Trigger expression for last 3 changes in a row are with some value

[reddysk]

Hello,

I am trying to setup a trigger wich will raise problem in case if last 3 measures report increase of value at least by 4.

Something with this syntax but functional.
"last(change(rejected.sessions),#3)>=4".

Meaning last 3 values of function "change(rejected.sessions)" are higher or equal 4

Can't find the right solution.

Thank your
Regards, Rudo

[markfree]

I think the expression "last(change(rejected.sessions),#3)" would be incorrect.

The "change" function gives you "the amount of difference between the previous and latest value."

You cannot evaluate the second or third most recent change amount unless you store it.
Therefore, "change(rejected.sessions)" should be an item for the "last" function to evaluate it.

Still, you could try to use only the "last" function for this.

Is this what you mean?

( last(/host/key,#1) - last(/host/key,#2) )>=4
and
( last(/host/key,#2) - last(/host/key,#3) )>=4
and
( last(/host/key,#3) - last(/host/key,#4) )>=4

[reddysk]

Mark, thank you. it is working by this hack.

[markfree]

I think the expression "last(change(rejected.sessions),#3)" would be incorrect.

The "change" function gives you "the amount of difference between the previous and latest value."

You cannot evaluate the second or third most recent change amount unless you store it.
Therefore, "change(rejected.sessions)" should be an item for the "last" function to evaluate it.

Still, you could try to use only the "last" function for this.

Is this what you mean?

( last(/host/key,#1) - last(/host/key,#2) )>=4
and
( last(/host/key,#2) - last(/host/key,#3) )>=4
and
( last(/host/key,#3) - last(/host/key,#4) )>=4

[reddysk]

Mark, thank you. it is working by this hack.

[Semiadmin]

This method is simple for 3 values, but dramatically difficult for many values (for example, 60 or during 1h).
For such case you may create a dependent item (for example, rejected.sessions.delta) with simple change in preprocessing and a trigger:

monoinc(/host/rejected.sessions,1h)=1 and min(/host/rejected.sessions.delta,1h)>=4

[markfree]

This method is simple for 3 values, but dramatically difficult for many values (for example, 60 or during 1h).
For such case you may create a dependent item (for example, rejected.sessions.delta) with simple change in preprocessing and a trigger:
monoinc(/host/rejected.sessions,1h)=1 and min(/host/rejected.sessions.delta,1h)>=4

Considering the question above was only for the last 3 deltas, I think that using the "last" is sufficient and avoids creating a new item. But I see what you mean for a larger context.

I didn't understand one thing: why use the "monoinc" function for the parent item?
If a dependent item is created to store the delta values, isn't the "min" function enough?

[Semiadmin]

If the value of the master item is reduced, the dependent item will skip the value. We have to make sure that this does not happen.

[markfree]

Oh I see... because Zabbix discards negative differences with the simple change preproc.