Close SNMP trap event with the same OID

[markfree]

Using Zabbix 6.2.

Whenever my Proxy receives a trap, it shows that the service has switched to either Backup or Primary mode. Therefore, a trigger was created to check if the SNMP trap has specific strings.

find(/HOST/snmptrap["\.1729\.104\.0\.2"],#1,"iregexp",": Runmode changed to (BACKUP|PRIMARY)")=1
and
find(/HOST/snmptrap["\.1729\.104\.0\.2"],#1,"iregexp","10610")=1

So, if a service switches to Backup, the trigger creates alerts for each service as expected. But when the same service switches back to Primary mode, another trap is created with the same OID, and the trigger is not resolved.

SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.1729.104.0.2
SNMPv2-SMI::enterprises.1729.100.1.10.13.0 type=66 value=Gauge32: 148
SNMPv2-SMI::enterprises.1729.100.1.10.14.0 type=4 value=STRING: "[Application dcrj_msgserver_b]: Runmode changed to BACKUP from PRIMARY"
SNMPv2-SMI::enterprises.1729.100.1.10.15.0 type=4 value=STRING: "10610"

SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.1729.104.0.2
SNMPv2-SMI::enterprises.1729.100.1.10.13.0 type=66 value=Gauge32: 148
SNMPv2-SMI::enterprises.1729.100.1.10.14.0 type=4 value=STRING: "[Application dcrj_msgserver_b]: Runmode changed to PRIMARY from BACKUP"
SNMPv2-SMI::enterprises.1729.100.1.10.15.0 type=4 value=STRING: "10610"

I've added a tag that captures the service name from the SNMP trap, hoping that it would close the triggered event, but it does not.


Additionally, I tried to add a recovery expression, but it did not work out.

I'm trying to figure out how to make this trigger close itself.
Any ideas?

[cyber]

It does not resolve, as your expression is always"TRUE"... you have 2 options in regex, backup and primary, and this way it is always matching...
If you leave it just to "Runmode chnaged to PRIMARY from BACKUP", then you will get an event, when it matches and it will resolve, when you get new trap ("from BACKUP to PRIMARY") as it will not match expression any more. And then this "service" tag also works, I think...

[markfree]

Sometimes the service runs as Backup, other times it runs as Primary.
This way, the service may switch between the two modes and the trigger may be started from either Backup or Primary mode.

I was hoping to use a single trigger for both modes, but I see no other option for now.