Str trigger only when repetition

[norbertorozas]

Hi!

I'm using a script to test a TCP connection. Every output from it is:

ok: when connection is ok;
mipid_error: when there's any problem

To avoid false triggers I 'd like 3 consecutive errors before trigger it.

I used: {COP.APP1:tmid[s2.xxxx.com,8001].str(mipid_error,#3)}=1

But #3 is not giving to me what I expected, since it is triggering in the following situation:

12/24/2016 11:39:32 AM ok
12/24/2016 11:38:32 AM ok
12/24/2016 11:37:31 AM ok
12/24/2016 11:36:32 AM ok
12/24/2016 11:35:32 AM ok
12/24/2016 11:34:32 AM ok
12/24/2016 11:33:32 AM ok
12/24/2016 11:32:32 AM ok
12/24/2016 11:31:42 AM mipid_error
12/24/2016 11:30:32 AM ok
12/24/2016 11:29:31 AM ok


And I want triggering only in this situation:

12/24/2016 11:39:32 AM ok
12/24/2016 11:38:32 AM ok
12/24/2016 11:37:31 AM ok
12/24/2016 11:36:32 AM ok
12/24/2016 11:35:32 AM ok
12/24/2016 11:34:32 AM ok
12/24/2016 11:33:32 AM mipid_error
12/24/2016 11:32:32 AM mipid_error
12/24/2016 11:31:42 AM mipid_error
12/24/2016 11:30:32 AM ok
12/24/2016 11:29:31 AM ok



What am I doing wrong?

[Linwood]

{COP.APP1:tmid[s2.xxxx.com,8001].str(mipid_error,#3)}=1 AND 
{COP.APP1:tmid[s2.xxxx.com,8001].str(mipid_error,#4)}=1 AND 
{COP.APP1:tmid[s2.xxxx.com,8001].str(mipid_error,#5)}=1

The #3 refers to the third item, not how many. Something like the above (depending on where in the list you want it to check, it might be 1, 2, 3 instead of 3, 4, 5 but I took you literally.

[norbertorozas]

Thank you!!!

It's a bit common confusion between #3 as the 3rd register (what is!) and the last 3 events....

Anyway, I've tried:

{COP.APP1:tmid[s2.xxxx.com,8100].str(mipid_error,#1)}=1 and {COP.APP1:tmid[s2.xxx.com,8100].str(mipid_error,#2)}=1

And the behavior seems to be the same:
27-12-2016 13:44:32 ok
27-12-2016 13:43:32 ok
27-12-2016 13:42:45 mipid_error
27-12-2016 13:41:31 ok
27-12-2016 13:40:32 ok
27-12-2016 13:39:32 ok

.. triggering the event (with only 1 occurrence):

DATE DESCRIPTION STATUS
27-12-2016 13:43:32 Driver: Aplicacao - L2S1 OK
27-12-2016 13:42:45 Driver: Aplicacao - L2S1 PROBLEM


Anything else?

PS: "AND" must be lower case, correct?

[Linwood]

Sorry, drawing a blank, hopefully someone can help.

[norbertorozas]

There's a new test that may help understand this issue:

I simplified expression just to test if the n th. data would be detected (in this case, the 5th data):

{COP.APP1:tmid[s1.xxxx.com.br,8100].str(conn_error,#5)}=1

The result was that:

a) As problem occurred (expression = 1), it triggered immediately!
b) As it returns to normal (ok), it detected in the 5th event


30-12-2016 11:44:26 ok
30-12-2016 11:43:27 ok <- Where "Normal" triggered
30-12-2016 11:42:26 ok
30-12-2016 11:41:29 ok
30-12-2016 11:40:26 ok
30-12-2016 11:39:27 ok
30-12-2016 11:38:21 conn_error <- Where "Problem" was supposed to trigger
30-12-2016 11:37:22 conn_error
30-12-2016 11:36:26 conn_error
30-12-2016 11:35:26 conn_error
30-12-2016 11:34:26 conn_error <- Where "Problem" triggered in fact
30-12-2016 11:33:27 ok
30-12-2016 11:32:27 ok
30-12-2016 11:31:27 ok
30-12-2016 11:30:27 ok

That confused me! Any explanation?

[Linwood]

I think maybe I misled you earlier, sorry.

A function .last(#5) is the 5th prior item.

Other functions, like sum(#5) are the sum of all 5 prior.

I was thinking that str, being a matching, would act like last, but I think not; my guess is it is checking all 5, not the 5th.

I'm not where I can try this, and the syntax of nesting always completely confuses me, so you likely have to experiment with the syntax, but see if you can work it so last is in there somewhere.

{COP.APP1:tmid[s1.xxxx.com.br,8100].last(#5)}.str(conn_error)=1

An alternative might be to create a calculated item with the .last(#5) and then use those in the trigger if you can't nest the two.

Or maybe there's a syntax for saying it in "str", it just doesn't jump out at me at the moment.

See here.

[norbertorozas]

{host:item.last}.str() ????? Strange syntax... It was not recognized by Zabbix.

By the way... searching a little more, I found a "work around" for it (at http://serverfault.com/questions/658...matches-regexp )

It was not using str but solve the problem anyway:

{COP.APP1:tmid[s1.xxxx.com,8100].count(#3,conn_error,eq)} = 3

The result was what expected:

30-12-2016 19:01:32 ok
30-12-2016 19:00:32 ok <- Triggered "Normal" on first 'ok'
30-12-2016 18:59:26 conn_error
30-12-2016 18:58:26 conn_error <- Triggered "Problem" after 3 repetitions
30-12-2016 18:57:26 conn_error
30-12-2016 18:56:26 conn_error <- Did not trigger
30-12-2016 18:55:32 ok
30-12-2016 18:54:32 ok
30-12-2016 18:53:31 ok


So str mystery remains... and so the confusion "#3" makes in our minds....

Thank you, Linwood !!! And have a nice 2017!

[Linwood]

Yeah, I was making up the syntax hoping for a way to combine functions (no server handy) and hoping you would figure out a combination.

Personally I find the disconnect between item function and trigger function syntax, and the relatively... unusual syntax for parameters in general (I never know when to quote things for instance) all to be cumulatively tiring.

But I guess it works. Sorry I sent you off on a tangent in the first place.

Happy New Year!