Multiple PROBLEM and OK Events generated - v2.2.4

[jordan.emersive]

Hi All,

I have an issue with event generations. I am not 100% sure when this started but I have a feeling it was around the time we upgraded to Zabbix Server v2.2.4.

The Issue:
I am monitoring multiple hosts via ICMPPing, pinging once per minute. When a host goes down, after 5 consecutive responses of '0' the trigger is evaluated as True. For the period of the active trigger multiple events are being generated at a rate of one per minute. The first event will be a PROBLEM event followed 1 minute later by an OK event, followed 1 minute later by a PROBEM even again. This goes on until the host recovers.

My Trigger Expression:

({TRIGGER.VALUE}=0 & {Emersive ICMP Tunnels:icmpping.count(#5,0)} = 5) 
| 
({TRIGGER.VALUE}=1 & {Emersive ICMP Tunnels:icmpping.count(#10,1)} = 10)

I DO NOT have the 'Multiple PROBLEM events generation' enabled.

The Data received:

2014.Jul.17 14:53:31	Up (1)
2014.Jul.17 14:52:31	Up (1)
2014.Jul.17 14:51:31	Up (1)
2014.Jul.17 14:49:31	Up (1)
2014.Jul.17 14:48:31	Up (1)
2014.Jul.17 14:47:31	Up (1)
2014.Jul.17 14:46:31	Up (1)
2014.Jul.17 14:45:31	Up (1)
2014.Jul.17 14:44:31	Up (1)
2014.Jul.17 14:43:31	Up (1)
2014.Jul.17 14:42:31	Down (0)
2014.Jul.17 14:41:31	Down (0)
2014.Jul.17 14:40:31	Down (0)
2014.Jul.17 14:39:31	Down (0)
2014.Jul.17 14:38:31	Down (0)
2014.Jul.17 14:37:31	Down (0)
2014.Jul.17 14:36:31	Down (0)
2014.Jul.17 14:35:31	Down (0)
2014.Jul.17 14:34:31	Down (0)
2014.Jul.17 14:33:31	Down (0)
2014.Jul.17 14:32:31	Down (0)
2014.Jul.17 14:31:31	Down (0)
2014.Jul.17 14:30:31	Down (0)
2014.Jul.17 14:29:31	Down (0)
2014.Jul.17 14:28:31	Down (0)
2014.Jul.17 14:27:31	Down (0)
2014.Jul.17 14:26:31	Down (0)
2014.Jul.17 14:25:31	Down (0)
2014.Jul.17 14:24:31	Down (0)
2014.Jul.17 14:23:31	Down (0)
2014.Jul.17 14:22:31	Up (1)
2014.Jul.17 14:21:31	Up (1)
2014.Jul.17 14:20:31	Up (1)
2014.Jul.17 14:19:31	Up (1)

Screen grab of the events generated:


According to my trigger expression,I should only be getting 1 PROBLEM event at '2014.Jul.17 14:27:31', and a recovery event at '2014.Jul.17 14:52:31'. I can't get my head around why these multiple PROBLEM and OK events are being generated.

If any one could point me in the right direction, or if there is some more information I can provide please let me know!

Thanks,

[jordan.emersive]

Resolved..

Hi There,

I thought I had better just let anyone who is searching know that I figured out ( I Think ) what was happening.

When using the Hysteresis trigger calculations, to cancel the trigger your equation has to return 'False'. The issue I believe here was that I was returning 'True' to cancel the trigger.

I did some further searching around and found a forum post from a couple of years ago with a similar problem and a solution.

Here is the code for my updated trigger which is now working perfectly:

({TRIGGER.VALUE}=0 & {Emersive ICMP Generic:icmpping.max(#5)}=0) 
| 
({TRIGGER.VALUE}=1 & {Emersive ICMP Generic:icmpping.count(#10,0)}>0)