Zabbix trapper and time delayed trigger

[apalacheno]

Hello,

I'm monitoring an boolean item with a Zabbix trapper. The values are coming in fine, but I cannot seem to get a trigger to work correctly.

The trigger should fire if a "1" value persists for more than 30 seconds (the monitored device sends an alarm status ["1"] every time it is switched on, but clears this alarm status after a few seconds ["0"]).

Now I've tried this trigger expression:

{Template_KNX:3_5_123.min(30)}=1

but the trigger fires immediately as soon as a "1" is coming in.

What am I doing wrong?

Zabbix 2.4.5 on Ubuntu 14.04 with PostgreSQL.

[apalacheno]

Could there be a general issue with Zabbix trapper items and time-based triggers?

Both the following triggers fail in the sense that they fire immediately without waiting for the specified delay time to pass:

{Template_KNX:3_5_123.min(60)}=1

Desired behaviour: Trigger should fire only if the item stays in the problem state (1) for more than 60 seconds.
Actual behaviour: Trigger fires immediately as soon as the problem state is detected.

({TRIGGER.VALUE}=0 and {Template_KNX:3_5_124.last(0)}=1)
or
({TRIGGER.VALUE}=1 and {Template_KNX:3_5_124.max(5m)}=0)

Desired behaviour: Trigger should fire immediately and only be reset if the item returns to normal state (0) for at least 5 minutes.
Actual behaviour: Trigger gets reset immediately.

The item is defined as Numeric (unsigned) information type with data type boolean and an item history storage period of 30 days.

Using latest Zabbix 2.4.7 on all components (server, agent, get).

[apalacheno]

Still chewing on this problem.

Okay, I can use the nodata() trigger function on trapper items. But I don't see how I can specify a grace period in which an alarm status can be received without firing a trigger. The trigger should only be fired if the alarm status persists after the grace period.

Ideas are welcome

[LenR]

I'd suggest you go to "Latest Data" for one of those items, graph it, then switch to Values, just to verify that you data is being captured as you think.

[LenR]

Another thought, do you send the 0 value just to reset it, or every minute?

Here's my thought, value has been 0 for 10 minutes, but not updated. Value of 1 arrives min(60) is now 1, since that is the only value in 60 seconds.

[apalacheno]

Hi LenR,

you may be right with your suspicion. But how to solve this problem?

The pattern is always the same: think of it as a motor that gets switched on. Now imagine the motor has an independent simple monitoring device that gets switched on and off together with the motor and that triggers if the rotational speed is too low. Now the motor gets switched on, and at the beginning, the rotational speed is of course below the threshold, so the monitoring device gets triggered. As the motor spins up it reaches the threshold and the monitoring device is satisfied and switches off the alarm.

The values are as follows, read from bottom to top:

2016-05-10 08:29:02	0 # Motor has reached nominal speed; monitoring device deactivates alarm
2016-05-10 08:28:50	1 # Monitoring device triggers as motor spins up
# Motor and monitoring device get switched on again

# Motor and monitoring device get switched off somewhere in between

2016-05-10 07:02:44:	0 # Motor has reached nominal speed; monitoring device deactivates alarm
2016-05-10 07:02:38	1 # Monitoring device triggers as motor spins up
# Motor and monitoring device get switched on

So every time the motor switches on, it is expected and perfectly normal to cause an alarm for a few seconds. However, in Zabbix this short alarm should be suppressed as it is a normal condition. Only if the alarm stays in the alarm condition for more than the expected time it should cause a notification.

The values are not sent periodically; only on conditional change. So the alarm gets acivated - it sends a '1'. A few seconds later, the alarm gets deactivated, and it sends a '0'.

I need a way to bridge this small gap of a few seconds before actually triggering a trigger(tm) in Zabbix.

From my own experiments in dealing with this problem: I get the impression that either the standard 'max'/'min'/etc trigger functions do not work the same way with Zabbix Trapper items or I'm completely wrong in my assumptions on how trigger functions work.

[apalacheno]

LenR,

your words kept me thinking and I believe I've solved this problem:

{Template_KNX:1_5_90.last()}=1
and
{Template_KNX:1_5_90.nodata(30)}=1

The logic behind this is as follows: The machine gets turned on, so Zabbix receives an '1'. This the last() trigger turns to true. The nodata() function is starting to count. However, after 12 seconds Zabbix receives an '0', thus nodata is reset. At the same time, the last() function turns to false. As the machine keeps running, the nodata() function turns to true after 30 seconds, but the whole AND'ed trigger expression still stays at '0'.

Now for the case where the problem persists for more than 30 seconds: The machine gets turned on, so Zabbix receives an '1'. This the last() trigger turns to true. The nodata() function is starting to count. Since no '0' is received by Zabbix within the expected timeframe, after 30 seconds the nodata() function turns to true as well, and the whole AND'ed trigger expression turns to true, thus firing the trigger.

[Tec_Technician]

Really good Thread i learn a bit about triggers, thanks ;-).

But i have a question :

I have an item as follow:
logrt["{$LOG_PATH}local.log","ERROR|SEVERE|WARN","UT F-8",100]

This item already made the filter to take only the important lines on the log. because we don't want to get all the log...is a really big log.

Now i need a trigger that actives when the item get data. I'm not sure...because all the triggers i saw are excluiding something or filtering something...and i want to trigger whenever it gets info.

Could someone give me a clue?

i check the documentation and think about something like this :

Template_logs:logrt["{$LOG_PATH}local.log","ERROR|SEVERE|WARN","UT F-8",100].diff()}=1

will this work??

Thanks in advance for your comments.

[apalacheno]

Hi!

Beware of your encoding expression; yours contains a blank ("UT F-8", should be "UTF-8")!

I'm not quite sure I get you right. You want a trigger that fires each time a line containing the words 'ERROR' or 'SEVERE' or 'WARN' appears in your log. Is that correct?

If so, the following expression (untested) should do the trick:

{Template_logs:logrt["{$LOG_PATH}local.log","ERROR|SEVERE|WARN",UTF-8",100].nodata(10)}=0

The nodata(10) does the following: As soon as Zabbix detects your specified pattern in the logfile, it activates the trigger, switching the trigger to the PROBLEM state. However, after 10 seconds the normal trigger state (OK) gets restored.

[Tec_Technician]

Thanks a lot for the fast replay ;-).
I think is the fastest replay i ever seen on Zabbix Forums XD.

the blank was because of the copy paste, XD sorry.

well, it looks like that will work. But i dont want the log trigger to come back to OK.

The item will only catch erros with the strings "ERROR|SEVERE|WARN".

I'll active the option "Multiple PROBLEM events generation" to get only problems about logs and don't need the OKs.
(dont want to ACK all OKs too)

The trigger i need is like:

Every time that the item catch something, what ever, trigger!!!
Because the item had already a filter for only problem strings.

Thanks for your help ;-).