Disk space problem solved in 4m. But it is not true.

[jolalla]

Hello everyone, I am new to the zabbix world, hehe so I am learning little by little, thanks for your patience. I have zabbix 5.0 installed on centos7. I have the alerts configured to be delivered to me by mail and by telegram.

I receive this alert:
E :: Disk space is critically low (used> 90%)


And 4m later I get this message:
Resolved in 4m: E :: Disk space is critically low ((used> 90%)


But it is not true, that is, the disk is still low on space, the problem has not been solved. and the message first: E :: Disk space is critically low (used> 90%) comes to me over and over every 15minutes and followed by the message that the problem is resolved.

Why could this be happening? I think the correct thing is that the message that the problem was solved should only appear once the corresponding space has been freed.

I hope you can help me with this. Thank you

[Glencoe]

What is the actual disk space usage? Any chance you're balancing between low and acceptable?

[jolalla]

Hello Glencoe thanks for answering

The total size of the disk is 3.39TB and only 71GB is left free.

The truth is I am new to zabbix, I have not modified any parameter because I do not know how to do it. I am using the windows template for the zabbix agent.

If you could help me with how to correct this problem, I would appreciate it.

Here I attach the image of where I think the disk configurations of that template are and also how the disk with the Alert is currently

Thanks.

[Markku]

What do your Latest data values show during the events?

Markku

[Markku]

Also note that the screenshot you showed is not related to the triggers you were talking about. See the actual trigger configurations and the template documentation at https://git.zabbix.com/projects/ZBX/.../windows_agent.

Markku

[jolalla]

Hello Markku

Sorry but I have no experience in Zabbix, I am learning and still have a hard time understanding some things.

Currently I keep getting an alert that indicates that the disk is almost full but after 3 minutes or less I get another message indicating that the problem has already been solved. But it is not true, the disk is still the same. And so it becomes a cycle of problem alerts and then problem solved over and over again.
As indicated above I am using the Template OS Windows by Zabbix agent template and I have not made any changes to it.
Here I attach the image of the event.
If you could tell me which part I should go to or what I should modify so that this does not happen, I would appreciate it.


Thanks.

[Markku]

Latest data: go to Monitoring - Latest data, select your host. Then browse to the item that is the disk utilization, click Graph at the end of the line. On top right there is a dropdown menu, select Values, and filter the list so that you see item values for the time interval that you are interested in. See the values.

But anyway, you know your disk is really very full, only 2% is free. When you check the trigger configuration (or the link I sent) you see there is the prediction function "timeleft" used in the trigger. It uses the previous values of the item and tries to figure out where the item values are going in the future. So, since you apparently have the disk usage fluctuating, the trigger is occasionally "seeing" that the disk space will run out very soon, thus it triggers.

How to solve it? Free some disk space so that you are not running at risk, or go to the template and edit the trigger prototype in the discovery rule for the disks so that you modify or remove the predictive component from the trigger expression if you are happy with an almost full disk.

(Btw I'm using 5.0 so I don't know if there are some small differences in the GUI compared to 5.4.)

Markku

[jolalla]

Hello Markku , thank you very much for answering

Sorry for my lack of experience, I went to template os windows by zabbix agent > linked templates > Template Module Windows physical disks by Zabbix agent > Discovery rules and finally to Trigger prototypes and there I see those options of the image that I attach here. Where I can disable predictive component from the trigger?

For now I prefer to take that option and so avoid that cycle of alerts that arrive every 5 minutes. It is the disk of a customer that I have already alerted him to the problem of disk space on many occasions but he prefers not to receive so many repetitive alerts of problems and solved over and over again.

Sorry for my bad english, im from Chile. Thanks.

[Markku]

As you noticed, that is not the correct template. See for a "Windows filesystems" template and the discovery rules there.

Markku

[jolalla]

Markku I think I am in the correct template now. What should I disable or modify there?

Thanks for your help

[jolalla]

Hello Markku I think I am in the correct template now. What should I disable or modify there?

Sorry is me again but I have not been able to solve this issue and I still get many problem alerts and after 3min. problem solved, and so on over and over again.

Thanks for your help

[Markku]

From

{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and (({Windows filesystems by Zabbix agent:vfs.fs.size[{#FSNAME},total].last()}-{Windows filesystems by Zabbix agent:vfs.fs.size[{#FSNAME},used].last()})<5G or {TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].timeleft(1h,,100)}<1d)

to

{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ({Windows filesystems by Zabbix agent:vfs.fs.size[{#FSNAME},total].last()}-{Windows filesystems by Zabbix agent:vfs.fs.size[{#FSNAME},used].last()})<5G

Markku

[jolalla]

Hello Markku thanks again

I tried to replace the existing expression with the one you sent me but doing it and applying the update throws me the error that I attach in the image. I am doing something wrong ?

[Glencoe]

TEMPLATE_NAME is just an example. You are supposed to put your real template name there. It would be more productive if you understood the syntax for trigger expressions, at least in general. It's not that difficult: https://www.zabbix.com/documentation...ers/expression

The idea Markku suggested to remove the last part of expression ...timeleft() < 1d