Help with triggers

[clahti]

Hello all:

I am a reforming Nagios user . One thing I like about Nagios is that it has a warning and critical thresholds that become alert points for various checks that can take completely different escalation paths and I am trying to duplicate this mentality in Zabbix.

An easy example is disk space checking, the item:

vfs.fs.size[/home,free]

The triggers:

vfs.fs.size[/home,free].last(0)<5000000 (warning)
vfs.fs.size[/home,free].last(0)<1000000 (critical)
vfs.fs.size[/home,free].last(0)<10000 (disaster)

The actions for the above triggers would be:

(warning) email unix sysadmins
(critical) page unix sysadmins
(disaster) page unix sysadmins and email IT management

Other triggers are a bit more challenging, for example I am monitoring an ldap server via a UserParameter that returns the response time in milliseconds, and the check interval is set to 180 seconds (3 minutes)

how would I define the triggers, here is the criteria:

(warning) the server returned no data after one check cycle (3 minutes?) or the response time was more than 1 second
(critical) the server returned no data after three check cycles (9 minutes?)
(disaster) the server returned no data after five check cycles (15 minutes?)

Also, lets assume the above triggers are defined, and the warning and critical have fired. When the server comes back online and the triggers flip to the off position, can I suppress the action of the warning trigger since the critical action will also fire? I am trying to avoid an email and/or paging storm

I am using 1.3.3 but the syntax should be the same as 1.1.x...correct? Thanks in advance!

/Christian

[James Wells]

Greetings,

vfs.fs.size[/home,free].last(0)<5000000 (warning)
vfs.fs.size[/home,free].last(0)<1000000 (critical)
vfs.fs.size[/home,free].last(0)<10000 (disaster)

These are very doable, however, you will need to ensure that you use trigger dependencies on templates, which are broken in zabbix 1.1.x and possibly 1.3.x, without the trigger dependency patches. Unless of course you wish to create the dependencies for each host independently.

Other triggers are a bit more challenging, for example I am monitoring an ldap server via a UserParameter that returns the response time in milliseconds, and the check interval is set to 180 seconds (3 minutes)

how would I define the triggers, here is the criteria:

(warning) the server returned no data after one check cycle (3 minutes?) or the response time was more than 1 second
(critical) the server returned no data after three check cycles (9 minutes?)
(disaster) the server returned no data after five check cycles (15 minutes?)

First, you will want to create the disaster trigger, say '{HOST:custom.ldap.nodata(#15)}=1'. This trigger will fire if the custom.ldap item returns no data for 15 iterations. This trigger will be set to disaster. Note you could make it more complex as well, something like, '({HOST:custom.ldap.nodata(#15)}=1)|({HOST:custom. ldap.min(#15)}>1.0)' to capture high return times as well.

Next you will create the critical trigger, '{HOST:custom.ldap.nodata(#9)}=1'. This trigger will depend on the previous trigger and will be set to critical. Now, this trigger will not fire as long as the disaster trigger is set. Again, you could make this more complex as well, as shown above. Now, because it depends on the previous trigger, it will not fire, unless the previous trigger is false.

Finally you create the warning trigger as, '{HOST:custom.ldap.nodata(#3)}=1' which depends on the previous trigger. As above, because this one depends on the previous trigger, it will not fire while the previous two triggers are true.

I hope that helps.

EDIT: Please remember, that these cannot be used correctly on templates, unless the trigger dependencies on templates bug is fixed.

[clahti]

Excellent, this is exactly what I need. Thanks James! I will report back whether the dependencies have been fixed in 1.3.3 for templates.

/Christian

[vikty]

Finally you create the warning trigger as, '{HOST:custom.ldap.nodata(#3)}=1' which depends on the previous trigger. As above, because this one depends on the previous trigger, it will not fire while the previous two triggers are true.

If I have this situation:
( "--->" means: Trigger2 depends on Trigger1)
"trigger1--->trigger2--->trigger3" and trigger1 is True;

1)trigger2 don't fire
2)trigger3 fire, because trigger2 is False; is it correct??

[vikty]

YES it is correct!

I have done some test....
this simplify many problems