How to trigger alert if file is not modified since X hours

[Merrick]

Hello all,

first of all, english is not my native language, so please forgive if I make mistakes.

I try to monitor the date of the last backup. I created a template, named Backup, that collects vfs.file.time[/var/log/backup.log,modify]
I created a trigger : fuzzytime(/Backup/vfs.file.time[/var/log/backup.log,modify],12h)=0

I thought this trigger should be up only if the file was not modified since at least 12 hours, but it always trigger.
When I look and the item, I can see :

awx2

backup_last_write

26m 38s

1732762868

That means : 2024-11-28 04:01:08 (and it's consistent with a "ls -al" command), and it is now 2024-11-28 09:25, so the trigger should not raise, but it still does. What am I missing ?

Zabbix version : 7.0.6, using docker

Thanks a lot

[cyber]

fuzzytime is not a function to be used here...

fuzzytime (/host/key,sec)

Checking how much the passive agent time differs from the Zabbix server/proxy time.

All you need is "now()-last(/Backup/vfs.file.time[/var/log/backup.log,modify])> 43200"

[Merrick]

Well... Thank you, your solution is far more elegant than what I tried to do, but... now the trigger does not raise. Is there a way to test expressions (to see what is the value of now()-last(/Backup/vfs.file.time[/var/log/backup.log,modify]) for example ?

[Merrick]

The solution works. I had to restart the server (don't know why), but after that, I've got the alerts. Thanks a lot !

[cyber]

Trigger testing is possible. If you open triger config, theres also a link "expression constructor"

if you use it, there will also be a "Test" button, where you can submit values to expression and see result...

[Merrick]

Thank you, all now is working fine, but after restarting the server only (docker version). I didn't know about this expression constructor, I will look at it right now