Help with basic hysteresis

[rubendob]

({TRIGGER.VALUE}=0 and {Template App HTTP Service:net.tcp.service[http].max(#3)}=0) or ({TRIGGER.VALUE}=1 and {Template App HTTP Service:net.tcp.service[http].max(#3)}=1)

Hi!

Im trying to understand why this trigger does not work as I want. With current expression trigger change their status all time from ok to problem, problem to ok, ok to problem. Meanwhile the status of HTTP service is down I do not understand why the trigger status is jumping all the time.

I think the expression is pretty simple, so why is not working properly?
My zabbix version is 3.X by the way.

Any ideas?

[troffasky]

https://www.zabbix.com/forum/showthread.php?t=42681

Did you get your example from blog.zabbix.com?

[rubendob]

Actually is just a trigger which comes with default Templates. I know if everything is fine I don't need this but I like to apply hysteresis to avoid flap detection in every important trigger like HTTP

[rubendob]

After reading the link I think is not possible to avoid this kind of expression.

In pseudocode will be something like:

if  "ALL IS OK" and "HTTP CRASH" 
     return 1;

else if

    "ALL IS WRONG" and "HTTP IS FINE"
      return 1;

else 

     return 0; 

and the expression will be:

{TRIGGER.VALUE}=0 and {Template App HTTP Service:net.tcp.service[http].max(#3)}=0) or ({TRIGGER.VALUE}=1 and {Template App HTTP Service:net.tcp.service[http].max(#3)}=1)

The problem is with this trigger, at least in my test, I turndown the HTTP server and without switch on again, the trigger status changes itself!!!!!

Never happened to me like these before... I don't know what I'm doing wrong.

[rubendob]

Hi again

I've changed expression to something like

{Template App HTTP Service:net.tcp.service[http].min(60)}=0 or ({TRIGGER.VALUE}=1 and {Template App HTTP Service:net.tcp.service[http].max(120)}=1)

Now the trigger don't flap from PROBLEM to OK and viceversa but it never reverts to OK from PROBLEM even when the http service is working ok since more than 2 minutes. It remains in PROBLEM for ages.



I don't understand. This kind of thins worked perfectly in the older Zabbix 1.8 or 2.X

any ideas guys?

[Linwood]

Some of this is I think backwards. In the first set (truncating a bit for brevity):

({TRIGGER.VALUE}=0 and max(#3)}=0) or
({TRIGGER.VALUE}=1 and max(#3)}=1)

A way to read these in English that is not exactly equivalent but is a good way to think of them is:

"Begin alerting when.... Keep alerting so long as".

So this says begin alerting when for three consecutive polls the service is down, and keep alerting so long as at least one poll in the last three is up. Which is not at all what you want, I think.

You might want:

({TRIGGER.VALUE}=0 and max(#3)}=0) or
({TRIGGER.VALUE}=1 and min(#3)}=0)

This says "Begin alerting when three consecutive polls are down, and keep alerting so long as at least one of the last three polls is down" In other words, stop when you have three consecutive polls up.

The last one about says "Alert when over the last 60 seconds there is even one outage any time and keep alerting until there is any time in the last two minutes the service is up". Which is really not at all what you want. Though you might have intended to switch min and max, and add the trigger value=0 to the first, and you end up with my example above but for 60/120 seconds.

[rubendob]

Hi Linwood

you're totally right. I will update my triggers accordingly.

Thanks!