Custom expression for monitoring disk growth over time

[Murmur12]

Hi,

I've been struggling with creating a custom trigger for when disk space exceeds growing 10G over 10 minutes.
I'm currently running Zabbix 6.0.35.
When looking online, the syntax used is often very different of what my version currently supports.

For example. This shouldn't be very difficult to achieve. I found the following code online and that should technically just work:

{hostname:vfs.fs.size[D:,used].last()} - {hostname:vfs.fs.size[D:,used].prev(10m)} > 10G

However using the syntax in this way is not supported for me.




Instead I tried using something like this:

last(/hostname/vfs.fs.size[D:,used]) - max(/hostname/vfs.fs.size[D:,used],10m) > 10737418240

This solution is going in the right direction but is showing some very weird behavior. When increasing the disk size used over 10G, the trigger does not fire. However when I free the same amount of space and go back to the amount of free storage I had before, The trigger does fire. It basically does the opposite of what it's supposed to do. The trigger also remains in the "PROBLEM" state far after the 10 minutes have exceeded. What I expected this code to do was to grab the used diskspace from 10 minutes ago, compare it to what the used diskspace is right now. Subtract them and see if the difference is bigger then 10G.

I have no idea how to get this working properly. Tried a lot of different things, half of which my Zabbix version does not seem to support.

Any ideas on how to approach this?

Thanks in advance and very kind regards.

[cyber]

Your first example is old syntax (before v5).. so it will not work for v6.

your second one ... "last value minus max value within last 10 minutes". I dont think this is what you meant (your last value IS the highest during 10 minutes, thus calculation result is 0)... you wanted to compare last value to a value 10m ago?

last(/hostname/vfs.fs.size[D:,used]) - first(/hostname/vfs.fs.size[D:,used],10m) > 10737418240

last value minus first value from 10m calculation interval..
almost same as

last(/hostname/vfs.fs.size[D:,used]) - last(/hostname/vfs.fs.size[D:,used],#1:10m) > 10737418240

they just look in different directions for second value... last value 10 minutes ago is looking back, first value 10m back is looking forward...
If we have values A, B, C, D.....N (N being latest and 10 minutes back is between B and C), then calculation is done either N-C or N-B

[cyber]

Your first example is old syntax (before v5).. so it will not work for v6.

your second one ... "last value minus max value within last 10 minutes". I dont think this is what you meant (your last value IS the highest during 10 minutes, thus calculation result is 0)... you wanted to compare last value to a value 10m ago?

last(/hostname/vfs.fs.size[D:,used]) - first(/hostname/vfs.fs.size[D:,used],10m) > 10737418240

last value minus first value from 10m calculation interval..
almost same as

last(/hostname/vfs.fs.size[D:,used]) - last(/hostname/vfs.fs.size[D:,used],#1:10m) > 10737418240

they just look in different directions for second value... last value 10 minutes ago is looking back, first value 10m back is looking forward...
If we have values A, B, C, D.....N (N being latest and 10 minutes back is between B and C), then calculation is done either N-C or N-B

[Murmur12]

Hello Cyber,

Thank you so much for your reply and for the clarification on how these functions work exactly.

I have tried changing up the code with your example. :

last(/hostname/vfs.fs.size[D:,used]) - first(/hostname/vfs.fs.size[D:,used],10m) > 10737418240

This worked like a charm!

Best and kind regards.