Trigger to look if value is more than 0 for a certain time.

[Gertjan]

Hi, I'm struggling to find a good trigger for this as i do not understand it fuly. Let me explain:

I'm checking on some Ubuntu servers if there is an security update available and would like to set a trigger if the value is more then 0 for 14 days.(UserParameter=ubuntu_updates.security,apt-get upgrade -s | grep ^Inst | grep -c security).
So i would like to create an alarm if the value is e.g. >0 for longer than 14 days.

This is what ive got but it doesnt seem to work properly: last(/ubuntu-server/ubuntu_updates.security,#1:now-14d)>0

Anyone able to help me in the right direction?

[cyber]

min(/ubuntu-server/ubuntu_updates.security,14d)>0

Lowest value during last 14d is higher than 0 (all values have to be higher than 0) . Right?

[Gertjan]

Hi, thanks for your quick reply. The value is indeed always higher than 0, though what im trying to do is:

If it is higher than 0 for longer then 14days. It should trigger a warning. (Im stating that this value is not always 0 and changes for time to time)
To be clear: All updates >0 that are present for 14days long should trigger this warning.

Does this achieve that?

[cyber]

Yes.. That's what I said...

[Gertjan]

Great, thanks i will use that and test my config!

[Gertjan]

Hi cyber

I did this also for another update check where i set this (non security updates trigger) to 160d. Now i do not have any measurements this long (see attached graph) and still the trigger is activated. How do i set the trigger to look only if the value is indeed >0 for the periode of 160days even if there is no data for that long?

[cyber]

Consult the manual..

https://www.zabbix.com/documentation/6.0/en/manual/appendix/functions

There are trend functions. Personally, never used them, but I think they should do the trick...

[Gertjan]

Hi thanks, i found the link also, have tried some like min,max last, use time shift im simply a bit stuck on it. If anyone else has an idea please let me know.

[Gertjan]

I found an way to work with it though some agents still are not working properly, i have decided to disable the monitoring for the agents that are not working for this 160days trigger as it takes up to much time . For now this is what i did. look for the value you want, count this in these days, then also look for nondata as new hosts do not have history:

min(/ubuntu-server/ubuntu_updates.package,160d)>0 and count(/ubuntu-server/ubuntu_updates.package,160d)>0 and not nodata(/ubuntu-server/ubuntu_updates.package,160d)=1

If anyone has a better idea, dont hesitate to add