One alert for several events in a period

[arr1val]

Greetings.
I use a trigger to monitor SUDO usage.

find(/monitor sudo/log[/var/log/auth.log,sudo],,"like","sudo: gitlab-runner")=1

During auto-deploy, about 40+ messages are generated. Is it possible to configure sending one alert message when a trigger is fired instead of 40? May be there is a condition: events by trigger in a period of time, for example a minute?

Zabbix 6.4.5

[cyber]

You can add additional condition to your expression ... "and nodata(/monitor sudo/log[/var/log/auth.log,sudo],1m)=0"
then trigger will react only, if there is no incoming data for at least a minute...

[arr1val]

Thank you! I will try it.

[arr1val]

You can add additional condition to your expression ... "and nodata(/monitor sudo/log[/var/log/auth.log,sudo],1m)=0"
then trigger will react only, if there is no incoming data for at least a minute...

Didnt help, zabbix continue to send alert messages for each event.

[dimir]

Consider voting for https://support.zabbix.com/browse/ZBXNEXT-39