Count function woes

[cstackpole]

I am using Zabbix 1.6

There is a program that I monitor that has an output that is sent to Zabbix through zabbix_sender. I want to continue to capture all of the data sent but there is a certain phrase that I want to monitor specifically. The other data is for historical information and I don't care to monitor it at this time.

The output often has a lot of information in it of the format:
timestamp informational phrase

My goal was to trigger an alert when a specific one of the many phrases is repeated more then 10 times in 30 seconds. The messages could be all back to back or mixed with other messages.

So I configured an item:
Description: TestAlert
Type: Zabbix Trapper
Key: TestAlert
Type:LOG
kept defaults for the rest.

Sending to Zabbix works and it shows up in the history of that item.

I configured a trigger.
Name:TestAlertTrigger
Expression:{MyHost:TestAlert.count(30,My Phrase)}>10

However, this doesn't actually trigger anything. When I watch the events for that trigger, it never leaves 'OK' except for when I flush the history and there is a few seconds of 'Unknown'.

My understanding of the count function is that the expression will trigger when My Phrase occurs more then 10 times in the last 30 seconds. I have a script that sends the message 12 times back to back. The messages show within a few seconds of each other on the history page but the alert never triggers. I thought it might have something to do with the spaces in the My Phrase so I tried just using Phrase as the key word. Still didn't trigger.

I tried setting the item from LOG to character and text, but still no luck. Actually I had more problems when I set it to text (it didn't seem to do anything but unknown with text).

What am I missing?

I am very appreciative of any comments.

Thanks!

[cstackpole]

OK, so I think I had some issues after doing the upgrade to 1.6. I noticed that my sender and agent were still 1.4 even though I had done a full update/install.

So I rebooted (dev server...no one cares ). It now triggers as it should and all the executables are now showing 1.6. My guess is that I either didn't restart all of the services when I did the install, or a step failed and I didn't notice it.

The only thing left on this problem is that after the 30 seconds is up, the trigger doesn't go green again. Still shows "problem" until another message comes in. I *think* (have not verified this yet) that it is because the count function is triggered on the message update and not on the 30 second timer. If this is true, then I can add a nodata clause to turn it off again.

[Alexei]

I *think* (have not verified this yet) that it is because the count function is triggered on the message update and not on the 30 second timer. If this is true, then I can add a nodata clause to turn it off again.

You are absolutely right! Only time related functions (nodata, time, date, etc) are affected. Combination of count() and nodata() in one trigger expression can be used to update trigger expression (including evaluation of count()) every 30 seconds.

[cstackpole]

Thanks Alexi!
The nodata addition appears to be working as expected.