment of a problem happening and will become the basis of a static problem name, the macros in the operational data maintain the ability to display the very latest information dynamically.