configure trigger recovery with nodata

[jjanno]

Hello,


I have searched the forum but have not found the solution that works for me.

I have network equipment that sends traps.
"SNMPv2-MIB::snmpTrapOID.0 = SNMPv2-SMI::enterprises.12356.100.1.3.0.102"

That is a Fortigate memory high usage. If memory usage falls below limit, it stops sending traps.

How to configure recovery expression? I would like to recover, if no traps recieved in 10 minutes. I would like to do that in template, so I can use that for all my fortigates.. The problem expression is "length(last(/Fortigate_traps/snmptrap[12356.100.1.3.0.102]))>0". That can be improved, if somebody has better idea.

I have tried different versions of nodata(), but have not found the one that works.

Any help would be appreciated.

br,
jJanno

[ISiroshtan]

Did you try to just use trigger expression as below? Pretty sure it should work

nodata(/Fortigate_traps/snmptrap[12356.100.1.3.0.102],10m) = 0

You don't not need the recovery expression with this. Just dont use this approach with Multiple Problem event generation mode.

[cyber]

There is no point in adding recovery expressions, if your initial trigger expression is still TRUE...
Recovery expression is ADDITIONAL criteria, that has to be true after you initial trigger value is already turned to FALSE...

like.. if you fire some disk space trigger at 80% but you want it to rearm only after value is dropped below 50% ... so you add recovery expression "disk usage < 50%". If disk usage drops to, lets say 65%, you initial trigger is already FALSE as it is below 80... but recovery expression keeps it open until it really drops below 50...

So if you have trigger condition "length of last value >0" then it is still over 0 even if there is X amount of time passed... thus adding nodata() to recovery does not give you anything... initial trigger expression is still true...

You can combine both to one... length>0 and nodata(Xm)=1... if there is no data for Xminutes it will fire... or with nodata(Xm)=0 .. it will fire immediately when trap arrives and closes the problem X minutes after last data arrived..

EDIT: and yea.. multiple event generation is even more complicated topic...