Best trigger expression for a host that has been shutdown

[adavis373315]

Hello!

I am struggling with trying to get a trigger expression to alert when a host is shutdown. Here is what I have tried so far, but this trigger expression never seems to fire

count(/OS Windows/icmpping,#10,"eq","0")>9 and nodata(/OS Windows/agent.ping,15m)=1 and count(/OS Windows/system.uptime,15m)=0

Is there something wrong with this expression? Please provide feedback if possible.

Thanks!

[SanMonitor]

Hey adavis,

the "nodata(/OS Windows/agent.ping,15m)=1" might be blocking your trigger here.
When the host is offline, there will still be data in this item, the value will just be a 0 (for the unsuccesfull ping).

Can you try removing this and see if it works better?

[adavis373315]

I'll give it a try and test it without that nodata expression Sam. Thanks!

[adavis373315]

I gave it a try, and it still didn't seem to work. What is the best way to go about getting an accurate trigger expression for a host being shut down? This one has been a tough one for me to crack as the agent being down or a network issue could also make the trigger go off too. I am open to suggestions on this.

[cyber]

Hey adavis,

the "nodata(/OS Windows/agent.ping,15m)=1" might be blocking your trigger here.
When the host is offline, there will still be data in this item, the value will just be a 0 (for the unsuccesfull ping).

Can you try removing this and see if it works better?

this is wrong... agent.ping does not return anything if it fails connection. there is no 0 recorded for it...

agent.ping
Agent availability check.	Nothing - unavailable 1 - available		Use the nodata() trigger function to check for host unavailability.

As OP here says, Zabbix cannot really decide, is is this caused by network issue or real shutdown. result is same, no data for "system.uptime", failed pings, and failed agent checks... You can ping closest GW and if that one is also down, one can assume network issues. You can probably create somekind of little script, that will send a value to item "I_am_shutting_down" with zabbix_sender during real shutdown. That would be knowledge from the real source..

[adavis373315]

Cyber's answer seems to be the best answer I could find on this. Thanks!