Understanding flapping trigger

[Yello]

Hi,
I have a trigger which is intended to fire if the string "Fail" is returned and surpresses when things return to normal ("Fail" messages stop). Here is the trigger:

({TRIGGER.VALUE}=0&{availability[{$PORT} {$URL} {$NAME}].str(Failed)}>0)|({TRIGGER.VALUE}=1&{availability[{$PORT} {$URL} {$NAME}].str(Failed)}=0)

As you can tell by the thread name, this trigger flaps continuously despite the latest data still showing a failure with no breaks in the data stream. The polling interval is 2 mins (I have tried others) and the behaviour is consistent across all intervals.

I suspect the trigger expression isn't doing what I anticipated it would and that I'm not using the right expression for this type of task. Any help that anyone can provide in correcting this behaviour will be greatly appreciated.

Regards,
David

[Yello]

Hi,
Do I need to provide more information? I was hoping someone would have replied by now.


Regards,
David

[ghoz]

you should just test availability[{$PORT} {$URL} {$NAME}].str(Failed)>0 or whatever.

the way I read your actual trigger is :

if trigger is OK, check for failure
if trigger is problem, check for OK (??)

1st failed check => trigger fires
2nd failed check => condition are no longer true => trigger back to normal
3rd failed check => trigger fires
etc...

these kind of construct are used when you have more complex triggers,
like problem if temperature is > 30°C and back to normal if it's below 25°C

[Yello]

Hi,
Thanks for the reply. In the time that I've had this query posted my thinking has moved towards what you've been saying.

However, what isn't clear to me is how that expression can return the trigger to an OK state if the input value is still at a problem level.


Regards,
David

[DSon]

Hi,

It's due to the way regular expressions are used in triggers - I think you've not quite understood how Zabbix evaluates expressions.

You're telling Zabbix the various conditions that will result in an expression being TRUE.

I think what your original trigger was doing was effectively:

IF NOT ALREADY TRUE, if text IS found, expression = TRUE (otherwise the expression = FALSE, which is fine)
or..
IF ALREADY TRUE, if text IS NOT found, expression = TRUE (otherwise the expression = FALSE, which is wrong)

Hope this helps explain why the trigger was flapping!

Firstly, ghoz is correct in saying you're best just using the first half of the trigger expression; it means exactly the same as what you were trying to say (don't need the TRIGGER.VALUE bit either).

However, using TRIGGER.VALUE in my opinion is something worth learning about (called "hysteresis" in the manual, although maybe "heuristics" is the correct word?).

- e.g. if you wanted the trigger to be TRUE if text "Failed" is found, and stay TRUE until the text "Fixed" appears.

Using your trigger as an example:

({TRIGGER.VALUE}=0&{availability[{$PORT} {$URL} {$NAME}].str(Failed)}>0)|({TRIGGER.VALUE}=1&{availability[{$PORT} {$URL} {$NAME}].str(Fixed)}#1)

The key to using heuristics/hysteresis is by using the NOT (#) character in the second part of the expression (when TRIGGER.VALUE=1). This effectively tells Zabbix that an expression will be TRUE if something DOES NOT happen (i.e. it will be only ever be FALSE if something specific DOES happen).

Try it.

Hope this helps,
Danny.

[Yello]

Hi,
That's great. Thanks for explaining.


Regards,
David