Trigger on both max(,60s) and change() <> 0

[db100]

i am trying to set a trigger that would fire if a metric changes and if its end value goes above a threshold for more than 60 seconds.

so for example firing when a value goes from 0 to 1 and stays 1 for at least 60 seconds (this is because i want to avoid intermittency).

The value comes in at a variable frequency but definitely more often than once per minutes, so the problem now is that changes() will only be true before 60 seconds have elapsed ....

how to deal with this situation ?

[cyber]

So, basically if the value has been 1 for at least a minute, no matter how many values there was during that minute?
min(/host/item,60s)>0, iExpression is recalcualted each time, when new values come in. So, each time new value comes, it looks back for 1m. If all values in that minute satisfy the expression, it is fired...

[db100]

well this is what i ended up implementing, but it is not 100% what i need:

in fact i have 2 situations that require "changes" to be taken into account, the first situation is very common and it is dealing with the fact that sometimes there are network errors and thus the incoming stream of data has gaps, therefore imagine you have a gap of more than 60 seconds then the next point coming in would necessarily be the min/max of the past 60 seconds, which would always lead to a problem. this can only be avoided using some sort of time bounded changes calculation (see picture to the left). On the right side you find the second case, which basically is the only reason i can imagine why one would need to use changes() at all, that is, the very first time that the trigger is configured, if it does not look for changes, then it would immediately fire and require manual closure. which is not desirable:



NOTE: picture left should not cause a trigger because the value 1 holds for only 40 seconds, but because of the gap > 60s between 0 and 1, the trigger would fire.

AFAIK i cannot handle the first case to the left using just changes(), but i might need changecount(,60s) <> 0 or countunique(,60s) > 1
using changecount() or countunique() should fix both cases above i guess

[ISiroshtan]

changecount(/host/key,1m,"inc")>0 and count((/host/key, 1m)>1 and min(/host/key,1m)>0

changecount(/host/key,1m,"inc")>0 - will ensure there was increase in last minute
count((/host/key, 1m)>1 - will ensure there is at least 2 values in last minute, so that you not fire alert on data collection start or after there was a gap
min(/host/key,1m)=1 - will ensure that minimum value is above threshold

Because you have 3 requirements to fire alert, it will be super eager to switch back to resolved (when any of 3 conditions no longer met) so you might want to set recovery expression to keep it open for longer than 1 min (changecount(/host/key,1m,"inc")>0 will be main resolver I'd guess)

Overall feels like over engineering, but if you want it - go for it.

[db100]

why would i need count() ? wouldnt be enough to check for changecount > 0 to only catch the moments when there are no gaps ?

[cyber]

, therefore imagine you have a gap of more than 60 seconds ..... which would always lead to a problem.

Well, that was not in you original statement of problem.. there was just "The value comes in at a variable frequency but definitely more often than once per minutes" ...

I think you can leave out changecount... count + min should be enough. If there is a gap, there is not enough values and it really does not matter was it increase or decrease... count should be =>2 for a minute... and both should be "failures"

And it would be nice to merge topics.. https://www.zabbix.com/forum/zabbix-...s-and-change-0

[db100]

thanks to all of you for the replies:

> The value comes in at a variable frequency but definitely more often than once per minutes

i am sorry, for me network issues are always a possible reality so i did not consider that explicitly in the requirement but i do mean it

> I think you can leave out changecount.

i believe i need to use changecount() otherwise i would not be able to fire the trigger only when a change actually occur when there are enough values.
anyways i think i would go with changecount + min i just wanted to have a confirmation here that this was the way to go

> And it would be nice to merge topics.. https://www.zabbix.com/forum/zabbix-...s-and-change-0

i agree with you, but there was a network error when i opened the topic and it resulted to twice topics being open ... i dont know how to close them now, fi you know please go on