Zabbix recovery of problem

[wildm]

Hello,
I have created a trigger to create a linkDown trap but the recovery (linkUp) is not clearing the problem. The linkup comes very quickly after the linkDown so not sure if that is related to the issue.

Below are an example linkDown and linkUp (I have substituted some of the data below with XXX or nn:nn:nn:nn) for the same device/ifIndex:

2024-12-03T08:49:54+0000 ZBXTRAP nn.nn.nn.nn
PDU INFO:
errorstatus 0
transactionid 15794
messageid 0
version 0
notificationtype TRAP
receivedfrom UDP: [nn.nn.nn.nn]:161->[nn.nn.nn.nn]:162
errorindex 0
community XXXXXXX
requestid 0
VARBINDS:
SNMPv2-MIB::sysUpTime.0 type=67 value=Timeticks: (1011070289) 117 days, 0:31:42.89
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: IF-MIB::linkDown
IF-MIB::ifIndex.36 type=2 value=INTEGER: 36
IF-MIB::ifAdminStatus.36 type=2 value=INTEGER: 2
IF-MIB::ifOperStatus.36 type=2 value=INTEGER: 2
IF-MIB::ifDescr.36 type=4 value=STRING: "36"
IF-MIB::ifAlias.36 type=4 value=""
SNMPv2-SMI::snmpModules.18.1.3.0 type=64 value=IpAddress: nn.nn.nn.nn
SNMPv2-SMI::snmpModules.18.1.4.0 type=4 value=STRING: "XXXXXX"
SNMPv2-MIB::snmpTrapEnterprise.0 type=6 value=OID: XXXXXX

2024-12-03T08:49:57+0000 ZBXTRAP nn.nn.nn.nn
PDU INFO:
notificationtype TRAP
version 0
transactionid 15795
messageid 0
errorstatus 0
requestid 0
community XXXXXX
errorindex 0
receivedfrom UDP: [nn.nn.nn.nn]:161->[nn.nn.nn.nn]:162
VARBINDS:
SNMPv2-MIB::sysUpTime.0 type=67 value=Timeticks: (1011070560) 117 days, 0:31:45.60
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: IF-MIB::linkUp
IF-MIB::ifIndex.36 type=2 value=INTEGER: 36
IF-MIB::ifAdminStatus.36 type=2 value=INTEGER: 1
IF-MIB::ifOperStatus.36 type=2 value=INTEGER: 1
IF-MIB::ifDescr.36 type=4 value=STRING: "36"
IF-MIB::ifAlias.36 type=4 value=""
SNMPv2-SMI::snmpModules.18.1.3.0 type=64 value=IpAddress: nn.nn.nn.nn
SNMPv2-SMI::snmpModules.18.1.4.0 type=4 value=STRING: "XXXXXX"
SNMPv2-MIB::snmpTrapEnterprise.0 type=6 value=OID: XXXXXX

Attached is the screenshot for my trigger. I have checked the regular expression and it matches the ifIndex value ok

I know that polling would fix this but I have to rely on traps.

I am new to zabbix so may have missed something obvious but any ideas what the issue may be?

[cyber]

One thing.. use "PROBLEM event generation mode" -> Multiple. Otherwise it will not generate any other down events, while one is already triggered..
But otherwise... I managed to replicate this and it works just fine... (with zabbix v6)
Do you see portnumbers extracted nicely in tag values? That regsub had issues with multiline values, IIRC... So it may not extract, what you need and then things do not match any more...

[wildm]

Thanks for this. I realise I posted this question in the wrong place really.

I checked and it does look like the tag is the issue - see attached screenshot in comment below.

I am on version 7 and the same regex works when used in the name of the problem - just not in the tag. Is there a known workaround for this by any chance?

[wildm]

Tag appears to not be working

[cyber]

For myself, I have resovled it by adding a preprocessing to items "replace all linebreaks (\n) with ";;" ". Then your trap is saved as one line and regsub will work much better..

ie.

{{ITEM.VALUE}.regsub("ifIndex = (.*?);;","\1")}

if your saved data looks like

20241203.174847 UDP: [sender IP]:34857->[receiver IP]:162;;DISMAN-EVENT-MIB::sysUpTimeInstance = 0:0:00:00.00;;SNMPv2-MIB::snmpTrapOID.0 = IF-MIB::linkUp;;IF-MIB::ifIndex = 2;;IF-MIB::ifAdminStatus = down;;IF-MIB::ifOperStatus = up

[wildm]

Thank you. I have implemented and the tag looks ok - e.g. Port 2

I just need to check that the clear is working but no reason to think it should not be,