Trigger with nodata cannot evaluate function

[mppdidi]

Hi,

i recently modified some triggers with the nodata funtion in order clear eventlog statuses in the dashboard.
However some hosts get stuck with a question mark in the dashboard and the triggers are deactivated for those hosts:

Cannot evaluate function {hostname:eventlog[System,,"Warning|Error",,,,skip].logseverity(0)}=2 & {Template OS Windows:hostname[System,,"Warning|Error",,,,skip].nodata(1440m)}#1

What is even more weird is the fact that updating those triggers ( or templates in this case ) with other values seems to be affecting arbitrary hosts.

Any hints what is going on here ?

Kind regards.

[mppdidi]

Update

Hi,

i did some further testing.
I can reproduce this behaviour when changing the nodata time interval.
I've set it temporary to 1s for a couple of minutes and the revert to the original value - all trigger errors are gone now.
Maybe this is helpfull for the dev's.

Kind regards.

[ingus.vilnis]

Hi,

Is that the very exact trigger expression you are using in your trigger?

{[B]hostname[/B]:eventlog[System,,"Warning|Error",,,,skip].logseverity(0)}=2 & 
{Template OS Windows:[B]hostname[/B][System,,"Warning|Error",,,,skip].nodata(1440m)}#1

If so, then you have to correct the following things first:

{[B]Template OS Windows[/B]:eventlog[System,,"Warning|Error",,,,skip].logseverity(0)}=2 & 
{Template OS Windows:[B]eventlog[/B][System,,"Warning|Error",,,,skip].nodata(1440m)}#1

When you'll have the trigger working properly, you may also want to add the "Error" severity to your trigger as well because now you will only get triggers for the "Warning" messages.

Best Regards,
Ingus

[mppdidi]

Trigger with nodata cannot evaluate function

Hello Ingus,

i attached a screenshot of the four triggers.

Kind regards.

[ingus.vilnis]

The picture was pretty hard to read due to reduced size, but I guess you did the changes I suggested you.

So, is it working now as expected or are you still having any issues with your triggers?

Best Regards,
Ingus

[mppdidi]

Trigger with nodata cannot evaluate function

Hello,

i attached a zip file containing the screenshot of a host that is affected.
Does this help ?

Kind regards.

[mppdidi]

Maybe a bug with eventlog function and nodata

Hello,

i did some further testing with the eventlog function and nodata. It appears to be buggy in cunjunction with skip, logserverity and nodata. with an item like this:

eventlog[System,,"Warning",,,,skip]

and a trigger like this:

{Template OS Windows:eventlog[System,,"Warning",,,,skip].logseverity(0)}=2 & {Template OS Windows:eventlog[System,,"Warning",,,,skip].nodata(1d)}#1

the triggers randomly go offline with the original error from this posting.

initialy this trigger expression works, but altering the nodata interval eventualy causes the error.

so in the end i removed the skip option and things went back to normal. As the zabbix server debugging does not show any viable clues, i am unsure on how to narrow this down.

Kind regards

[mppdidi]

Update

Hello,
i figured out why this beahviour occurs. It is specific to the windows event log trigger with nodata. The state of the trigger remains in 'cannot evaluate funtion' until the trigger is fired up again. I also noticed that the dashboard status is longer than the nodata expression. For example:

1) nodata is set to 1d
2) the item trigger kicks in for the first time -> state changes.
3) 12 hours after 1) a new event triggers
4) the oldest date is still shown in the dashboard.

I guess this is due to the fact that windows eventlog are not switching from info -> error and back correctly. To my knowledge the windows eventlog design is the cause of this, since there is no strict correlation when an error has been actually corrected.

Kind regards.

[bednar]

Hello,

I have exactly the same behaviour with snmptrap. Items and triggers are created in host, not template. Everything was working properly before adding "nodata" function. After that a lot of triggers have error: Cannot evaluate function.

(({LNX-VC-01:snmptrap[".*alarm.DatastoreDiskUsageAlarm.*([[:space:]].*)+.*APP_PL_PR.*"].regexp(.*Yellow.*)})#0&({LNX-VC-01:snmptrap[".*alarm.DatastoreDiskUsageAlarm.*([[:space:]].*)+.*APP_PL_PR.*"].nodata(3600)})=0)

Every item has two triggers, for Yellow and for Red status.

Do you have any solution for this?
I tried to change names, regexp in item, value of nodata time and delete whole nodata expression but without any success.

[mppdidi]

Trigger with nodata cannot evaluate function

Hey,

there is no solution to this afaik.
Can you reproduce this by:

1) initiate the snmp trigger ( manually if necessary )
2) check the trigger state
3) the trigger should look normal / healthy
4) if within the nodata interval no corresponding trigger happens, the state of the trigger should switch to 'Cannot evaluate function'

My conclusion is that, if within the nodata timeframe no event reported the trigger to be good or bad, zabbix turns the trigger state into 'Cannot evaluate function'. I also reproduced this behaviour by restarting the zabbix server ( no new events for the trigger where received after the restart).

Kind regards

[bednar]

Hey,

there is no solution to this afaik.

Hey,

thanks for reply.
Is there any other way to clear status of these triggers?
I added third trigger with nodata function for every item, but it doesn't clear these trap triggers.

BR.

[PiotrIr]

Hi,

I have the same problem, has anybody found solution for this?

[mobu]

I can also confirm this issue. We are running Zabbix 2.2.7.

[mobu]

This one works

{hostname:eventlog[Application,,"Error|Critical",,,,skip].logseverity(0)}=9&{hostname:eventlog[Application,,"Error|Critical",,,,skip].nodata(15m)}=0

When this one does not

{hostname:eventlog[Application,,"Warning",,208,,skip].logseverity(0)}=2&{hostname:eventlog[Application,,"Warning",,208,,skip].nodata(15m)}=0

Only difference between these two is - event id tag.

[PiotrIr]

So it is Event ID which causes the problem? Unfortunately I have to use ID in mine case. Any solution?