How to recover a snmp trap item trigger with another snmp trap item value

[Bundes44]

Hello,

I can't find the correct expression to recover triggers fired in phase 1 and phase 2 in the following use case :



Here is our trigger for an incident:

{[ITEM 1].strlen()}>1 and {[ITEM 1].nodata(1s)}=0

I tried to give to this trigger the following recovery expression (unsuccesfully):

{[ITEM 2].nodata(1s)}=0 and {[ITEM 2].str({ITEM.VALUE)}=1

I tried ITEM.VALUE, ITEM.VALUE1, ITEM.LASTVALUE, ITEM.LASTVALUE1... But It seems that I can't use these macros in the recovery expression, I must miss something.

When I put a string in it, it works, ex:

{[ITEM 2].nodata(1s)}=0 and {[ITEM 2]. str("ALPHA")}=1

So, how could we recover Triggers fired in phase 1 and 2 with Item values collected in phase 3 and 4 in another item ?

I would really appreciated if you had any clue to resolve this use case...

[Bundes44]

That was the missing part

We were confused by trying to use macro in recovery expressions.

Event correlation + additional tags made it works fine.

Many Thx

[tfineberg]

Hi Bundes44 ,

Would you post how you are tagging the SNMP traps that come in? Are you extracting any data from the SNMP trap to fill the Tags?

I have been trying to do this but keep getting the full SNMP message in the tag not the regx value.

Here is a link to my post about this ,

https://www.zabbix.com/forum/zabbix-help/431520-regex-help-extract-data-from-snmp-trap-to-tag-s

Thanks

Tao