Do recovery triggers use zabbix value cache, even with no problem triggered?

[PliusZabbixMan]

Hello,

The issue I'm facing is described by the topic title. I will go into more detail:

I am monitoring network switches. The default template trigger was checking if the port speed reached 100mbps and triggered if it fell below 100mbps afterwards.

Since the recovery option was for it to reach 100mbps again, but often it is not supposed to, I added a recovery trigger "OR" using the delta(7d):

triggers.recovery_expression: {ifHighSpeed[{#SNMPINDEX}].min(#5)}=1000000000 => {ifHighSpeed[{#SNMPINDEX}].min(#5)}=1000000000 or {ifHighSpeed[{#SNMPINDEX}].delta(604800)}=0

After this change my value cache usage % spiked by 25%.


At first I assumed that recovery expressions are only used once the problem is triggered, but now I have my doubts.

[cyber]

I think any item value, that is used in calculations, be it problem or recovery, will be kept in cache... So, if you want to use 7d of values for calculation... you need some place to keep the data.

[PliusZabbixMan]

I see. Any advice to go around this? A spike in cache usage by 25% makes this recovery trigger invalid. The amount of data taken is not important, the time frame is. Maybe there are some less resource intense functions?

[PliusZabbixMan]

I found this macro defined in the zabbix documentation: {EVENT.AGE}

Maybe I could use {EVENT.AGE} to close the problem after 7 days?

[cyber]

Docs also say, where you can use it. It does not say, you can use it in trigger expressions... trigger notifications, yes, but directly in trigger expression... no. All time based closing is complicated, unfortunately...

[PliusZabbixMan]

Ok, now what I used was this.

{ifHighSpeed[{#SNMPINDEX}].min(#5)}=1000000000 or {ifHighSpeed[{#SNMPINDEX}].last(,7d)}={ifHighSpeed[{#SNMPINDEX}].last()}

Not exactly what I wanted, since it opens up the possibility of false recoveries if the port speed goes to 100mbps and back down to 10mbps within the week, but I think it's good enough for now.

If anybody thinks of a solution let me know.

Thank you.