Trigger last(0) function

[Andreas Bollhalder]

Hello

I have an item which has the value "2" for the "off" conditions. Now I want it to trigger, when the last "x" values are not "2". Unfortunatly, the function "{item.last(x)}#2" does not exist. I can't use min or max, because every value other then "2" is an error.

Any suggestions ?

Andreas

[Alexei]

Function last() does not support this, however ZABBIX pre 1.4.2 accepts third parameter for function count():

count(period,value,operation)

operation is gt, lt, le, ge, eq, ne, for greater, less, less or equal, equal, not equal.

You may use it as:

count(600,"2","ne"), which returns number of values not equal to 2 within last 10 minutes.

So, something like count(600,"2","ne")>2 & count(600,"2","eq")=0 would do the trick.

[cstackpole]

I do not mean to hijack this thread, but I would like to verify that I understand the count function. I have not tried to use it before.

If there was a log file being monitored that would print HB every 5 seconds ( in addition to other entries into the log ) and an alert was to go out if 2 HB were missed the trigger would be:
{system:log[/path/to/log].count(10,"HB","eq")}=0

If I understand the count function correctly then it would look for the value "HB" in the past 10 seconds of the log regardless of other information added to the log and if the total count was 0 then it would trigger. If an "HB" entered again, say 30 seconds later, the trigger would go off again. Correct? If so, I know I could put this to use...

Please correct me if I misunderstood.
Thanks!

My Zabbix server version is 1.4.1.

[Andreas Bollhalder]

Hello Alexei

Function last() does not support this, however ZABBIX pre 1.4.2 accepts third parameter for function count():

count(period,value,operation)

operation is gt, lt, le, ge, eq, ne, for greater, less, less or equal, equal, not equal.

You may use it as:

count(600,"2","ne"), which returns number of values not equal to 2 within last 10 minutes.

So, something like count(600,"2","ne")>2 & count(600,"2","eq")=0 would do the trick.

Thank you very much for the tip. I will try it when 1.4.2 stable is out. Would it be possible to extend the function count() to accept a number like count(#x,"2","n") instead of seconds ? In my opinion, the best would still be to extend the function last() to accept a number. Maybe it could be named as a second function like lasts(number or second) or something like that.

I have to mention that even there are some small short comings in ZABBIX, I like it very much! Keep up the good work!

Andreas

[Andreas Bollhalder]

Thinking more of this topic, I really like to be able to specify the number of values in the functions too insteed of seconds. This is because it seems to me, that there is no garantie that each check will be performed at the fixed time and to be able to change the check interval for the items without having to change the seconds in the triggers.

Andreas

[Alexei]

It is already in our TODO list. Not sure about ETA though.

[cstackpole]

I would appreciate some help on the count function.
I have a log file that I am monitoring and in that file I have a heartbeat function that prints a message every minute. If the heartbeat message does not occur in 120 seconds, I want to know. The heartbeat can stop but information can still be added to the log file so using .nodata(120) doesn't help because data can still be added.

So I have my trigger:
{host:log[/path/to/file.log].count(120,heartbeat,eq)}<1

The way I understand this function is that the function looks through the past 120 seconds and totals up how many times heartbeat was found and returns that number. So, in my case, in the last 120 seconds if the total count of the phrase heartbeat is less then 1 activate trigger. If there has not been a heartbeat message in the past 120 seconds then the total should be 0 and less then 1.

However, as soon as I set this it triggers true regardless of if there is a heartbeat going or not. So I changed it from <1 to =0 and the trigger stays off and does not trigger to true.

I am using Zabbix 1.4.1 and would appreciate any help anyone can give.

