One trigger doesn't send recovery notifications

[artschooldropout]

We're using Zabbix 6.4.10. We have many working triggers which send problem and recovery notifications based on host group. We have one host (it's an Audiocodes SBC) in this host group with many working triggers, but one trigger (based on an SNMP item) doesn't send recovery notifications. The problem expression for this trigger is

last(/[host FQDN]/acActiveAlarmSeverity[{#ALRMID}])<>0

. Basically, if there's an active alarm on the device, it triggers a problem. The 'Ok Event Generation' was set to 'Expression' so I tried changing it to 'Recovery Expression' and set that to

last(/[host FQDN]/acActiveAlarmSeverity[{#ALRMID}])=0

, however, it still doesn't work. Any ideas?

[cyber]

I suppose you only gather active alarms, that have some kind of severity higher than 0? That's why your expression does not ever return to normal also.. your last value has always a value <>0 (and no, if check does not return anything, then it is not 0, it is "no value", nothing is returned or saved, last() will still return value of whatever was last). And adding recovery does not change anything, it is additional expression that has to be true AFTER problem expression already turned FALSE.. So if your initial expression never becomes false, recovery will not be looked at also...

OK event generation

OK event generation options: Expression - OK events are generated based on the same expression as problem events; Recovery expression - OK events are generated if the problem expression evaluates to FALSE and the recovery expression evaluates to TRUE; None - in this case the trigger will never return to an OK state on its own.

https://www.zabbix.com/documentation/current/en/manual/config/triggers/trigger

[artschooldropout]

Here's an example of what the item returns when there is an active alarm:

[{"{#SNMPINDEX}":"167","{#ALRMID}":"167","{#ALRMNAM E}":"[SBC] Proxy Set Alarm Proxy Set 1 ([server name]): Server [IP] is down - one or more servers in the proxy set are offline","{#ALRMSRC}":"Board#1/ProxyConnection#1"}]

Here's what gets returned when there is no alarm:

[]

So I tried changing my problem expression; I added this to the existing expression

and nodata(/Basic AudioCodes - SNMP/acActiveAlarmSeverity[{#ALRMID}],120)=0

Note that the item gets polled every 60 seconds, so I set the timer for this at 120 seconds.

Basically, when there's *some data* returned by the item and there's an alarm with non-zero severity, that should trigger the problem. However, I still don't get resolved notifications. Any ideas?

[cyber]

Its kind of fuzzy here (or maybe its just Friday evening)... you are displaying prototypes in first post.. right? Or is that {#ALARMID} accidentally looking just like LLD macro?

last(/[host FQDN]/acActiveAlarmSeverity[{#ALRMID}])<>0

Then your items return json data... do you think that acActiveAlarmSeverity[{#ALRMID} automatically refers to a specific field in returned json? Or is it still a prototype trigger we are talking about .. ?

[artschooldropout]

That's correct, I'm editing the trigger prototype. The trigger gets populated in the host when the discovery rule finds an alarm. For instance, here's one such trigger that's been discovered:

last(/[host FQDN]/acActiveAlarmSeverity[169])<>0 and nodata(/[host FQDN]/acActiveAlarmSeverity[169],120)=0

[cyber]

That one should return to OK if there is no data during 2m... it is pretty much the same as having just nodata() clause, because first part is most probably always true