Interface up/down flapping trigger

[Mechanix]

Hi,

I have this trigger in place to notify me if a interface goes from status up to down.

{Template Datacenter:ifOperStatus[{#SNMPVALUE}].avg(5m)}<2 and {Template Datecenter:ifOperStatus[{#SNMPVALUE}].last()}=2 and {Template Datacenter:ifAlias[{#SNMPVALUE}].str(this_does_not_exist)}=0

This works well. However we got a couple of interfaces (mainly VPN Tunnel endpoints) which goes fro a couple of seconds down during the night.
How can fire up the trigger only if the interface has been down for lets say =3 minutes?

Any hint is much appreciated.

Cheers

[Mechanix]

Sorry to push this: any thoughts? Thank you

[Semiadmin]

{Template Datacenter:ifOperStatus[{#SNMPVALUE}].count(3m,2,eq)}=3 and {Template Datacenter:ifOperStatus[{#SNMPVALUE}].count(3m,2,eq,3m)}<>3
P.S. If update interval = 60 s, of course.

[Mechanix]

Thank you for your reply. I will test the trigger.

Can you explain what this line does:

count(3m,2,eq)

specially the 2

[Mechanix]

Sorry to say but this trigger is generating a lot of alarms on interfaces that are already down

[Semiadmin]

Sorry to say but this trigger is generating a lot of alarms on interfaces that are already down

Are you sure you use whole trigger expression? The seconfd part {Template Datacenter:ifOperStatus[{#SNMPVALUE}].count(3m,2,eq,3m)}<>3 must prevent alert then interface is down over 3 min. And in your case may be add the third part "and {Template Datacenter:ifAlias[{#SNMPVALUE}].str(this_does_not_exist)}=0".

[Mechanix]

Yes, the trigger looks like this:

{Template Datacenter:ifOperStatus[{#SNMPVALUE}].count(3m,2,eq)}=3 and {Template Datacenter:ifOperStatus[{#SNMPVALUE}].count(3m,2,eq,3m)}<>3 and {Template Datacenter:ifAlias[{#SNMPVALUE}].str(this_does_not_exist)}=0

[Semiadmin]

It's a strange thing. I just tested this trigger,of cource without the third part, it fired after 3th min. of a problem and cleared after 6th.

[Mechanix]

Hmm...your trigger doesnt check if the port was last down or not:

{Template Datacenter:ifOperStatus[{#SNMPVALUE}].last(0)}=2

And I do not understand this line. .count(3m,2,eq)}=3

why ...=3 because the values should be 1(up) 2(down)

Thx

[Semiadmin]

The 1st part of the trigger counts how many times ( =3) ifOperStatus was in state 2(down) (2 eq) during 3m.
The 2nd part counts the same with timeshift 3 min. "<>3" means ifOperStatus wasn't down during 3m 3m ago.

[Mechanix]

The 1st part of the trigger counts how many times ( =3) ifOperStatus was in state 2(down) (2 eq) during 3m.
The 2nd part counts the same with timeshift 3 min. "<>3" means ifOperStatus wasn't down during 3m 3m ago.

well, thats the problem: the trigger should fire only when the interface was UP (<2) before

To be more specific: fire trigger only when the interface went from UP to DOWN and stays in DOWN state for at least 3 minutes.

[Semiadmin]

fire trigger only when the interface went from UP to DOWN and stays in DOWN state for at least 3 minutes.

({Template Datacenter:ifOperStatus[{#SNMPVALUE}].last(#4)}=1 and {Template Datacenter:ifOperStatus[{#SNMPVALUE}].min(#3)}=2 and {TRIGGER.VALUE}=0) or ({Template Datacenter:ifOperStatus[{#SNMPVALUE}].min(#3)}=2 and {TRIGGER.VALUE}=1)

where item update interval is equal 1 min.

[Mechanix]

Thank you very much, this seems to work

[moshe]

Hi,
Trying to create toggling/flapping trigger on ifOperStatus.

The condition for the increase an alarm is 5 times (up and down status) in last 1 Hour.
I would be very happy to help.

[soufyanelaksibi]

hello everyone
I'm trying to monitor a huawei firewall using SNMP, when the port that connect this firewall to zabbix server is unplugged i get this message ^Unavailable by ICMP ping^ ,need to get an alert of the status of the port (up or down ) with its number .
Thanks in advance