zabbix 6.4 configuring trigger for snmp interface down/ up traps

[ISiroshtan]

Hey Marijana
So let me try to explain what is the issue and why it not working as you expect.

Main point to understand here - recovery expression. Recovery expressions is evaluated only AFTER trigger expressions switches to false. So if you have two different items (A and B) and want a trigger to open based on value of A but be resolved based on value of B, you need to make sure that by time B arrives the trigger expression is already resolved. So if you use find(A, ...)=1 and item A only gets values that match this condition, the trigger can not be automatically resolved. Ever. Because latest value of value A that find(A) takes for evaluation is always matches the alert condition. Simply put, if you got trap "power lost" at 15:39, the last value of item A will still be "power lost" at 16:00, 20:00, 24:00, etc. It will never change. No matter how many traps arrive to item B, value of find(A) will remain same and will satisfy the trigger expression.

In my initial message in this thread I offered the easiest way to solve it - you combine traps that trigger alert and those that resolve alert into same item. This way find() function will be fetching the latest trap. If latest trap received indicates alert fire condition - trigger condition will match and alert will fire. If latest trap received indicates alert resolution condition (or NOT alert fire condition) trigger expression will be false (and recovery condition will be true, if set) resulting in alert resolving.


Alternative approach (which I think is working, tho it was long time since i had to use it so not sure if it still would work same way in current version of Zabbix) is to limit time for how far back in the past we looking with find() function.
This way you keep your items A and B separately. Then you define trigger like find(A,1m,"regexp","some_matching_string")=1. Recovery like find(B,1m,"regexp","some_other_matching_string")=1 .
Now how it work:
Trap arrives to item A with matching string - Zabbix will take all values A over last minute and check if any of them match trigger conditions -> last one matches -> alert fired.
Few minutes later (it's important, we set 1m in find() function, so there should be at least 1 minute between alert trap and recovery trap) a recovery trap arriver -> as new value that is used for trigger arrive Zabbix needs to reevaluate the trigger -> zabbix takes all values over last minutes for item A -> there should be no values, as alert open trap arrived more than a minute ago -> trigger expression is not satisfied(false) so zabbix can proceed to check recovery expression -> it takes all values of item B now over last minute -> it checks if find function matches -> it's matched -> alert resolved

Big problem with second approach is the fact you are setting static lookback (1m in my example) to function. If time between alert trap and recovery traps will be less then set time (1m) - recovery will not work. That is why I recommend first approach whenever possible.
(And writing regexp with oid name instead of oid number is easier (IMO), that is why I usually recommend to have mibs installed)

Either way, pretty lengthy reply and I never saw myself as good at explaining, so feel free to follow up with questions

[cyber]

This way you keep your items A and B separately. Then you define trigger like find(A,1m,"regexp","some_matching_string")=1. Recovery like find(B,1m,"regexp","some_other_matching_string")=1 .
Now how it work:
Trap arrives to item A with matching string - Zabbix will take all values A over last minute and check if any of them match trigger conditions -> last one matches -> alert fired.
Few minutes later (it's important, we set 1m in find() function, so there should be at least 1 minute between alert trap and recovery trap) a recovery trap arriver -> as new value that is used for trigger arrive Zabbix needs to reevaluate the trigger -> zabbix takes all values over last minutes for item A -> there should be no values, as alert open trap arrived more than a minute ago -> trigger expression is not satisfied(false) so zabbix can proceed to check recovery expression -> it takes all values of item B now over last minute -> it checks if find function matches -> it's matched -> alert resolved

Are you sure... ? I think if there is no new value for A, that trigger will not be reevaluated and recovery will not be considered, even if B has new value... because B is not part of "original" expression..
If it works, as you say, there is a shortcoming in docs... It should then mention also recalculating, it any of items in recovery expression receive new value...

https://www.zabbix.com/documentation/7.2/en/manual/config/triggers#calculation-time

Calculation time
A trigger is recalculated every time Zabbix server receives a new value that is part of the expression. When a new value is received, each function that is included in the expression is recalculated (not just the one that received the new value).
Additionally, a trigger is recalculated each time when a new value is received and every 30 seconds if date and time and/or nodata() functions are used in the expression.
Date and time and/or nodata() functions are recalculated every 30 seconds by the Zabbix history syncer process.

[ISiroshtan]

Are you sure... ? I think if there is no new value for A, that trigger will not be reevaluated and recovery will not be considered, even if B has new value... because B is not part of "original" expression..
If it works, as you say, there is a shortcoming in docs... It should then mention also recalculating, it any of items in recovery expression receive new value...

that is the fun part. Based on documentation it should not work, just as you say. And it should not have worked in past versions too. But I know for a fact it did work like that in v4 and v6. Because I never tested it in v7 I did add the

(which I think is working, tho it was long time since i had to use it so not sure if it still would work same way in current version of Zabbix)

And I demonstrated this case to my instructor during ZCS v6 course, asking for explanation how so.. sadly instructor was as surprised as you are about it and I never got my reply on this case

[cyber]

Nice.. Give that man a cookie..

[Marijana]

hi guys!!
I solved this problem with using nodata function with some agreed time intervall. .no other ways were possible

ISiroshtan
yes ,you are wright .Your explanation is true but I am not used on that logic of zabbix ( I used to work with enterprsie grade software .for example NNMi of HP /MicroFocus /Optics, InfoVista by InfoVista where this stuff were practically built n (almost ). Yes that is why you are paying big money for enteprise software not to bleeding on each step, like with Zabbix . special I am new to "its" logic.
anyhow ,thi is how I "have solved" request for autoclose of trap.
define first





thx a lot for YOUR HELP!!!!!

[Marijana]

Hi!

Now I have new challenge by our network guys and their non existent naming convention
so I use autodiscovery rules and discovery actions to put node in monitored state.
beacuse of non dns records for all nodes ,I have to use SysName.0
1. problem ( not related to sysname variable) -i see node in discovery list ,its ip address ,but it is not in monitored state.I have wait usually 1 day ...sometimes more ..sometimes is at once ,sometimes it never happens.....and it si same subnet , same type of devices. SO my first question is how I can tshoot this discovery actions ? and setting time to be short , for putting device into monitored state.? I am in completely dark there.
discover rule:


action:




simple as it could be and still not working. or mybe it will show up after y time.

2. here is problem with names:
SNMPv2-MIB::sysName.0 = STRING: DO-81173-M-10_(BLA-1)
you see name has "(" and ")" which is not good ,but they are stubborn and resist to build normal name
that name shows up in zabbix like thIs : DO-81173-M-10__BLA-1_
Zabbix parser changed "(" into "_" .. so my question is :where I could find and see parser code in zabbix installation ? it is LLD discovery and parsing ..what is the name of script?
i will not change anything but want to be able to see because I could not find in documenation . I am using 6.4 Zabbix.
other time will something else be problem.
thx a lot again for your help!!
BR,
marijana