Ad Widget

Collapse

How trigger checking works when with log type item

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • pioterus
    Junior Member
    • Jul 2020
    • 9

    #1

    How trigger checking works when with log type item

    I have item type 'log'. Trigger expression (part) is this:
    ({server:log[{$SCRIPTS_MONITORING},,,,skip].count(25h,"some_string",like)}=0)
    and
    ({server:log[{$SCRIPTS_MONITORING},,,,skip].dayofweek()}=1
    .....


    It should react on lack of 'some_string' in the log only when Monday. On Monday some service should run and leave 'some_string' in the log. Zabbix notifies if not run.

    The problem is with the behavior of this trigger.
    What I found is that items of the type log are updated only when something is written to log file, only than triggers with such items are evaluated. And all my triggers (except this) uses only this kind of expression:
    ...log[{$SCRIPTS_MONITORING},,,,skip].count(xx,"some_string",like)}=0

    But in this one I added checking the day of week. And this trigger was evaluated every 30s (so generated so many problems, because I have setup 'PROBLEM event generation mode' to multi. The same mode on triggers mentioned above generates problems only when log file is updated.

    So I'm confused with this trigger behavior. How it actually works? Why it was evaluated every 30s, even without log being updated? Why other very similar behaves differently?
    Regards
    P.
  • Hamardaban
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • May 2019
    • 2713

    #2
    If time-based functions (nodata(), date(), dayofmonth(), dayofweek(), time(), now()) are used in the expression, the trigger is recalculated every 30 seconds by a Zabbix history syncer process. If both time-based and non-time-based functions are used in an expression, it is recalculated when a new value is received and every 30 seconds.


    Comment

    • pioterus
      Junior Member
      • Jul 2020
      • 9

      #3
      Of course, it was in documentation ;-) Thanx

      Comment

      Working...