Unable to trigger on file size

[pmurtey]

Hi All,
We are trying to set up a trigger on a log file that is constantly being written to, and wish to alarm when there has been no activity in the log. We have set up the key as :
vfs.file.size[/data01/usr/log/Notifier/notifier.log] and it finds the log and presents the size in the Latest data graph. We are trying to alarm if the log hasn't been written to in 1 hour. Now, we set up the trigger as: {servername:vfs.file.size[/data01/usr/log/Notifier/notifier.log].last(0,1h)})=0 but we get the following message:
Invalid parameter "/1/expression": incorrect trigger expression starting from "})=0 If we use the vanilla command of {servername:vfs.file.size[/data01/usr/log/Notifier/notifier.log].last()}=0 the system accepts
this trigger but it doesn't do anything in the way of alerting. Could someone please share what we may be missing.

TIA

[tim.mooney]

You have an extra closing ')' in your expression, I think. Compare what's immediately before the = in the working vs. non-working scenarios.

It really can help to use the exression-builder, even as just a point of comparison.

Also, I don't think you want last() for this, I think you want delta().

[pmurtey]

Hi Cyber, Our customer wants to know if there is no growth of the file in the last hour. I went ahead and removed the extra ) as suggested by Tim, and it accepted the expression, but when the log stops writing it doesn't appear to do anything. I tried substituting .delta(0,1h)}=0 as Tim suggested and I get an error incorrect trigger function , invalid first parameter.

[pmurtey]

Hi Tim, I even tried the solution you posted in https://www.zabbix.com/forum/zabbix-...for-15-minutes of using the .delta(15m) == 0 and I get " Invalid parameter "/1/expression": incorrect trigger expression starting from "{servertname:vfs.file.size[/data01/usr/log/Notifier/notifier.log].delta(15m)==0".

[johndoe2374]

I guess if you're using vfs.file.size you can also try to use change() function for your condidion. For example you collect your filesize data once an hour and change() will calculate difference between sizes in bytes. "Small amount of new bytes" - low activity, "0" - no activity at all. Function delta() is probably doing the same, but I didn't find it in expression builder.

[johndoe2374]

It is there, really..



But I must agree, change() might be better in this case. If there is a change in size and it is positive, then everything is fine... Delta will not tell you, has it been growing or shrinking..

Well, I guess your screenshot is from 5.0 LTS version, and I can swear I saw this function previously when I had it installed on my server. But now I've updated it to 5.4.3: all functions are categorized and I still can't find it when creating any trigger.

[johndoe2374]

It's still mentioned on these pages:

https://www.zabbix.com/documentation/current/manual/config/triggers/prediction

https://www.zabbix.com/documentation...s/prediction?s[]=delta

Oh, actually I've found it in manual's changelog:

https://www.zabbix.com/documentation/current/manual/introduction/whatsnew540

"delta function has been removed, you should use max-min instead"

Zabbix have a great documentation but still sometimes lacks very important info and very often you have to find it yourself by experimenting and observation.

[johndoe2374]

hmm .. "max (<value1>,<value2>,…) - min (<value1>,<value2>,…)" ... computer says no... if there is no time period option..
valueX - value returned by one of history functions (change, count, countunique, find, first, fuzzytime, last, logeventid, logseverity, logsource, nodata, percentile, trendavg, trendcount, trendmax, trendmin, trendsum).
OK... trendmin and trendmax can give min and max values for 1h period... so I don't need min-max, can use those values directly... But if I need delta for 15 or 30 minute period, I am still in poop...

But this has moved far far away from initial question

No, I believe you use trendmin and trendmax to work with trend values, not actual values. Corresponding to this page:

https://www.zabbix.com/documentation/current/manual/appendix/functions/aggregate

Example:
⇒ max(/host/key,1h) - min(/host/key,1h) → calculate the difference between the maximum and minimum values within the last hour¹ (delta of values)

So, I believe pmurtey's trigger would look like that:

1. No difference between values for 1h:

max(<hostname>/vfs.file.size[/data01/usr/log/Notifier/notifier.log],1h)-min(<hostname>/vfs.file.size[/data01/usr/log/Notifier/notifier.log],1h)=0

2. Insignificant difference (less than 100 bytes):

max(<hostname>/vfs.file.size[/data01/usr/log/Notifier/notifier.log],1h)-min(<hostname>/vfs.file.size[/data01/usr/log/Notifier/notifier.log],1h)<=100

[pmurtey]

Hi All, Using delta(15m)}=0 is working great for us. Thank you for helping with the syntax. Is there anything thats different that we need to be aware of if monitoring rotating logs?

[cyber]

Why use vfs.file.size at all, when there is vfs.file.time ?

[cyber]

use single =, not == and you seem to miss closing }
it shoudl look like this
{servertname:vfs.file.size[/data01/usr/log/Notifier/notifier.log].delta(15m)}=0
As Tim suggested, use expression builder, it helps to avoid such simple typos.....

[cyber]

Function delta() is probably doing the same, but I didn't find it in expression builder.

It is there, really..


But I must agree, change() might be better in this case. If there is a change in size and it is positive, then everything is fine... Delta will not tell you, has it been growing or shrinking..

[cyber]

Mine was from 4.4.. and is same for 5.0.. I have no newer installed here..
But looking at

https://www.zabbix.com/documentation/current/manual/appendix/functions

you are right.. there is no delta() any more... also no diff() (can be replaced with change()) .... regexp() and iregexp() are gone, but there is now find()..
But it still leaves me thinking how delta is replaced...?

[cyber]

hmm .. "max (,,…) - min (,,…)" ... computer says no... if there is no time period option..
valueX - value returned by one of history functions (change, count, countunique, find, first, fuzzytime, last, logeventid, logseverity, logsource, nodata, percentile, trendavg, trendcount, trendmax, trendmin, trendsum).
OK... trendmin and trendmax can give min and max values for 1h period... so I don't need min-max, can use those values directly... But if I need delta for 15 or 30 minute period, I am still in poop...
But this has moved far far away from initial question

[cyber]

Hah! I was looking at wrong max and min...:P Those are described also under mathematical functions, which was the first to pop up for me..Of course, they will work as needed, if used as described under aggregate functions.. Documentation mess...