Zabbix 7.0 Trigger to compare with more than 2 values

[SirLagz]

Hi All,

I require some assistance with the following situation -

I need alerts when value 1 doesn't contain value 2.
These values are both IP addresses, but value 1 may be a single IP address, or more than one.

Both of these values are currently being sent to Zabbix via a script on another server, sending values via zabbix_sender.
These 2 values are stored on a bunch of hosts.
When both value 1 and value 2 are single IP addresses, I can do what I need to with the <> operator in a trigger expression like so -

last(/Script/IPCell)<>last(/Script/henodeb)

with value 1 being "henodeb" and value 2 being "IPCell"

However, this fails when

henodeb

is more than one address.

I tried using the find (https://www.zabbix.com/documentation...s/history#find) history function however that doesn't seem to take a item as the pattern

I suppose I could create more items when value 1 has more than one IP address, however that means that the trigger expression would take that into account and I'm not sure how that would work.

Does anyone have any suggestions on how this could be done?

Thanks in advance

[s841]

My first thought is that you can maybe use "replace".

It depends on the format of the values but, if it's a script, I imagine you can likely tweak the output a bit if necessary. For example, let's say we have two items with the following values:

item1: "192.168.1.12","192.168.1.13","192.168.92.54"
item2: "192.168.1.13"

The point here is that item1's IPs are wrapped in quotes or something similar to delineate where an ip starts and ends.

Now from this point, we can use `replace`. The thought behind this is that we will essentially try to replace any occurrence of item2 in item1 with an empty string, and then compare that new value with item1's original value. If they are the same, then item2 doesn't contain an IP in item1. If they are different, then there was an occurrence of item2 within item1. So our trigger might look like this:

replace(last(/test-host/item1), last(/test-host/item2), "")<>last(/test-host/item1)

I tested this out and was able to get a successful event generated for it:

[SirLagz]

Very clever.
I will try this out and report back

[SirLagz]

Seems to work well. I will need to keep an eye on this to make sure it does what I need, but working well so far!