Uptime and service restart false positive alerts

[jhboricua]

The uptime and service triggers sends out an alert if the system uptime or a service has been up less then 10 minutes. We use Chef to install/configure the Zabbix Agent in our systems and auto-registration rules to apply the templates. What we are seeing is that when a new system is bootstrapped and the agent is installed and registers, we are immediately spammed with uptime and 'service has been restarted alerts'. Is there a better way for the trigger to take into account new systems that have just been registered in Zabbix so that we don't get these false alerts?

[CarolinaAn]

what happen to this case?

[PeterZielony]

in trigger last(/Windows by Zabbix agent/system.uptime)<10m
you need to add another "and ( <metric that indicates is NOT new system>)
when both are true means isn't a new system.

for a metric that indicates a new system, do you have to research something unique to the deployment? no one knows what is unique about your deployment. It could be even another item for zabbix template that takes
systeminfo | find /i "install date"? pre-process date out and compare if it was today? Add to trigger expression and you are done.


or using registry.. or wmi? wmi.get[<namespace>,<query>]

[jhboricua]

in trigger last(/Windows by Zabbix agent/system.uptime)<10m
you need to add another "and ( <metric that indicates is NOT new system>)
when both are true means isn't a new system.

for a metric that indicates a new system, do you have to research something unique to the deployment? no one knows what is unique about your deployment. It could be even another item for zabbix template that takes
systeminfo | find /i "install date"? pre-process date out and compare if it was today? Add to trigger expression and you are done.


or using registry.. or wmi? wmi.get[<namespace>,<query>]

Peter is correct, the way I solved for this was adding a AND to the existing expression. In my case I looked for the value of the uptime metric that's previous to last. If the value was not higher than 10 minutes, like in the case of a new system, it wont trigger the alert.

Example of new expression in my template:

{Windows by Zabbix agent:system.uptime.last()}<10m and {Windows by Zabbix agent:system.uptime.last(#2)}>=10m