A trigger that will fire if a condition is met 3 or more times in 15 minutes

[reekoff]

Hi all! I'm using Zabbix 5.4. I'm asking for help in writing a trigger based on the vm.memory.size[pavailable] key. I need to build a trigger for a linux server that will fire when memory utilization is greater than 80%, but only if this threshold is exceeded 3 or more times in 15 minutes. Thank you very much for the advice!

[ISiroshtan]

Check the count function from List of Supported function - History functions. It should allow you to achieve what you want.

[reekoff]

Thanks for the tip! I constructed the following expression: count(/Template OS Linux-ptwaf/vm.memory.size[pavailable],15m,,20)>=3. But I'm not sure if it's correct. Zabbix did not generate an error, but the trigger did not fire either (it is not clear whether it was due to the fact that the trigger conditions were not met or that the trigger itself was incorrect).

[ISiroshtan]

So if you reference the document, the syntax is:

count (/host/key,(sec|#num)<:time shift>,<operator>,<pattern>)

In your trigger you have key, sec, and pattern. But you skip the operator. Default operator is "eq". So it will fire if in last 15 minutes you have 3+ values of exactly "20".
You need to add "gt" operator to select values that are higher then your pattern. (also, why 20? I thought you want more then 80?)
So I would say try with

count(/Template OS Linux-ptwaf/vm.memory.size[pavailable],15m,gt,80)>=3

[reekoff]

(also, why 20? I thought you want more then 80?)

But key parameter is pavailable, not pused. I thought need to read this as available memory less than or equal to 20%

[ISiroshtan]

Ah, makes sense, did not really read the key, my bad.
Then try:

count(/Template OS Linux-ptwaf/vm.memory.size[pavailable],15m,le,20)>=3

[reekoff]

yes, thanks! But doublequotes for "le".