closing manually for reappearing problem

[alila26]

Hello!
I'm rather new to Zabbix and I need some help with configuring triggers.

There is a trigger for pid changes and it works perfectly fine:
changecount(/xxx/xxx.change_pid,1d)>=1
So it basically states that there was a at least one pid change within the last 24 hours.

What I need is to configure it that way:
- if someone closes this problem manually, the problem is solved, there is no new notification for closed problem, triggers again only if there was another pid change within 24 hours.

Manual closing is mandatory here, since we need to make sure why pid changed and resolve problem ourselves. The main issue I have is that if a problem is closed manually now, the data from the host still has values that match the trigger and problem reappears again after receiving data from the host during the next iteration.
I kinda found out that Suppress supposedly does that job and removes Problem from the dashboard, but this won't notify if there was e.g. 2 changes of pid during the last 24 hours.

Is there a way to make an expression or some workaround for this?

Help is really appreciated.

[ISiroshtan]

Hey there.

To find an answer you need to ask the question: why do I need to evaluate 24 hours of data?
The likely answer I expect to hear based on inormation in original post: to keep trigger open until some one manually closes it or the pid does not change for a day. In which case, you need to get yourself familiar with triger hysteresis. This is functionality that allows you to open problems (fire a trigger) on one condition but close it on additional requirements (to stress it out, when using hysteresis you need to have problem expression = false AND recovery expression = true for auto closure. This is mandatory and oftern missed in understanding of Zabbix hysteresis).

Using the hysteresis function you can define trigger as follows:
Problem expression: last(X) != last(X,#2) or changecount(X, #2) = 1 or (any other variation with same logic)
Recovery expression: changecount(X, 1d) = 0 (or any other condition for autoclosure that fits your requirements)

With this approach when last pid is not the same as previous pid - trigger will fire. On next check, pid will be same as previous pid, so problem expression will be false. But as long as there are any changes in PID for last 24 hours, recovery expression will be false and problem will remain open.
At this state, you still can manually close the problem. When you do such, only Problem expression will matter, and as long as latest PID = previous PID - trigger will not refire.

[alila26]

Hello!

Oh. Indeed that works like a magic - it really helped to achieve the result I needed. Such a simple and elegant solution

You have all my thanks!