Ad Widget

Collapse

Using mulitiple find() in Trigger Expression not firing notification

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • GarrettCO
    Member
    • Jan 2024
    • 44

    #1

    Using mulitiple find() in Trigger Expression not firing notification

    Hello. Trying to get an understanding of the use of the find() function in trigger expressions. Have a scenario where only need to fire a notification to third-party ticketing only if the SNMP trap has severity of "critical"; lesser severity would not and just be ignored. After the event is pre-processed and logged, nothing happens even though the regexp parameters are met. When I look through the documentation does not appear multiple find() functions can't be done. Not sure if I am misinterpreting the scope of find().

    Zabbix 7.2.2

    LOG ENTRY:
    errorstatus 0
    messageid 0
    transactionid xxxxx
    errorindex 0
    VARBINDS:
    DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=1099922469
    SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.26866.1.1.9
    SNMPv2-SMI::enterprises.26866.1.2.17 type=4 value=STRING: "HC2-Chassis"
    SNMPv2-SMI::enterprises.26866.1.2.1 type=2 value=INTEGER: 4
    SNMPv2-SMI::enterprises.26866.1.2.2 type=4 value=STRING: "Packet Rx/Tx Error"
    SNMPv2-SMI::enterprises.26866.1.2.4 type=4 value=STRING: "1/1/x16"
    SNMPv2-SMI::enterprises.26866.1.2.7 type=2 value=INTEGER: 0
    SNMPv2-SMI::enterprises.26866.1.2.8 type=2 value=INTEGER: 7
    SNMPv2-SMI::enterprises.26866.1.2.9 type=2 value=INTEGER: 8
    SNMPv2-SMI::enterprises.26866.1.2.88 type=4 value=STRING: "xxxxxxxxx"
    SNMPv2-SMI::enterprises.26866.1.2.79 type=4 value=STRING: "Not-Applicable"

    POST PREPROCESSED ENTRY
    DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=1099922469
    SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.26866.1.1.9
    gigamon HardWare Name = "HC2-Chassis"
    gigamon Notification Level = Critical
    gigamon Description = "Packet Rx/Tx Error"
    gigamon Port Name = "1/1/x16"
    gigamon Rx Tx Type = 0
    gigamon Rx Tx Error Type = 7
    gigamon Counter = 8
    gigamon Host Name = "xxxxxx"
    gigamon Cluster ID = "Not-Applicable"​

    Click image for larger version

Name:	Screenshot 2025-02-06 at 1.08.31 PM.png
Views:	167
Size:	71.4 KB
ID:	498674
  • cyber
    Senior Member
    Zabbix Certified SpecialistZabbix Certified Professional
    • Dec 2006
    • 4806

    #2
    Why multiple finds?
    Code:
    find(/_BCV_Gigamon/snmptrap["gigamonSnmpRxTxErrorNotification - Critical"],,"regexp","\.26866\.1\.1\.9\s.*\s.*Notification Level = Critical\s")
    Regular expression tester with syntax highlighting, explanation, cheat sheet for PHP/PCRE, Python, GO, JavaScript, Java, C#/.NET, Rust.
    Last edited by cyber; 07-02-2025, 13:23.

    Comment

    Working...