Help with Hysteresis

[akbar415]

Hello.
I have a lot of web scenarios in zabbix and they are annoying me with triggers.

So, I decided configure the triggers with hysteresis. But now I have false positives.

This is the way I configured the triggers

({TRIGGER.VALUE}=0 and
{frontend01:web.test.fail[InitialPage].sum(3m)}>1)
or
({TRIGGER.VALUE}=1 and
{frontend01:web.test.fail[InitialPage].sum(4m)}=0)

Someone can help me please.

[akbar415]

This is drive me nuts.

I already tried this two ways with no success

{TRIGGER.VALUE}=0 and
{srvwww:web.test.fail[InitialPage].sum(5m)}>1)
or
({TRIGGER.VALUE}=1 and
{srvwww:web.test.fail[InitialPage].sum(4m)}=0)

and

({TRIGGER.VALUE}=0 and
{srvwww:web.test.fail[InitialPage].last(#1)}=1 and
{srvwww:web.test.fail[InitialPage].last(#2)}=1 and
{srvwww:web.test.fail[InitialPage].last(#3)}=1)
or
({TRIGGER.VALUE}=1 and
{srvwww:web.test.fail[InitialPage].last(#1)}=0 and
{srvwww:web.test.fail[InitialPage].last(#2)}=0 and
{srvwww:web.test.fail[InitialPage].last(#3)}=0)

None of this worked. The trigger keep flapping between status every 30s.
Anybody can help me.



Sorry for the bad englsih.

[ArtemK]

second condition defines rule for trigger to stay in problem state, i.e. don't switch to OK, until web page is available at least 5 minutes:

{TRIGGER.VALUE}=0 and
{srvwww:web.test.fail[InitialPage].sum(5m)}>1)
or
({TRIGGER.VALUE}=1 and
{srvwww:web.test.fail[InitialPage].max(5m)}#0)

* "#" symbol was replaced in 2.4, I don't remebmer is it "<>" now or what, check docs.

max(5m)}#0 defines, that this trigger remains in problem state, until all values for web.test.fail key are 0 (web check is performed successfully) for 5 minutes.

[akbar415]

second condition defines rule for trigger to stay in problem state, i.e. don't switch to OK, until web page is available at least 5 minutes:

{TRIGGER.VALUE}=0 and
{srvwww:web.test.fail[InitialPage].sum(5m)}>1)
or
({TRIGGER.VALUE}=1 and
{srvwww:web.test.fail[InitialPage].max(5m)}#0)

* "#" symbol was replaced in 2.4, I don't remebmer is it "<>" now or what, check docs.

max(5m)}#0 defines, that this trigger remains in problem state, until all values for web.test.fail key are 0 (web check is performed successfully) for 5 minutes.

Thanks ArtemK.

My trigger don't works because I got it wrong. I thought the expression was "the situation that will take out the alarm", no that the trigger will remains until ...
thanks.

[ArtemK]

you are welcome! Alexei explained hysteresis quite well in this blog post (check comments also)