Trigger expression

[MarekHanus]

Hi,

I have a zabbix trapper item with no regular update interval.

I would like to fire a trigger only if the item values =1 in last 5 minutes.

Let's have an example:

Receive value =1 .. trigger "start" waiting
1minute later receive =1 .. trigger still waiting
2minute later receive =1 .. trigger still waiting
3minute later receive =1 .. trigger still waiting
4minute later receive =0 .. trigger reset
5minute later receive =1 .. trigger "start" waiting
6minute later receive =1 .. trigger still waiting
7minute later receive =1 .. trigger still waiting
8minute later receive =1 .. trigger still waiting
9minute later receive =1 .. trigger still waiting
10minute later receive =1 .. trigger is fired!

Could somebody help me build a reliable expression for this trigger?

[allexpetrov]

Hello Marek,

Please take a look at the Zabbix Official documentation into the Configuration -> Triggers.

I would suggest you the {host:key.min(5m)}=1 the construction which will be fired if the minimum value for past 5m equals 1.

Regards,
Alex!

[MarekHanus]

Hello Alex,

thanks for your reply.

Believe me I have tried a lot of combinations of "Supported trigger function" listed in Zabbix documentation.

Function min() was one of the first I tried. This function working if the "initial" value =0. But if there is couple of values =2 and then receive value =1 the trigger fire.

I have this expression - {999:me.machine.state.min(2m)}=1

This sequence of values fired the trigger:
Timestamp Value
2018-02-20 14:21:26 Shutting down (2)
2018-02-20 14:22:14 Shutting down (2)
2018-02-20 14:22:33 Shutting down (2)
2018-02-20 14:23:16 Shutting down (2)
2018-02-20 14:23:35 OutOfOrder (1)
.. but here is no value =1 for more than 2 minutes. The trigger fired immediately after receive value =1. Also only value =0 can close the trigger immediately.

Another sequence of values fired the trigger:
Timestamp Value
2018-02-20 14:40:04 Operational (0)
2018-02-20 14:43:29 OutOfOrder (1)
.. as you can see there are no another values in last 2 minutes so the trigger fired immediately after receive value =1.

I have also put function min(2m)=1 together with function max(2m)=1, but no satisfactory result.

Finally, if received value =1 and no more values are received the function min() and max() are not evaluated. I had to force evaluation with adding expression {999:me.machine.state.time()}<=240000.