Trigger expression

[beye91]

Hi,

I want to create a trigger expression like follows:

- String is not "200 OK" or last 5 values are empty.

Trigger should not be activated when 3 values are empty!
Sometimes my check returns no values, but it is working (maybe a timing problem).

So I want to reduce the false positive messages with that expression.

I tried a combination with the functions regex and count but without success.

Any idea?

Regards, Chris

[dimir]

Can you show your current trigger expression?

[beye91]

Hi dimir,

the expression looks like this:
{Bluecoat-Threatpulse-Test:web.page.regexp[test.threatpulse.com,/demo.php,80,"^HTTP/1.1 .*",,].regexp(200 OK)}=0

So sometimes I don't get the data but this is not an error which should be alerted (only after 3 times)



Any idea?

Regards, Chris

[dimir]

I suggest using Zabbix Web monitoring feature for that:

https://www.zabbix.com/documentation/3.4/manual/web_monitoring/items

For each step you create in a web scenario Zabbix will create item web.test.rspcode[Scenario,Step] (where Scenario and Step or the names you set). This item will return HTTP status code. Add a trigger with this item, e. g.

{Bluecoat-Threatpulse-Test:web.test.rspcode[Scenario,Step].count(#5,200,ne)}<>0

which translates to "trigger an alert if within last 5 checks there was at least one non-200 HTTP status".

[beye91]

I can't use the web monitoring, because the test needs to be done at the host not from the zabbix server itself.

I test if a page is available which indicates, that the internet connection onsite it working via the cloud proxy solution.

Is it possible to expand my expression with your idea?

[Hernandes Martins]

Hi Chris,

The best practices, use native web monitoring Zabbix.

But its posible use regular item with preprocessing and regular expressions a new feature zabbix.3.4

https://www.zabbix.com/documentation/3.4/manual/config/items/item#item_value_preprocessing

Regards

[dimir]

I want to create a trigger expression like follows:

- String is not "200 OK" or last 5 values are empty.

Since you specifically look for "200 OK" I suggest to fetch this particular value, so change you item to:

web.page.regexp[test.threatpulse.com,/demo.php,80,"^HTTP/1.1 (.*)",,"\1"]

And the trigger expression to:

{Bluecoat-Threatpulse-Test:web.page.regexp[test.threatpulse.com,/demo.php,80,"^HTTP/1.1 (.*)",,"\1"].str(200 OK)}=0 OR {Bluecoat-Threatpulse-Test:web.page.regexp[test.threatpulse.com,/demo.php,80,"^HTTP/1.1 (.*)",,"\1"].count(#5,"",eq)}=0

[beye91]

Hi Dimir,

thanks!