Trigger question (Zabbix 2.4)

[hwtzbh]

Hi,
I've created a simple item & trigger to notify if a directory was got too big within the last 5 minutes. Trigger seems to be working, but I cannot find where do I set the trigger clear after acknowledgment. Is it possible to set the trigger to be clear (after ack) after X minutes?

[zabx_ks]

Hi hwtzbh!

It's not possible to do that yet. But there is a opened feature request for this :
ZBXNEXT-104


zabx_ks

[Linwood]

Generally speaking you write the trigger expression so it returns to zero when you want it to clear.

Events can be acknowledged, not triggers. Alerts act on trigger/event conditions, and you can build conditions into alerts that look if an event has been acknowledged, but I do not think you can make the trigger itself go to "OK' based on acknowledged (I never wanted to, haven't looked -- to me it's not OK until, well, it is OK). You can use this for escalation, for example if you have alerts at (say) an hour that go to management, you could have those go out only if the event was not acknowledged even if the trigger is still marked as a problem.

You can make a trigger clear based on time using the time based expressions, something like min and max over that X minute interval. For example, if the MIN and MAX are both over the limit for X minutes, that might be your time based reason to set the trigger back to zero if that is your intent (it wouldn't be mine, as the problem still exists).

[hwtzbh]

Well, my trigger is pretty simple:

{10.x.x.x:space_used[/somedir].last(0)}>4G

So what should I add in order to (finally) the event will be cleared after acknowledged? right now, 3 days later and ack - it still didn't clear the event.

Thanks

[Linwood]

Well, my trigger is pretty simple:

{10.x.x.x:space_used[/somedir].last(0)}>4G

So what should I add in order to (finally) the event will be cleared after acknowledged? right now, 3 days later and ack - it still didn't clear the event.

Thanks

Acknowledgement does not clear triggers. Acknowledgement would normally be used in escalation to control additional alerts (if you use the escalation feature), and/or to allow a place to put comments for humans to look at. Triggers continue to fire (to be in a problem state) until the problem goes away. "The problem goes away" means that the trigger expression resolves to false (0) instead of true (1).

So in the above, your trigger should clear when the space used falls below 4G, making your trigger condition false.

[hwtzbh]

ok, so perhaps I wrote the trigger incorrectly.

Basically I'm looking to create a trigger that escalates when a directory is growing above 4 GB in order to notify the admin, but the event from this trigger should be clear upon acknowledgment, even if the directory size remains the same.

Basically I see it all over the Zabbix triggers, for example: hostname was changed, I acknowledge it and after 30-60 minutes the event is cleared and you're done.

Could you suggest what to change in this trigger please?

Thanks

[Linwood]

I'm not sure you can get what it is you want, though there are some possibilities.

Without seeing the trigger, my guess about the host name change is that it detects change. As the most simple example, it can compare the last value polled against the second to last polled, and if different trigger. If you poll that every 30 minutes, then the trigger condition will remain for 30 minutes, and on the subsequent poll the last and 2nd to last will both be the new name, and the trigger will clear. But key to this is that the condition itself is what caused it to clear, not your acknowledgement.

For disk space the problem is more complex to handle in the same fashion as space used tends to change continually, up or down. If you write a trigger something like:

space is below X AND space is lower than it was 2nd to last poll

You can make it alert, then clear if the space condition does not get worse, but this is very likely to flap as you have small changes up and down. You might look at the max and min over time, and alert only when there has been a big upward change (as opposed to small ones) if you can defined "big" and "small" in a way that will make you satisfied.

Version 3.x introduced forecasting functions as well, which will let you make the trigger a function of "when will I run out of space". So a quick upward jump may make it look like you have a problem, but if it stabilizes at that value and no longer is increasing you could make the trigger not fire. But in my opinion these tend to be very simplistic approaches -- disk space usage, like CPU usage, tends to be noisy with too many ups and down for this to be terribly accurate. But you might look at those (if you are on a 3.x version) and see if forecasting can help you.

But I since your frustration is related to the acknowledgement - you want to say "I will take care of it" and make the trigger go away, is that your real motivation? If so, I think you need to focus on the alerts, not the triggers. You can us acknowledgement status control if alerts continue to come out, but not if triggers continue to be in a problem state. It just doesn't work that way. And from a (human) management standpoint I tend to favor the condition continuing to show up as a problem until it is fixed, not just until someone says "i'll take care of it".

Now you can filter the trigger display to show only unacknowledged events; that does not make the trigger problem status go away, it just hides it. Just as you can use acknowledgements in the alerts that go out to decide whether to send (or to whom to send).

Sorry if that's not very helpful, but (if I understand you), the product just isn't designed that way.

[hwtzbh]

the trigger is this:

{10.x.x.x:space_used[/somedir].last(0)}>4G

space_used is a simple UserParameters which does a "du -bc" on a selected directory (and cuts the other text)

The customer who I build this Zabbix for him require this: I need to know if a specified directory is growing extremely fast ( >4GB in 5 minutes ). If it is, I want to know about it and I'll decide if to leave it as it is or to clean this directory. The Alert should be cleared after I acknowledge it.

[Linwood]

the trigger is this:

{10.x.x.x:space_used[/somedir].last(0)}>4G

space_used is a simple UserParameters which does a "du -bc" on a selected directory (and cuts the other text)

The customer who I build this Zabbix for him require this: I need to know if a specified directory is growing extremely fast ( >4GB in 5 minutes ). If it is, I want to know about it and I'll decide if to leave it as it is or to clean this directory. The Alert should be cleared after I acknowledge it.

When I said "without seeing the trigger" I referred to your other example of a name change.

I understand what you are saying. I repeat: Acknowledgements cannot clear triggers, to the best of my knowledge.

I'm sorry if this is not a satisfactory answer, perhaps someone else has a better idea.

It is possible to see if growth is fast. You could do something like check the value 5 minutes ago against the current value and see if it's greater than 4G. The problem (per your description) is that if that growth rate is reduced, the next polling interval may clear the trigger by itself. It does not depend on or react to your acknowledgement.

[hwtzbh]

It is possible to see if growth is fast. You could do something like check the value 5 minutes ago against the current value and see if it's greater than 4G. The problem (per your description) is that if that growth rate is reduced, the next polling interval may clear the trigger by itself. It does not depend on or react to your acknowledgement.

And this is exactly what I'm looking for and the trigger that I posted here. The item itself does check every 300 seconds the directory size, so we have an understanding

The problem is that 10+ minute goes, the directory size is not being changed that much (give or take few megs) but I still get the damn alert (after I ack it), and it drives me nuts.