Trigger does not work - "Cannot convert expression..." - Zabbix 5.4.3

[um3n]

Hey guys,

we have a problem with one trigger, that dont want to work, because of a "cannot convert"problem.

In this scenario we want to get an alert, when the item gets a value in the last two ours. Therefore we created an "log" item with the following
item key.

log[/var/log/auth.log,"Failed password for ([a-z]+)",,,,\1]

So we just get the username of the Logentry and only if there is a failed login.
The trigger should work, but there is the issue with the expression result converting.

length(last(/cs-web01/log[/var/log/auth.log,"Failed password for ([a-z]+)",,,,\1]))>=1

Anyone an idea what is causing this issue? We are a littlebit confused

Thanks alot! Kind regards,

Ulli

[um3n]

Anyone here with some help?

[johndoe2374]

Hello. Try to use nodata() function like I'm using in this example:

https://www.zabbix.com/forum/zabbix-help/363539-log-monitoring-trigger?p=430020#post430020

[um3n]

I will use your nodata() trigger to achieve my goal about the notification for the security log - thanks for that !

[um3n]

The delete and recreate solution did the trick.
Problem solved!

THANKS to all of u!

[cyber]

Cannot say anything about that error, but isn't this trigger always true, if there is at least one value received? Because last has always some length until history expires?
EDIT: there is very similar issue here

https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/426245-trigger-

...

[cyber]

As I said, OOB template comes with a "default" macro, which has no context, like "/" or "/home" as template creator cannot know, what kind of mountpoints you have and thresholds for them, so it is made to work with "default values" ... But trigger prototypes have been created using such context macros (using {#FSNAME} LLD macro in them), just in case, so you could "fine tune" things. If macro with context does not exist, it will fall back to a macro without context. It is all described here ->

https://www.zabbix.com/documentation/current/manual/config/macros/user_macros_context

So basically you need to add that user macro with context to either a host(s), if you need to fine tune it on each one, or add it to template, if you can get away by adding same threshold for particular mountpoint on all servers...
For adding to all hosts, select hosts from your host list, click mass update, navigate to "Macros" and add {$VFS.FS.PUSED.MAX.CRIT:"/"} with appropriate value (this will be used for root FS). At first it will be same for all, then you can go into each hosts config and "fine tune" it. But this is not really a sustainable approach...
I don't think you have different setup for each host there... You probably can group your hosts by available resources, clone OOB template for each group and add appropriate macros/values for each group and assign those templates instead of the OOB one. And even after that you can fine tune even more and add same macro on host level, which overrides your template level one..
Or you can make a "macro templates".. Create a new template for a group of hosts, insert only those macros and then "link" it to the OOB template. Then you can link a host to "macro template" and it will automatically include all OOB template things, but you have now all needed macros also.

https://www.zabbix.com/documentation/current/manual/config/macros/user_macros

Ok so what seems to have happened is, when I was trying to figure out expressions, I saved it with something that gave that error. But then all the updates I've done to it since don't clear/remove that error. Because now that I have deleted the trigger and re-created it, it works perfectly.

It really sounds quite ridiculous, but just try it... delete trigger and recreate it..:P