Help trigger with history data

[andvsilva]

Hey guys,

Can anyone help me with a trigger.

I need to create a trigger to validate the last 5 hours from now if the item value is equal to '3' if there is any value different of '3' in the last 5 hours the alert should not be closed.

I tried, but it didn't work. This is recovery expression:

count (/ITEM.LASTVALUE,4m:now-1h, "eq", "3") = 1

This is a trigger problem:

count (/ITEM.LASTVALUE,#3, "ne", "3") = 3

I'm following zabbix doc, but I probably got something wrong:

4 History functions (zabbix.com)

Thank you for your help.

[ISiroshtan]

I'm not sure I understood it precisely, but let me try to answer and you correct me if my understanding is wrong.

TASK:
You have the trigger that properly fires up. You just need to close it only if ALL values in last 5 hours are "3". If ANY of the values in last 5 hours is not "3" - don't close the alert.

Now

count (/ITEM.LASTVALUE,4m:now-1h, "eq", "3") = 1

means that if you have exactly one value "3" in between 64 and 60 minutes ago - close the trigger. Which does not really sounds like what you trying to achieve.

Please try this recovery expression:

count (/ITEM.LASTVALUE,5h,"ne",3) = 0

or

count (/ITEM.LASTVALUE,5h,"ne","3") = 0

[ISiroshtan]

I'm not sure I understood it precisely, but let me try to answer and you correct me if my understanding is wrong.

TASK:
You have the trigger that properly fires up. You just need to close it only if ALL values in last 5 hours are "3". If ANY of the values in last 5 hours is not "3" - don't close the alert.

Now

count (/ITEM.LASTVALUE,4m:now-1h, "eq", "3") = 1

means that if you have exactly one value "3" in between 64 and 60 minutes ago - close the trigger. Which does not really sounds like what you trying to achieve.

Please try this recovery expression:

count (/ITEM.LASTVALUE,5h,"ne",3) = 0

or

count (/ITEM.LASTVALUE,5h,"ne","3") = 0

[cyber]

ITEM.LASTVALUE ? Should it not be /host/key there?
I'm getting a bit suspicious if someone uses macro names with wrong format.. Never know, what they mean exactly..:P

[andvsilva]

I'm not sure I understood it precisely, but let me try to answer and you correct me if my understanding is wrong.

TASK:
You have the trigger that properly fires up. You just need to close it only if ALL values in last 5 hours are "3". If ANY of the values in last 5 hours is not "3" - don't close the alert.

Now

count (/ITEM.LASTVALUE,4m:now-1h, "eq", "3") = 1

means that if you have exactly one value "3" in between 64 and 60 minutes ago - close the trigger. Which does not really sounds like what you trying to achieve.

Please try this recovery expression:

count (/ITEM.LASTVALUE,5h,"ne",3) = 0

or

count (/ITEM.LASTVALUE,5h,"ne","3") = 0

Hi thanks for your tip, it worked.

count (/host/key,5h,"ne","3") = 0

But why the value is '=0' what is that mean? I don't get why in count I need to set on this way.

This expression say 'count in the last 5 hour if the value is different of "3" ' so 0 is 'false' and 1 should be 'true' ?

[ISiroshtan]

Hi there mate.

Count is a bit different. It's not a true/false expression. It returns number of matched value. So what we ask here of Zabbix is: "count the values in last 5 hours. But only count values that are not '3' ". If Zabbix counted 0 (meaning it found no non-3 values) - then resolve the problem.

If it would find any non-3 values, Count would return the number of those values. So 1,2,3, etc.

Hope it helps mate.

[andvsilva]

ITEM.LASTVALUE ? Should it not be /host/key there?
I'm getting a bit suspicious if someone uses macro names with wrong format.. Never know, what they mean exactly..:P

Sorry my mistake, but i'm using /host/key. I just write down in the wrong format.

[andvsilva]

Hi there mate.

Count is a bit different. It's not a true/false expression. It returns number of matched value. So what we ask here of Zabbix is: "count the values in last 5 hours. But only count values that are not '3' ". If Zabbix counted 0 (meaning it found no non-3 values) - then resolve the problem.

If it would find any non-3 values, Count would return the number of those values. So 1,2,3, etc.

Hope it helps mate.

Hi mate,

All right thanks for explanation. I'm reading doc now and undesrtood your answer.

Thanks a lot.