Trigger if null string for 15 minutes

[Bubbagump]

I am trying to monitor our NTP servers to make sure they have a peer in use. I am using

system.run[ntpq -p| grep '*']

to check to see if NTP has a peer it is using. If there is no peer, then I get a null value and I should get an alert. Easy enough. What I can't seem to get to work is a trigger. I have been experimenting with variations of length() with little success.

length(last(/OPNSense1/system.run[ntpq -p| grep '*']))=0

seems to work well enough, however I only want it to alert if it has been in this state for 15 minutes.

length((last(/OPNSense1/system.run[ntpq -p| grep '*'])),15m)=0

and variations of this won't parse and I am stuck.

Any kind soul with ideas?

[tim.mooney]

length((last(/OPNSense1/system.run[ntpq -p| grep '*'])),15m)=0

and variations of this won't parse and I am stuck.

You don't say what version of Zabbix you're using, but based on the trigger syntax you're using, I'm assuming it's 5.4 or 6.0.

The length() function at 5.4 and later doesn't take a 2nd time/shift argument, so what you have won't work.

If you're actually trying to pass "15m" to last(), I think you have the parenthesis incorrect, but that doesn't matter anyway because last(something, 15m) doesn't do what you want anyway. There are good reasons why the "time" parameter to last() works differently from some other functions, but it trips up a lot of people until they're used to it.

If you can get the "iregexp" parameter to count() correct, I think count would do what you want, without needing any function composition, but it may take some experimentation to get your regex correct. I mean ^$ should match an empty string, but there's some quoting and other stuff that you'll need to deal with. I don't use regexp very often with triggers because my site tries to use numeric returns in most cases.

PS: Your "grep '*'" is going to confuse a lot of people that look at it, because it looks like it should be invalid. In nearly every situation, '*" modifies the previous regular expression, but since you don't have a previous RE, grep is treating it as a literal '*' character, which is what you actually want I suspect. To avoid tripping up other people that look at your (valid, but weird) grep, you might want to use something like "grep '^\*'" instead, to it's clear you're matching a "*" at the beginning of a line. What you're doing isn't wrong, it's just going to confuse your coworkers. :-)

[Bubbagump]

You are correct, I am on Zabbix 6. This has been extra confusing as most everything I have found references strlen() but of course that doesn't exist in 6.

Thanks for the tip on the regex. NTP does give you a lot of ways to determine if a peer has been selected and a literal "*" was the best I could come up with. '^\*' makes a lot of sense. As a rule I always avoid regex as if there is one thing I will screw up, its a regex.

Ok, so armed with this let me play and see what I can come up with. Thanks for the pointers.

[tim.mooney]

You are correct, I am on Zabbix 6. This has been extra confusing as most everything I have found references strlen() but of course that doesn't exist in 6.

Yeah, although there are real benefits to the changes they made to the trigger syntax at 5.4, it does partially invalidate a lot of old examples and solutions on these forums. It was a good change, but it will take a while for the new syntax to be well-represented here and in other web resources. Luckily they've really expanded the "Examples" section for triggers, which helps some.

Thanks for the tip on the regex. NTP does give you a lot of ways to determine if a peer has been selected and a literal "*" was the best I could come up with. '^\*' makes a lot of sense. As a rule I always avoid regex as if there is one thing I will screw up, its a regex.

You're in good company there. I personally really like regular expressions, but I also enjoy this old chestnut about regular expressions:

'Some people, when confronted with a problem, think "I know, I'll use regular expressions." Now they have two problems.'