Tigger with Up/Down/NoData

[jgshier]

I have been trying to figure this out, but can't. The way I have it seems to have issues. If I click on triggers then click the trigger, it shows it go up and down every 30 seconds. I am guessing because of my nodata(30).

What I want is a trigger for 3001,Warning (Down) if I get a 3002,Information(Up) that would clear the trigger. Also if we get nodata for lets say an hour it would also clear the trigger. In my example I have it for 30s but it just so I can test. Is this even possible?

(({TRIGGER.VALUE}=0 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}=2 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3001)}=1)) or
({TRIGGER.VALUE}=1 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}<>1 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3002)}<>1) and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].nodata(30)}<>1))


Any help would be great.

[jgshier]

Anyone? Also when looking at windows events, what is the best practice? One Item and multi triggers off that item or multiple items and each having their own trigger?

[jgshier]

I got a little closer by putting the nodata on the outside, but if I send a fake 3001 Information event it still clears the trigger how do I fix that?

Should only trigger on 3001 Warning and Clear on 3002 Information or after nodata time.

This does work with the nodata now:
(({TRIGGER.VALUE}=0 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}=2 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3001)}=1)) or
({TRIGGER.VALUE}=1 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}<>1 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3002)}<>1))) and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].nodata(30)}<>1

I tried this to fix it so if I send a fake 3001 Information but it still clears.

(({TRIGGER.VALUE}=0 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}=2 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3001)}=1)) or
({TRIGGER.VALUE}=1 and ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}<>1 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3002)}<>1) or ({TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logseverity()}<>1 and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].logeventid(3001)}<>1))) and {TestPC:eventlog[Application,,"Information|Warning",ZabbixTest,^(30 01|3002)$,,skip].nodata(30)}<>1

[jgshier]

Hello? Any help please?