Zabbix Trigger Timeout

[qwertysqwerty]

I have a trapper item type with key "example" capturing text information. The associated trigger looks like:

{myserver:example.iregexp("/string/")}=0

In this particular case, the I require this trigger to stop showing up on the "monitoring" > "triggers" dashboard after n-minutes.

Is there a way (without specifying a global configuration change) to achieve this?

I tested with:

{myserver:example.iregexp("/string/",60)}=0

As per the Zabbix documentation, i.e. "iregexp (pattern, <sec|#num>), but had no luck.

[BDiE8VNy]

Zabbix trigger functions can be separated in time-based and non time-based functions.
The latter represent the majority of the available functions.

A trigger based on (exclusively) non time-based functions is only evaluated when the corresponding items get a new value. Even when the function supports time related parameter. Actually when a new value is synchronized to the database.

When at least one time-based trigger function is used, then the trigger gets (additionally to each new value) evaluated every 30 seconds.

See: Triggers

This trigger expression for instance is TRUE when '/string/' matches within 1 minute and the item received a value within the same period:

{myserver:example.iregexp("/string/",1m)}=1 AND {myserver:example.nodata(1m)}=0

Personally I prefer to ensure consistency by using a user macro for the period:

{myserver:example.iregexp("/string/",{$TRIGGER_TIMEOUT})}=1 AND {myserver:example.nodata({$TRIGGER_TIMEOUT})}=0

Example derived from: Trigger examples

[qwertysqwerty]

Thanks for your reply. Q: Does this require a certain version of Zabbix or are compound triggers supported from way back? (Having trouble applying this to test)

[qwertysqwerty]

...

A trigger based on (exclusively) non time-based functions is only evaluated when the corresponding items get a new value...

This doesn't explain why when I fire nothing into the trapper item, i.e. `zabbix_sender ... -o ""` the trigger is still present. I'd have though that since the trigger is looking for the expression 'xml' on each new value that not finding it would turn the trigger from "PROBLEM" to "OK".

[BDiE8VNy]

Trigger hysteresis is at least supported since release 1.4 - probably longer, what I don't know

Considering:

{myserver:example.iregexp("/string/",60)}=0

Then this expression is only evaluated when item 'example' gets a new value, since iregexp() is a non time-based trigger function.
So the expression checks for occurrence of '/string/' within the last 60 seconds, but only when the item gets a new value. If no item value gets send e.g. by zabbix_sender, then the expression gets not (re-)evaluated.

[Alex_SYB]

I have a similiar issue trying to get an event to turn off for a log reading item

{Linux:log[/log/app.log,"Remote service timeout",,,skip,].count(24h)}>0 and {Linux:log[/log/app.log,"Remote service timeout",,,skip,].nodata(24h)}=0

if I don't see the value re appear after 24 hours I want the trigger to go away.

They don't seem to be !

[BDiE8VNy]

A combination with another trigger function like count() would be beneficial, when the item might get different messages but only specific ones should be considered.
If I understand your use case right, then the item gets only messages to consider. So checking whether the item got any data for the a period should be sufficient.

{Linux:log[/log/app.log,"Remote service timeout",,,skip,].nodata(24h)}=0

[Alex_SYB]

Um yes I think so.

Basically I look for a specific string in a log file. Then I trigger an event.

But how does the trigger get cleared from zabbix, right now it shows up and its acknowledged, and its past 24 hours but still triggered!

[BDiE8VNy]

Maybe show your exact (if necessary, anonymized) item key and trigger expression of related elements.
It might be also more convenient to use a rather low period, e.g. 5m. This provides quicker results when testing.

[Alex_SYB]

<item>
<name>Remote service timeout</name>
<type>7</type>
<snmp_community/>
<multiplier>0</multiplier>
<snmp_oid/>
<key>log[/apps/rp/current/log/app.log,&quot;Remote service timeout&quot;,,,skip,]</key>
<delay>1</delay>
<history>90</history>
<trends>365</trends>
<status>0</status>
<value_type>2</value_type>
<allowed_hosts/>
<units/>
<delta>0</delta>
<snmpv3_contextname/>
<snmpv3_securityname/>
<snmpv3_securitylevel>0</snmpv3_securitylevel>
<snmpv3_authprotocol>0</snmpv3_authprotocol>
<snmpv3_authpassphrase/>
<snmpv3_privprotocol>0</snmpv3_privprotocol>
<snmpv3_privpassphrase/>
<formula>1</formula>
<delay_flex/>
<params/>
<ipmi_sensor/>
<data_type>0</data_type>
<authtype>0</authtype>
<username/>
<password/>
<publickey/>
<privatekey/>
<port/>
<description>Remote service timeout found in app.log</description>
<inventory_link>0</inventory_link>
<applications>
<application>
<name>YB Reverse Proxy Linux</name>
</application>
</applications>
<valuemap/>
<logtimefmt/>
</item>




<trigger>
<expression>{Linux:log[/apps/rp/current/log/app.log,&quot;Remote service timeout&quot;,,,skip,].count(24h)}&gt;0 and {Linux:log[/apps/rp/current/log/app.log,&quot;Remote service timeout&quot;,,,skip,].nodata(24h)}=0</expression>
<name>Remote service timeout found in log in last 24 hours</name>
<url/>
<status>0</status>
<priority>4</priority>
<description></description>
<type>0</type>
<dependencies/>
</trigger>

[BDiE8VNy]

Hmm, ad-hoc I don't see any mistake.

Do you have double checked whether the item and trigger are 'Enabled' and not 'Not supported', resp. 'Unknown'?

Possibly give this for testing purposes a try as well:

{Linux:log[/log/app.log,"Remote service timeout",,,skip,].nodata(5m)}=0

Manually writing proper messages to the log that match the item pattern to see that values arrive might be worth to try too.

[Alex_SYB]

no everything seems okay, except the trigger doesn't go away.

I have to remove the template and then re add