trigger expression - external reference

[MichaelM]

Hi all,

I try to monitor all of my linux hosts checking for the latest kernel installed.

My current trigger expression looks like this:
{myhost:system.sw.os[short].str({$LATEST_KERNEL})}=0

$LATEST_KERNEL is statically set either in the host object or by a template, which means whenever a new kernel is available I have to manually edit the host objects or the template.

I thought it would be handy to have some kind of reference host which holds the latest value populated by a zabbix_sender. I tried to change my trigger expression to something like this, but it seems that I cannot use an external reference as argument for str function?

{myhost:system.sw.os[short].str({Reference Values:linux.ubuntu.1604.latestkernel})}=0

I did not get any error messages, but the trigger does not get fired up.

The other option (but a bit more complex) would be to set the macro via api.

Did anyone else tried to monitor something like this, which can come in handy to monitor all kind of software versions?

--Michael

[Linwood]

I may be missing the point, but is there a reason you don't check the diff function and trigger when there's a change?

[MichaelM]

Hi Linwood,

I need to compare a reference value to with the current item value, diff does compare a change of the item value itself?

Or let me rephrase, can I compare a string item value from host #1 with a string item value of host #2? This is what I try to do.

--Michael

[Linwood]

Hi Linwood,

I need to compare a reference value to with the current item value, diff does compare a change of the item value itself?

Or let me rephrase, can I compare a string item value from host #1 with a string item value of host #2? This is what I try to do.

--Michael

I do not think you can do that (compare between two hosts) inside of a template, but not sure if in an item directly in a host. I always have to experiment with their regexp comparator to see what it will take and what it won't.

But if you are trying to check against a standardized value, you could use an external check against some master system (is that what you are after) to populate a global user macro through the API and compare against that.

[MichaelM]

Hi,

I have to bring this old post back, because I still need a solution for this.

I have a list of version numbers for different software packages, these are my reference values.

The agent gathers the version numbers of installed software and I need to compare this value with the reference (latest version) value. If it differs I have to fire up a trigger.

I was hoping to accomplish this without any API calls to modify some macros, a somewhat reference host with items would be perfect, but I think it's not possible. I can't even compare to item values in a trigger?

Any help highly appreciated, I'am struggling with this for a while.

--Michael

[Linwood]

Why doesn't comparison against a user macro value work for you? The user macro containing a list of allowable values (probably as a regex)?

[MichaelM]

Hi,

I could use macros, API calls does not look that much complicated, but if I change my reference value (macro) it seems that my trigger does not get evaluated automatically.

Only if item gets a new value the trigger gets fired up as well.

--Michael

[Linwood]

Hi,

I could use macros, API calls does not look that much complicated, but if I change my reference value (macro) it seems that my trigger does not get evaluated automatically.

Only if item gets a new value the trigger gets fired up as well.

--Michael

That's correct, triggers are evaluated only on value change, but that would be true in an external item calculation as well whether or not it used the API, as it would not get called except on the poll interval. You can use zabbix trapper items, which can be sent asynchronously from outside routines, and force evaluation at that point, but this leaves them rather disconnected from zabbix, so things like start/stop (or even ensuring they are always running) becomes a chore.

You said this was checking for a kernel version -- do those really change so rapidly you can't wait for a polling interval for general information? Is someone just standing by ready to react to a kernel version number change in seconds?

[MichaelM]

Hi,

what polling interval you mean? Will the trigger evaluated by an interval automatically? If this interval has a reasonable value that would do the trick as well, but I'am not aware of this.

--Michael

[Linwood]

Hi,

what polling interval you mean? Will the trigger evaluated by an interval automatically? If this interval has a reasonable value that would do the trick as well, but I'am not aware of this.

--Michael

Generally no, the trigger evaluates when new values come in, and values typically come in when an item polls. So if you are pulling the version from an SNMP poll every 60 seconds, the trigger fires when the value updates to check if the new value affects the trigger state.

There are some exceptions like triggers evaluated on a time basis (e.g. no data) but for most things triggers update on item poll.