Trigger event correlation recognizing tag for matching to resolve

[GarrettCO]

Hello all

Just asking for assist as to what would cause Recovery Expression to not recognize event tags in Trigger Correlation. I do know the Problem Expression needs to be FALSE before the Recovery Expression can evaluate as TRUE. My thinking is if using the find() function that when a Recovery Expression is evaluated outisde the default 30 seconds then the Problem Expression will be FALSE. I am just at a loss as to why recovery does not recognize and close associated tag "ifIndex".

Followed the following documentation but the behavior is odd as does not resolve associated event.

https://www.zabbix.com/documentation/current/en/manual/config/event_correlation/trigger

[GarrettCO]

Following up if anyone has any idea why tag matching would not be recognized. Looked more into documentation and curious if for this to work, it has to be the Zabbix agent that can accomplish this via looking into logs, and it's the SNMP agent that cannot accomplish tag matching

[cyber]

No, any trigger calculation, tag value extraction etc takes place on server, agent is just for gathering data. For server it does not matter how the data arrives, from agent or from SNMP.
Recovery expression is looked at only after trigger expression is calculated to False.
But your recovery is using different item. I am not sure tag values are even (re)calculated there. I think they are only extracted from trigger item and during trigger calculation...

I think you should try to capture linkup and down into same item and use same item in both calculations.. There was an example somewhere in this forum, not too long ago...