Understanding zabbix triggers for discovered items (systemd monitoring)

[msl09]

I'm monitoring systemd services with zabbix (6.4.16). The default template is fine for most of my services, but one of them restarts itself every night and spends a good minute offline. So I tried to create an alternative trigger for it:

(
find(/Systemd by Zabbix agent 2 - Custom/systemd.service.active_state["{#UNIT.NAME}"], 5m, "eq", 1)
+ find(/Systemd by Zabbix agent 2 - Custom/systemd.service.active_state["{#UNIT.NAME}"], 5m, "eq", 3)
) = 0

What I expected was, after 5 minutes of a service not being in active state 1 or 3 (active and inactive, respectively) the trigger would go off. What actually happened is that the trigger would take 30minutes to go off.

So I looked for the value of the /Systemd by Zabbix agent 2 - Custom/systemd.service.active_state["{#UNIT.NAME}"] item and I was surprised to see that the most of the item history was blank, the parent item systemd.unit.get["{#UNIT.NAME}"] is checked every 1m.



So my questions are. Why is the active state item so sparse? And how do I implement the trigger to go off after 5 minutes without good data (values 1 or 3, as described above).

[Dmitry2007]

You have got preprocessing in your item? Something like Discard unchanged with heartbeat 30m? If it so, then you need to change either trigger or item. Choose what suits you best

[msl09]

Yes I did. Thanks for the help!