IIS by Zabbix agent active - Appool is not in Running state, trigger after 3 minutes

[PeterBa]

Hello everyone,

I'm in a pickle with IIS by Zabbix agent active - IIS: Application pool {#APPPOOL} is not in Running state.

Due to network / security complications I'm not able to let Zabbix know that a website in IIS under maintenance. Our desired workaround is to not trigger the IIS: Application pool {#APPPOOL} is not in Running state prototype trigger until the application pool is not in running state (3) for longer then 3 minutes.

It doesn't matter how we adjust the trigger. It either doesn't see the application pool go down at all, or the trigger fires right away.

Our latest attempt which also failed;
Problem expression

min(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"],3m)<>3
and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1

Recovery expression

last(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"])=3

Is there a way to fire the trigger only if the application pool is not in running state for more then 3 minutes?

I'm using Zabbix 7.4.11

[PeterBa]

I managed to solve the issue. It was caused by the 'AppPool {#APPPOOL} state' Preprocessing step named 'Discard unchanged with heartbeat'. By default it is set to 1h. I changed it to 1m and my trigger acted perfectly.
For others who are bumping into the same, here are my settings;

Item Prototype
Name: AppPool {#APPPOOL} state
Go to the Preprocessing tab
Change the value of Discard unchanged with heartbeat from 1h to 1m

Trigger Prototype
Name: IIS: Application pool {#APPPOOL} is not in Running state
Problem Expression:

min(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"],3m)<>3
and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1

Recovery expression:

last(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"])=3

[Rudlafik]

Add to query: min(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"],3m)<>3
and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1 and count(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"],3m,,"3")>2

https://www.zabbix.com/documentation...ers/expression exampe 7.

[PeterBa]

I managed to solve the issue. It was caused by the 'AppPool {#APPPOOL} state' Preprocessing step named 'Discard unchanged with heartbeat'. By default it is set to 1h. I changed it to 1m and my trigger acted perfectly.
For others who are bumping into the same, here are my settings;

Item Prototype
Name: AppPool {#APPPOOL} state
Go to the Preprocessing tab
Change the value of Discard unchanged with heartbeat from 1h to 1m

Trigger Prototype
Name: IIS: Application pool {#APPPOOL} is not in Running state
Problem Expression:

min(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"],3m)<>3
and {$IIS.APPPOOL.MONITORED:"{#APPPOOL}"}=1

Recovery expression:

last(/IIS by Zabbix agent active/perf_counter_en["\APP_POOL_WAS({#APPPOOL})\Current Application Pool State"])=3

[cyber]

I hope you know, that you actually do not need that recovery expression at all .. It is only considered AFTER your trigger expression has been calculated to "false" already, which makes such recovery expression useless..