trigger - evaluating result is not as expected

[serwanski]

Hello,

Trying to create own: item and trigger. While item seems to work fine - fetches data from log file accorgin to rule: "log[/var/log/zabbix/events_zabbix.log,custom_alert]", and creates reasonable entries visible in history:



Trigger does not work as expected; construction of expression is: find(/usosweb-serwan/log[/var/log/zabbix/events_zabbix.log,custom_alert],10m,"like","error")=1 , and my expectations were:

- in case when there is 'error' string in logged line, alert is being raised (that part works perfectly), but
- in case when there is no 'error' string in logged lines for longer than 10 minutes, I've expected alert will be set to 'resolved' - but it is not
- to have alert set to 'resolved' I have to pass to log file additional line which does not contain 'error' string (that is why there are two lines with 'eror', not 'error' above).

Could anyone advice where is mistake I've made? How to evaluate / ask zabbix to properly evaluate timing? For me seems that trigger is evaluating last line, regardless of time if was logged..

Thank you in advance & regards
Tomasz

[ISiroshtan]

Hello there
I would say that is quite common issue people have when starting to work with Zabbix triggers. Refer to document here: https://www.zabbix.com/documentation...onfig/triggers
Specifically part

Calculation time

A trigger is recalculated every time Zabbix server receives a new value that is part of the expression. When a new value is received, each function that is included in the expression is recalculated (not just the one that received the new value).

Additionally, a trigger is recalculated each time when a new value is received and every 30 seconds if date and time and/or nodata() functions are used in the expression.

Date and time and/or nodata() functions are recalculated every 30 seconds by the Zabbix history syncer process.

So trigger is re-evaluated only when some value is fetched into your item. If your item fetches only error log entries - alert will be forever fired. You can add "and nodata(/usosweb-serwan/log[/var/log/zabbix/events_zabbix.log,custom_alert], 10m) = 0" to your trigger expression. This way if no new items were received in last 10m alert will be resolved.

[serwanski]

Hello,

Thanks for the answer above just in case someone else would have similar issue - I've rewritted both: item and trigger, and now it works as expected. I decided to use 'logrt' instead of 'log', as AI adviced (not sure if correctly) that 'log' looks for last line only, while 'logrt' is ablve to check earlir entries as well. Anyway - rewritten: item and trigger work.

regards
Tomasz

[cyber]

log and logrt both look at the end of logfile for new lines. logrt can manage logfiles that are rotated. Only during first install of item logfile is read from the beginning, but even that can be avoided with "skip" option in item parameters. Your AI is BS-ing..