If network interface is down for 3 minutes activate the trigger

[SnowDuck]

Hello everyone! I'm currently using Zabbix 3.2 and I'm loving it so far!

I'm monitoring the operational status of the network interfaces on a Ubuntu 16.04 LTS VM using SNMP v2. When SNMP gives the value of '1' the interface is up and the value '2' indicates that the interface is down.

I'm trying to create a trigger prototype to alert me when a network interface is down for 3 minutes. But I can't seem to get my trigger prototype for the network interface status to work properly. What happens now is that as soon as the network interface is down, the trigger activates.
But what I want is that the trigger only activates when the network interface has been down for 3 minutes. The following trigger expressions I have tried to no avail:

{LLD template:ifOperStatus[{#IFNAME}].last(0)}=2 and {LLD template:ifOperStatus[{#IFNAME}].last(180)}<>1

{LLD template:ifOperStatus[{#IFNAME}].last(0)}=2 and {LLD template:ifOperStatus[{#IFNAME}].nodata(3m)}=1

({LLD template:ifOperStatus[{#IFNAME}].last(0)}=2) and ({LLD template:ifOperStatus[{#IFNAME}].last(3m)}<>1)

{LLD template:ifOperStatus[{#IFNAME}].min(180)}=2

{LLD template:ifOperStatus[{#IFNAME}].max(180)}=2

{LLD template:ifOperStatus[{#IFNAME}].avg(3m)}=2

None of the above expressions yield the result I want. There must be something I have missed, but I don't know what it is.

Can anyone point me in the right direction please? Thanks in advance!

[kaspars.mednis]

Hello,

As far as i know, {LLD template:ifOperStatus[{#IFNAME}].min(180)}=2 must work,
because it evaluates all values for 180 seconds, and if minimum value is 2 in that period, that means all values are 2...

I suggest you check it one more time...

Regards,
Kaspars

[SnowDuck]

Thank you for your reply Kaspars,

I have checked one more time with '{LLD template:ifOperStatus[{#IFNAME}].min(300)}=2'. It seems to work now. Which I find weird, because when I tested it yesterday, the trigger would activate as soon as the interface went down and stayed in the PROBLEM state for 3 minutes after the interface went back up again instead.
While Googling my issue I have noticed some people where experiencing similar problems (the trigger firing immediately that is) when using the function 'min(180)' and some people even advised to use an epxression like the one below:

'({LLD template:ifOperStatus[{#IFNAME}].max(180)}=2) and ({LLD template:ifOperStatus[{#IFNAME}].min(180)}=2)'

The expression above does work but it didn't make much sense to me.

Anyway, it seems to work as intended now, thank you for your help Kaspars.


Kind regards,
SnowDuck