Question about return value trendstl function

[machinelearningdingetjes]

Hey,

I've been experimenting a lot with the trendstl function and I've come up with a question about the usage of this function. All the documentation that I've read about the function use this function in a following manner:
trendstl(<key>, 28d; now/h, 1d, 7d) = (1/24)

The documentation says that this trigger should activate when the amount of anomalies detected in 1 day (24 hours) equals 1.
The thing I'm confused about is that the trendstl function returns a float between 0 - 1 that describes a ratio of number of anomalie values / total number of values
My question is if there is a dependecy of the time interval when a certain item retrieves data and the total number of values?

For example: if I use the following trigger: trendstl(<key>, 28d; now/h, 1d, 7d) = (1/24) with an item retrieve time interval of 1 hour, this trigger should be accurate.
But if I use the same trigger on a different item with an item retrieve time interval of 5 minutes, is this trigger still accurate? Or should the threshold be set to > (1/(24*(60/5))?

If there is a dependecy, is there a way to obtain the total amount of values within a certain timeperiod?

Greetings,
machinelearningdingetjes

[dimir]

This is a Trend function, so the caluclation is done on trends. Trends are generated with a hard-coded interval - once per hour. The Update interval of an item is ignored here. Hope that answers it. :-)

[machinelearningdingetjes]

Does this also mean that the trigger only goes off once an hour if the right conditions are met?

[dimir]

There are different types of "trigger functions":

- history functions: https://www.zabbix.com/documentation...ctions/history
- trend functions: https://www.zabbix.com/documentation...nctions/trends

The former operate on history data, these are the metrics which are collected according to "update interval".

The latter operate on trend data. Trend data is calculated and saved to the database by Zabbix server automatically with frequency once an hour (average value per hour, well, it also stores min and max per hour, but it's different case). When Zabbix finds *trend function* in the trigger expression, it will be calculated using that trend data.

So a trigger does not care if it's history or trend data directly, it's what you have in the trigger expression what matters. And all these values are already there in the database, at this point the "update interval" or how often these values were put into the database doesn't really affect trigger functions. Of course, trigger is processed on receiving a new value so "update interval" basically affects how often it will be processed.

So, think of this as all the trigger needs from item is "item value type" and the item values themselves. It doesn't care about "Update interval" or anything else.

And to answer your question, yes, since "trendstl" is a trend function it means it will only go off once an hour, since this is the frequency of appearance of new values. But keep in mind this is true given you have single trigger function in your trigger expression. You can have multiple and even of the different items. So if for one item the values are coming every minute (and history function is used) and for the other every hour (also history function is used), trigger will be processed every minute, because it will be processed on receiving any of the values of any of the item used in trigger expression. Or it could be even the same item but different type of trigger functions (one - history, another - trend). But as you can figure out, even given the same item, for each function completely different set of values will be used.

Hope this helps.

[cyber]

As docs do not say anything about considering the collection interval, then I would assume it does not matter..

Returns the rate of anomalies during the detection period - a decimal value between 0 and 1 that is ((the number of anomaly values)/(total number of values)).

I would say, if you check more often, then also your anomaly values count is probably higher and overall "rate" is still the same.. Calculation just may take longer due to more data...:P

[machinelearningdingetjes]

It might be higher indeed but I don't think 12 times (60/5) as high. Is there any official Zabbix developers who can react to this post?

[cyber]

dimir maybe you have an answer ? Or at least can get more explaining answer from officials..

[machinelearningdingetjes]

if he responds...

[dimir]

This is a Trend function, so the caluclation is done on trends. Trends are generated with a hard-coded interval - once per hour. The Update interval of an item is ignored here. Hope that answers it. :-)

[machinelearningdingetjes]

Does this also mean that the trigger only goes off once an hour if the right conditions are met?

[dimir]

There are different types of "trigger functions":

- history functions: https://www.zabbix.com/documentation...ctions/history
- trend functions: https://www.zabbix.com/documentation...nctions/trends

The former operate on history data, these are the metrics which are collected according to "update interval".

The latter operate on trend data. Trend data is calculated and saved to the database by Zabbix server automatically with frequency once an hour (average value per hour, well, it also stores min and max per hour, but it's different case). When Zabbix finds *trend function* in the trigger expression, it will be calculated using that trend data.

So a trigger does not care if it's history or trend data directly, it's what you have in the trigger expression what matters. And all these values are already there in the database, at this point the "update interval" or how often these values were put into the database doesn't really affect trigger functions. Of course, trigger is processed on receiving a new value so "update interval" basically affects how often it will be processed.

So, think of this as all the trigger needs from item is "item value type" and the item values themselves. It doesn't care about "Update interval" or anything else.

And to answer your question, yes, since "trendstl" is a trend function it means it will only go off once an hour, since this is the frequency of appearance of new values. But keep in mind this is true given you have single trigger function in your trigger expression. You can have multiple and even of the different items. So if for one item the values are coming every minute (and history function is used) and for the other every hour (also history function is used), trigger will be processed every minute, because it will be processed on receiving any of the values of any of the item used in trigger expression. Or it could be even the same item but different type of trigger functions (one - history, another - trend). But as you can figure out, even given the same item, for each function completely different set of values will be used.

Hope this helps.