Thanks!
cstackpole


An example of my log file:
2007-08-29 16:28:00.001 - heartbeat 16
2007-08-29 16:28:12.493 - Status: sm=14 rx=33887 tx=1868 nc=2
2007-08-29 16:28:32.493 - Status: sm=14 rx=33887 tx=1868 nc=2
2007-08-29 16:28:52.492 - Status: sm=14 rx=33887 tx=1868 nc=2
2007-08-29 16:29:00.003 - heartbeat 17
2007-08-29 16:29:12.493 - Status: sm=14 rx=33890 tx=1869 nc=2

[cstackpole]

Don't mean to be rude by bumping this, but I could really use the help.

Thanks guys,
cstackpole

[cstackpole]

OK so I am going to use exactly what is listed in the manual.
I wrote a bash shell script that will generate nothing but "heartbeats" every 5 seconds till I manually stop it (aka infinite loop).
#!/bin/sh
i=1
while [ $i -ne 0 ]
do
echo 12
i=$(($i+1))
sleep 5
done

I run the script by simply doing:
./loop.sh > /opt/zabbix/mytest.log
so my log file looks like
12
12
12
12
12
12
12
...ect. ect. ect.

I have Zabbix configured to monitor the log as Item:
type: Zabbix agent (active)
Key: log[/opt/zabbix/mytest.log]
Type: log
Update interval: 1 sec.

My Trigger is configured as the way I understand it from the manual (release 009 pg 112):
{zabbixserver:log[/opt/zabbix/mytest.log].count(600,12)}<107

Information (the log file) shows up correctly in the latest data history.

1 "heartbeat" every 5 seconds for 600 seconds will generate 120 "heartbeats" or rather will print 12 to the log file 120 times. If less then 107 are found then we have not gotten a heartbeat in the past minute or so, therefore, the alert should trigger.

However, as soon as the trigger is enabled it turns true regardless of log status. If there are already 130 12's present (more then 107) it turns true. If there are 107 or less or none it turns true (which the latter two make sense because there are less then 107 and hence the trigger should be true).

Starting out with a blank log file, and waiting 15 minutes for the log file to fill with 12's (180 is a lot more then 107) does not turn the trigger to FALSE as it should.

Stopping the script so that nothing more is added to the log file should trigger something. So I stopped the script and waited. After 15 minutes of no update to the log at all, the trigger finally went False. When the heartbeats started again, the trigger went true. That doesn't make any sense at all. 0<107=True. Why was the trigger off when it should be on? If the count function is supposed to return the amount of values found in the past X amount of seconds then why does it not trigger properly?

Thinking that maybe the trigger needed quotes around the expression (since this was a log file and hence dealing with strings) I also tried this as my Trigger and got the same results except that the trigger never turned off even after the time limit.
{zabbixserver:log[/opt/zabbix/mytest.log].count(600,"12")}<107

According to the manual and I quote "count(600,12) will return exact number of values equal to ‘12’ stored in the history." Why does it seem to never have the right value? Why does this expression not work? All I want to be able to do is track a heartbeat event and trigger if the heartbeat event has not been heard-from/seen in X amount of time. Maybe the count function can not be used in this manner but surely someone out there has something to monitor the failure of heartbeat events.

Can anyone please tell me what/if I am doing wrong? If anyone has a different way of tracking a heartbeat from a log file I would appreciate the help in pointing me in the right direction. An example of the log file that I actually have is a couple of posts up.

[EDIT] Even though it would not make much logical sense, I tried something else. Because the trigger is doing opposite of what I want, I tried reversing the trigger to be:
{zabbixserver:log[/opt/zabbix/mytest.log].count(600,12)}>107
Now I can not get it to trigger at all. So that doesn't work either.

[Alexei]

I confirm that function count() does not work correctly for log items in 1.4.2 (possibly in 1.4.1 as well). This will be fixed.

[cstackpole]

Thanks Alexei!

[bashman]

How can I use something like this: .last(0)#"" to check that last value is not an empty string for a trigger expression?.

If I use that expression error:
Not allowed symbols or sequence of symbols in expression element detected: Check expression part starting from ' #'' '
Is showing.

Can I use .str(0,"") ?, no error are shown when expression is submited.

[bashman]

I tested and works fine. The expresion is: str("", 0)