Trigger for interface traffic speed too low: unexpected problems and brief recoveries

[catkins]

One of our Internet Leased Line (ILL) interface bits received periodically drops to less than 1 Mbps. It is not down but starts to carry very little traffic. We want Zabbix to tell us when that happens.

It should have been an easy trigger to create but the trigger has gone into problem state ~3 hours after being updated and stayed there during two daily peaks. Three times in 2 days the trigger has recovered for 3 or 6 minutes (1 or two sample intervals)

The current trigger problem expression is

(
  (
    {edge1.iciti.av:net.if.in[ifHCInOctets.7].last()} - {edge1.iciti.av:net.if.in[ifHCInOctets.7].last(#3)}
  )
  *
  (
    8/(60*3*2)
  )
) < 1000000

Notes

• last(#3) rather than prev() to reduce spurious problems but has not worked
• 8 converts from octets to bits
• (60*3*2) is the number of seconds between two sample taken at 3 min intervals
• The recovery expression is identical to the problem expression except < is changed to >=
• The interface traffic received speed graph, based on the same [ifHCInOctets.7] item, looks normal

Why does the trigger go into problem state? Why does it recover briefly?