Problems in configuring triggers for "No Data" and "Last n Values"

[zabbixfk]

Hi,


I have configured couple of triggers which has to trigger when no data is generated or last '3' values are more than 400. But looks like 'nodata' trigger is not getting triggered, and 'last 3 value' trigger is getting triggered only for last 1 values.

Triggers are as follows,

For last 3 values,

{Zabbix-Firewall-Interfaces:checkPing[{HOST.IP}].min(#3)}>400

is getting triggered if last value is more than 400, but it suppose to check last 3 values , and if all 3 are more than 400 then only get triggered. Please correct me if my thinkings are wrong

For no data ( if no data is received for 2 minutes )

{Zabbix-Firewall-Interfaces:checkPing[{HOST.IP}].nodata(120)}=0

Any pointers are greatly helpful.

Thanks.

[tchjts1]

I believe you have your "nodata" trigger wrong.

try this: nodata(120)}=1

[zabbixfk]

Problems in configuring triggers for "No Data" and "Last n Values"

Thanks for the reply. But, both nodata and last n values triggers are not triggered. I have changed as per your suggestion, still no help.


Thanks.

[drumspirit]

I believe you have your "nodata" trigger wrong.

try this: nodata(120)}=1

Hi,

I also tried a nodata trigger on incoming & outcoming packets.

The trigger is :
{T - Template Test:.ifOutOctets.10637.nodata(120)}=0&{T - Template Test:.ifInOctets.10637.nodata(120)}=0

One switch has no packets in or out. The other switch has traffic.

Whatever I do, whatever I set in time (120 secondes or even a billion of seconds), the tiggrer fires for the two switches...

If I set the value "=0" to "=1", both triggers don't fire at all.
It is ununderstable ... I guess I'll give up or if someone can help ?

Thank you for your reply.

[evertonco]

Although no traffic passing through the interface, a value is collected by server (value: 0). Thus, the data function works as expected.

[drumspirit]

Although no traffic passing through the interface, a value is collected by server (value: 0). Thus, the data function works as expected.

Hello !

Thank you for your reply, I really appreciate

That's what I red while looking for more information about the "nodata()" function. I understood that even a "0" is treated as a data by the trigger, because, in the facts, "0" IS a value.

Thank you for confirming once again what I had supposed previouvsly.

Regards,
Drumspirit

[ebonweaver]

nodata doesn't mean NO DATA??

I'm also finding that the nodata trigger does not work as expected. The issue is that if the agent (in this case snmpv2) is unreachable, which results in no data, the trigger is simply ignored instead of firing as expected.

So, the question is, if an item is "unreachable" (which seems to me means nodata, but apparently Zabbix works otherwise), how do I craft a trigger that says ok, I couldn't get data (nodata)/ item was unreachable/ item did not respond/ whatever happened I got nothin, so trigger =1 fire!

Seems pretty basic, but for some reason it's proving very difficult since nodata doesn't do the job as expected.

[drumspirit]

I'm also finding that the nodata trigger does not work as expected. The issue is that if the agent (in this case snmpv2) is unreachable, which results in no data, the trigger is simply ignored instead of firing as expected.

So, the question is, if an item is "unreachable" (which seems to me means nodata, but apparently Zabbix works otherwise), how do I craft a trigger that says ok, I couldn't get data (nodata)/ item was unreachable/ item did not respond/ whatever happened I got nothin, so trigger =1 fire!

Seems pretty basic, but for some reason it's proving very difficult since nodata doesn't do the job as expected.

Hello,

To my mind, you should better us an other value so that your Zabbix could fire the trigger correctly.
Instead of using the "nodata()" that doesn't work as expected, obviously, you better use a process that returns a boolean such as agent.ping. Then trigger will behave as you expect it.

Regards,
Drumspirit

[ebonweaver]

Unless I'm missing something, there is no such thing as agent.ping when talking about SNMP, only if you're talking about a computer running the zabbix agent software. Using icmp ping is not the same as checking if SNMP is responding.

[evertonco]

Unless I'm missing something, there is no such thing as agent.ping when talking about SNMP, only if you're talking about a computer running the zabbix agent software. Using icmp ping is not the same as checking if SNMP is responding.

You can get the availability of SNMP (and others types of check) by using the zabbix internal items. This is supported starting with Zabbix 2.0.0.
Zabbix Manual - Internal checks

The syntax is zabbix[host,<type>,available] Valid types are: agent, snmp, ipmi, jmx.

So, you can check availbility of SNMP agent by creating exactly zabbix[host,snmp,available] item key on the each host.

[abevern]

Possible Explanation

I'm also finding that the nodata trigger does not work as expected. The issue is that if the agent (in this case snmpv2) is unreachable, which results in no data, the trigger is simply ignored instead of firing as expected.

So, the question is, if an item is "unreachable" (which seems to me means nodata, but apparently Zabbix works otherwise), how do I craft a trigger that says ok, I couldn't get data (nodata)/ item was unreachable/ item did not respond/ whatever happened I got nothin, so trigger =1 fire!

Seems pretty basic, but for some reason it's proving very difficult since nodata doesn't do the job as expected.

I think I may've found an explanation for what I agree is counter-intuitive behaviour. In the zabbix 2.4 manual under trigger expressions
- example 8 reads:

Use of function nodata():

{zabbix.zabbix.com:tick.nodata(3m)}=1

'tick' must have type 'Zabbix trapper'. In order to make this trigger work, item 'tick' must be defined. The host should periodically send data for this parameter using zabbix_sender. If no data is received within 180 seconds, the trigger value becomes PROBLEM.

I believe the key is the section I have underlined - the data type must be Zabbix Trapper.

Thanks evertonco for your suggestion on internal checks to check snmp availability. I'll give that a shot.

[Christopher Gray]

evertonco solution works perfectly:

"Zabbix Manual - Internal checks
The syntax is zabbix[host,<type>,available] Valid types are: agent, snmp, ipmi, jmx.
So, you can check availbility of SNMP agent by creating exactly zabbix[host,snmp,available] item key on the each host."

[Nariman_tj]

i have used this and it worked!

I believe you have your "nodata" trigger wrong.

try this: nodata(120)}=1

[sambhu.prakash]

My understanding is nodata works best with a period of time not the last "N" values for the item as there will always be a last value if it ever had a value. So eventually, it will be hard for you to heal the alarm. So I always use something like nodata(/hostkey/,15m)=0 for the trigger expression. This will alarm if it find something on the item in last 15m and will automatically heal when that time elapses (if there is no new values came in in the past 15m period)