What exactly caused the trigger to fire if trigger is based on OR statements?

[Iggy]

Hello all,
I have trigger with custom items. Items are scripts which results are parsed and shown in zabbix.There are 4 of them.
I created trigger for those items and that trigger containts multiple OR between items/keys, for example:
last(/Zabbix server/item1.response.time,#5)>=3 or last(/Zabbix server/item2.response.time,#5)>=3 or last(/Zabbix server/item3.response.time,#5)>=3 or last(/Zabbix server/item4.response.time,#5)>=3

When trigger fire, I see only:
Trigger response time => 3sec

I want to see which of them exactly fired the trigger:
Trigger item2.response time => 3sec

But I do not see which macro I can use for that.

Please advise

[Iggy]

I tried with {ITEM.NAME} but it does not resolve.

[cyber]

There is no macro that tells you "this part of your equation caused all this"...

And why do you calculate your trigger on 5th last value? What's the point of knowing that 5 checks ago something failed?
(last(/host/item,#5) DOES NOT mean last 5 values, it means 5th most recent value)

[Iggy]

There is no macro that tells you "this part of your equation caused all this"...

And why do you calculate your trigger on 5th last value? What's the point of knowing that 5 checks ago something failed?
(last(/host/item,#5) DOES NOT mean last 5 values, it means 5th most recent value)

I want teigger to fire after 5 checks. I do not want to fire immediately. That part is OK.

You want to tell me that my only alternative is to create 4 triggers and hard code value?
I want to achieve that if any of the statement is resolved to be true and trigger is fired, I want to know what exactly of those 4 statements/items caused the problem. Are there is no way for that except creating 4 triggers? Ridiculous.

[cyber]

You are triggering it, when 5th check from now failed... it may be ok already, it may still be failing, does not matter, its one check it the past, that counts...
If you want it fire, when 5 checks in a row have failed, use min(/host/item,#5)=>3... this will fire, when all 5 checks have a value at "=>3".

I personally do not like those expressions, where you have many items and possible combinations... Due to fact that each expression gets recalculated each time, when any of the items receives a new value, expressions with many parts can have such recalculation many times in very short time, causing issues... Simplicity is the key..

Ridiculous or not, there still is no such function. You can use {ITEM.VALUE<N>} in your trigger name to reflect operational data for all used items... and then draw conclusions by yourself, which one failed. There is also {FUNCTION.VALUE<1-9>} what you can use in Event name field to display function values from calculations...

You can also submit a dev request for such function https://support.zabbix.com/projects/ZBXNEXT/

[Iggy]

Following simpicity rule I want 1 trigger for those 4 items. If any of this item fail, I want trigger to be fired. Or if any 2 or 3, or all items failed.
If I understand you correctly, I can't avoid having 4 triggers, 1 for the each item.

[cyber]

If you write your trigger name as "Response time of item(s) is over limit, {ITEM.VALUE1} {ITEM.VALUE3} {ITEM.VALUE3} {ITEM.VALUE4}" you should get a trigger like "Response time of item(s) is over limit, 0 0 3 0", so drawing a conclusion .. 3rd expression caused it all.. You will never see something like 0 3 3 3, only which one failed first... event text will not be updated if some other part of expression also fails later as trigger is already active...

[Alexei]

I think that macro {TRIGGER.EXPRESSION} and {TRIGGER.EXPRESSION.EXPLAIN} is what you need. From your notification:

Trigger expression: {TRIGGER.EXPRESSION}
Evaluates to: {TRIGGER.EXPRESSION.EXPLAIN}

You will receive something similar to this message, so you can clearly see how the expression was evaluated:

Trigger expression: last(/Zabbix server/item1.response.time,#5)>=3 or last(/Zabbix server/item2.response.time,#5)>=3 or last(/Zabbix server/item3.response.time,#5)>=3 or last(/Zabbix server/item4.response.time,#5)>=3
Evaluates to: 0>=3 or 1>=3 or 5>=3 or 0>=3

[cyber]

But they still show only "at the time of event generation" ... so if second or more of those expressions fail during trigger being active, event name will never reflect it...
As topic starter here says: "I want to achieve that if any of the statement is resolved to be true and trigger is fired, I want to know what exactly of those 4 statements/items caused the problem". then it will only show which one started it first... due to nature of triggers being recalculated for each new item value... it is already active, second or third failed part will never show.. If you are not looking at operational data, which can be shown easily in problem list..

That's why I said, if you want to know exactly, then have more triggers without any "logic".

[Iggy]

I think that macro {TRIGGER.EXPRESSION} and {TRIGGER.EXPRESSION.EXPLAIN} is what you need. From your notification:

Trigger expression: {TRIGGER.EXPRESSION}
Evaluates to: {TRIGGER.EXPRESSION.EXPLAIN}

You will receive something similar to this message, so you can clearly see how the expression was evaluated:

Trigger expression: last(/Zabbix server/item1.response.time,#5)>=3 or last(/Zabbix server/item2.response.time,#5)>=3 or last(/Zabbix server/item3.response.time,#5)>=3 or last(/Zabbix server/item4.response.time,#5)>=3
Evaluates to: 0>=3 or 1>=3 or 5>=3 or 0>=3

Thank you for your answer. Look promising, I will check that!