Trigger for file size in directory after 10 minutes

[romel]

Hello,

I am trying to configure a trigger that will alert if files within a specific directory exceed a certain file size, but only after the files have been present for at least 10 minutes.

So far, I can monitor file sizes with vfs.file.size, but I am not sure how to implement the condition that the file must remain larger than the threshold for at least 10 minutes before the trigger goes off. I have used the nodata function and added it to our already existing expression for detecting file sizes larger than a specified amount but it did not work for me for some reason.

Has anyone implemented something similar or could suggest the best approach?

Thank you in advance!

[cyber]

use

[B]vfs.dir.get[/B][dir,<regex_incl>,<regex_excl>,<types_incl>,<types_ excl>,<max_depth>,<min_size>,<max_size>,<min_age>, <max_age>,<regex_excl_dir>]

So you can define size and age etc...

[romel]

Hi Cyber,

I should've explained that we already have low level discovery set up where it applies item prototypes using the key vfs.file.size. This is an example of the trigger prototype:

length(last(/Script/vfs.file.size[path/to/dir/{LLD macro}]))>0

What function should I use to add a 10 minute threshold for files being larger than 0?

[cyber]

It does not rally matter, what you have there already... it does not suit your current requirements.. And you have a suggested item and its parameters, look it up from docs https://www.zabbix.com/documentation...nt#vfs.dir.get

vfs.dir.get[path/to/dir/,<regex to identify files>,,,,0,,,600]

I think ...
No discovery needed, if you can specify a regex to identify all the required files at once...
with this you will get the list of files, which match the regex and are more than 10m old.
with very similar vfs.dir.count item you can get the count of files... so it is up to you, which one you want to use...