Need a valid Recovery Expresion

[badchoice]

Hello everyone!

After reading many topics about the recovery expression, I still have no solution for my case.
I have the following Trigger:

find(/Data/logrt[C:\Path\.log,"[FAIL].*Fail execution",,,,,,])=1

The trigger works fine and shows in the dashboard problem.
But I need the recovery alert after 60 minutes.

I try with this expression:

nodata(/Data/logrt[C:\Path\.log,"[FAIL].*Fail execution",,,,,,],60m)=1


But this option doesn´t work

Any ideas or suggestions for this matter??


Thank you so much for your attention and participation.

[salakmisri]

Have you considered checking whether the trigger state is still in the 'Problem' state before executing the recovery expression? Sometimes, it's helpful to use a combination of nodata and a specific recovery expression that reflects the successful state after a failure.

[ISiroshtan]

You don't need the recovery expression here. The recovery expression would be evaluated only if problem expression is false. So if you collected log entry about failure, and there is no recovery log entries coming, the problem expression will always be TRUE -> recovery expression will never even be considered by Zabbix.

Instead you'd want to add nodata() function into trigger expression, so something like

find(/Data/logrt[C:\Path\.log,"[FAIL].*Fail execution",,,,,,])=1 and nodata(/Data/logrt[C:\Path\.log,"[FAIL].*Fail execution",,,,,,],60m)=0

[badchoice]

You don't need the recovery expression here. The recovery expression would be evaluated only if problem expression is false. So if you collected log entry about failure, and there is no recovery log entries coming, the problem expression will always be TRUE -> recovery expression will never even be considered by Zabbix.

Instead you'd want to add nodata() function into trigger expression, so something like

Uhmmm interesting this!!

I try to configure and publish the results.

Thank you so much for your time