**Simplified problem statement**
A trigger (prototype) cannot be evaluated at host level because *its associated item* (prototype) *does not store anything in history*, i.e., nothing is saved in storage.
**What I want to acomplish**
I have a list of processes (applications) that I need to know if they are terminated (individually) at any moment of time by any reason.
**What I have at the moment**
In order to gather the information of the terminated processes I used a PowerShell script that returns a JSON. It has this structure:
{
data: [
{
"ProcessName": "app1.exe",
"TerminationTime": StringifiedDateTime()
},
{
"ProcessName": "app2.exe",
"TerminationTime": StringifiedDateTime()
},
...
]
}
The script returns the most recent terminated process in the last 5 minutes. The master item that executes this script calls the script every 4 minutes. If a process is terminated several times in that 5-minute period, only the latest log of process termination is appended to the JSON.
In Zabbix Frontend, I created a (Dependent type) Discovery Rule assosiated with my master item (the one that collects the JSON from the PS script).
This is the workflow:
1. Master item collects JSON object
2. Master item uses preprocessing to discard any unchanged data and utilizes JSONPath to get the array "data" using `$.data[:]` as the PATH.
3. A discovery rule associated with the master item creates two LLD Macros: `{#PROCESS_NAME}` associated with `$.ProcessName` and `{#TERMINATION_TIME}` associated with `$.TerminationTime`.
4. The discovery item filters the `{#PROCESS_NAME}` macro according to a Global Regular Expresion "@Applications", which is just the list of processes I want to know if they are closed. It has this structure:^(app1.exe|app2.exe|...|appN.exe)$
5. An item prototype is created. It has this name: `Application {#PROCESS_NAME} terminated at {#TERMINATION_TIME}`. It is of type Dependent Item, and it *do not keep history data*. It also discard unchanged items in the preprocessing tab. 6. A trigger is generated using the `find()`.
This last step is where I am having issues. I do not know what is the best way to create these triggers. I am using this Expression but I know it is not appropiate:
find(/PowerShell Scripts/terminatedProcess.ProcessName[{#PROCESS_NAME}],,"eq",{#PROCESS_NAME})=1
**Details**
At host level, *items are created and updated succesfully*. If `app1.exe` is closed at time `time1`, an item with the name: "Application app1.exe terminated at time1" is created. If immediately, at next execution, app1 appears again in the JSON, the time is updated to `time2`. The previos item will be updated to "Application app1.exe terminated at time2".
At host level, triggers are the issue. Their status appears as unknown at next execution of the script.
Cannot evaluate function find(/SVR-GASO/terminatedProcess.ProcessName[8050.exe],,"eq","8050.exe"): item history is disabled.
Also, the following warning appears if the application does not appear in the JSON at next execution, which I think is fine because that is the whole idea:
The trigger is not discovered anymore and will be deleted in 32m 36s (on 2024-04-19 at 09:08).
**The goal**
If the "TerminatedProcess.ProcessName\[app1.exe\]" item is generated, a trigger must so. If the app1.exe is no longer in the JSON, the item ideally should be removed with is associated trigger. But I want to keep history of these processes being closed.
**Images**
A trigger (prototype) cannot be evaluated at host level because *its associated item* (prototype) *does not store anything in history*, i.e., nothing is saved in storage.
**What I want to acomplish**
I have a list of processes (applications) that I need to know if they are terminated (individually) at any moment of time by any reason.
**What I have at the moment**
In order to gather the information of the terminated processes I used a PowerShell script that returns a JSON. It has this structure:
{
data: [
{
"ProcessName": "app1.exe",
"TerminationTime": StringifiedDateTime()
},
{
"ProcessName": "app2.exe",
"TerminationTime": StringifiedDateTime()
},
...
]
}
The script returns the most recent terminated process in the last 5 minutes. The master item that executes this script calls the script every 4 minutes. If a process is terminated several times in that 5-minute period, only the latest log of process termination is appended to the JSON.
In Zabbix Frontend, I created a (Dependent type) Discovery Rule assosiated with my master item (the one that collects the JSON from the PS script).
This is the workflow:
1. Master item collects JSON object
2. Master item uses preprocessing to discard any unchanged data and utilizes JSONPath to get the array "data" using `$.data[:]` as the PATH.
3. A discovery rule associated with the master item creates two LLD Macros: `{#PROCESS_NAME}` associated with `$.ProcessName` and `{#TERMINATION_TIME}` associated with `$.TerminationTime`.
4. The discovery item filters the `{#PROCESS_NAME}` macro according to a Global Regular Expresion "@Applications", which is just the list of processes I want to know if they are closed. It has this structure:^(app1.exe|app2.exe|...|appN.exe)$
5. An item prototype is created. It has this name: `Application {#PROCESS_NAME} terminated at {#TERMINATION_TIME}`. It is of type Dependent Item, and it *do not keep history data*. It also discard unchanged items in the preprocessing tab. 6. A trigger is generated using the `find()`.
This last step is where I am having issues. I do not know what is the best way to create these triggers. I am using this Expression but I know it is not appropiate:
find(/PowerShell Scripts/terminatedProcess.ProcessName[{#PROCESS_NAME}],,"eq",{#PROCESS_NAME})=1
**Details**
At host level, *items are created and updated succesfully*. If `app1.exe` is closed at time `time1`, an item with the name: "Application app1.exe terminated at time1" is created. If immediately, at next execution, app1 appears again in the JSON, the time is updated to `time2`. The previos item will be updated to "Application app1.exe terminated at time2".
At host level, triggers are the issue. Their status appears as unknown at next execution of the script.
Cannot evaluate function find(/SVR-GASO/terminatedProcess.ProcessName[8050.exe],,"eq","8050.exe"): item history is disabled.
Also, the following warning appears if the application does not appear in the JSON at next execution, which I think is fine because that is the whole idea:
The trigger is not discovered anymore and will be deleted in 32m 36s (on 2024-04-19 at 09:08).
**The goal**
If the "TerminatedProcess.ProcessName\[app1.exe\]" item is generated, a trigger must so. If the app1.exe is no longer in the JSON, the item ideally should be removed with is associated trigger. But I want to keep history of these processes being closed.
**Images**