Trigger Expression and Template Help

[csmall]

I am trying to understand the best way to modify this templates trigger expression to only fire if the duration is longer than 5 minutes.

last(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

Would this work?

last(/Template DB MSSQL by ODBC/net.tcp.service,5m[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

Also, regarding templates, once a template is applied to a host with discovery rules and creates triggers and items etc.. how do you best modify all the hosts using that template for various changes like changing a triggers severity for example?

So if Template_1 is applied to Host_1 and Host_2 and the discovery creates a trigger with a severity of Disaster on each host, is the only way to modify that severity to do it on each individual host? If so, how do you manage various changes at the template level and have the hosts apply those changes in mass?

Unless I am missing something it feels like a template just generates the items and triggers on initial discovery and then the hosts need to be managed individually, which doesn't seem very friendly with a large number of hosts?

[cyber]

No. this will not work. If we add some colors, you may understand, why...

last(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

You cannot add that 5m somewhere in the middle of a key...

If you look into documentation of "last()" function ( https://www.zabbix.com/documentation...ctions/history ) then you can see, that it has no option to add "duration". So you need to change function here. Instead of last value you need to consider all values for 5m.. I assume that this check returns 0 or 1, then your trigger expression could be "max(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}],5m)=0" meaning.. there is no value above 0 for last 5 minutes.

If you have applied a template to hosts, then for changing things in all at once, you should modify template. This applies also for discoveries. If you change it, things are (re)discovered according to changed rules.

[cyber]

No. this will not work. If we add some colors, you may understand, why...

last(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

You cannot add that 5m somewhere in the middle of a key...

If you look into documentation of "last()" function ( https://www.zabbix.com/documentation...ctions/history ) then you can see, that it has no option to add "duration". So you need to change function here. Instead of last value you need to consider all values for 5m.. I assume that this check returns 0 or 1, then your trigger expression could be "max(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}],5m)=0" meaning.. there is no value above 0 for last 5 minutes.

If you have applied a template to hosts, then for changing things in all at once, you should modify template. This applies also for discoveries. If you change it, things are (re)discovered according to changed rules.

[csmall]

No. this will not work. If we add some colors, you may understand, why...

last(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

You cannot add that 5m somewhere in the middle of a key...

If you look into documentation of "last()" function ( https://www.zabbix.com/documentation...ctions/history ) then you can see, that it has no option to add "duration". So you need to change function here. Instead of last value you need to consider all values for 5m.. I assume that this check returns 0 or 1, then your trigger expression could be "max(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}],5m)=0" meaning.. there is no value above 0 for last 5 minutes.

If you have applied a template to hosts, then for changing things in all at once, you should modify template. This applies also for discoveries. If you change it, things are (re)discovered according to changed rules.

Thank you!

I think that was the part I was lost on with the templates. I was hung up on the discovery creating the objects and then I was thinking they were just stuck that way.. like a one time creation thing. I didn't realize the discovery would run again. I'll look around in the documentation for the discovery interval/frequency.

The trigger expression makes sense to me now, thank you for that. the colors did help

[csmall]

No. this will not work. If we add some colors, you may understand, why...

last(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}])=0

You cannot add that 5m somewhere in the middle of a key...

If you look into documentation of "last()" function ( https://www.zabbix.com/documentation...ctions/history ) then you can see, that it has no option to add "duration". So you need to change function here. Instead of last value you need to consider all values for 5m.. I assume that this check returns 0 or 1, then your trigger expression could be "max(/Template DB MSSQL by ODBC/net.tcp.service[tcp,{HOST.CONN},{$MSSQL.PORT}],5m)=0" meaning.. there is no value above 0 for last 5 minutes.

If you have applied a template to hosts, then for changing things in all at once, you should modify template. This applies also for discoveries. If you change it, things are (re)discovered according to changed rules.

@cyber

If a trigger was manually changed at the host level, will changes to the trigger in the template override it any longer?

I have manually modified some of the trigger severity on various hosts and I want to revert to using the template and macros for overrides on hosts, but it seems that the template is not changing the manually modified trigger severities on hosts with the template linked to them.

Is it possible to make it so the template is what is enforced again on the trigger? Do I have to delete the trigger and apply the template all over again or something?

[csmall]

I think what I am trying is working, I am selecting a bunch of hosts that have the same template applied and then doing a mass update, unlinking without clearing, then mass update and linking without clearing. I THINK it is working as I had hoped.