i have problem with network traffic triggers

[novint]

hello everyone,

i am using snmp and zabbix agent network interface discovery and trigger prototypes that i configured to suit my needs:
i configured the trigger names to show {ITEM.VALUE} and {ITEM.LASTVALUE}
and also configured them to trigger if the traffic exceeds 100M
i also have an action that send mail alerting when the triggers are reiggered

my problem begins when i get mails where the traggic is 13.97M and 18.56M
at first i thought maybe the trigger ignore the decimal points and look on 18.56M as if it was 1856 or somthing like that.
but then i checked the graphs for the times the mails are sent in and i confirmed that this was really what the graph showed

i dont really know why the triggers malfunction like that
would deeply apprciate and love to have your insights and help

[dimir]

Could you show the trigger expression and data in notification email?

[novint]

Could you show the trigger expression and data in notification email?

yes ofcourse,
ty for your reply
here you go:

this is the expression: {Fortigate 100D:ifInOctets[port3].last(#10)}>100M

this is what i get to my mail:
Problem started at 11:19:57 on 2019.09.26 Problem name: Download of port3 is 13.98 Mbps
Host: Fortigate 100D
Severity: High

Original problem ID: 145466

[dimir]

I assume you don't use macro _{ITEM.LASTVALUE}_ in notification. What if you add it? E. g.

Value: {ITEM.LASTVALUE}

This will show the value used when processing trigger expression.
Also I'm not sure how the bytes per second can be converted to megabytes in order to process the expression.

[novint]

I assume you don't use macro _{ITEM.LASTVALUE}_ in notification. What if you add it? E. g.

Value: {ITEM.LASTVALUE}

This will show the value used when processing trigger expression.
Also I'm not sure how the bytes per second can be converted to megabytes in order to process the expression.

the expression meant to be processed in bytes rather than megabytes?

[dimir]

Your item ifInOctets[port3] has preprocessing with Change per second?

[novint]

Your item ifInOctets[port3] has preprocessing with Change per second?

i dont know, how do i check it? (i just downloaded template for fortigate 100D from the website)

[dimir]

If it's this one

https://share.zabbix.com/network_devices/fortigate/template-fortigate-100d

you can ask an author this question.

[novint]

Your item ifInOctets[port3] has preprocessing with Change per second?

but what does it has to do with the question of which of the two the trigger process with byes/megabytes

[dimir]

Trigger references item value in the expression. If you want to know what type of value that is you look into item configuration.

[novint]

Trigger references item value in the expression. If you want to know what type of value that is you look into item configuration.

are you refering to the 'Units' rubrica in the item configuration? its says 'bps' if i change it to megabytes does it make any difference?

[dimir]

Ah, it's the units. No, leave it as it is. I suspect that in notification you get current latest value, while in the trigger expression you check 10th value from the latest. This is why I suggested adding a {ITEM.LASTVALUE} to the body of notification, but you ignored that part.

[novint]

Ah, it's the units. No, leave it as it is. I suspect that in notification you get current latest value, while in the trigger expression you check 10th value from the latest. This is why I suggested adding a {ITEM.LASTVALUE} to the body of notification, but you ignored that part.

so i should use {ITEM.LASTVALUE} without any number attached to it to get the last value resolved by the trigger?

[dimir]

I suggest you to add this macro to the notification that you receive. In order to do that, go to "Configuration -> Actions -> [make sure the top-right "Event source" drop-down is set to "Triggers"] -> [click the action that relates to your trigger] -> Operations [tab]" and add this macro to "Default message" textbox:

Value: {ITEM.LASTVALUE}

[novint]

I suggest you to add this macro to the notification that you receive. In order to do that, go to "Configuration -> Actions -> [make sure the top-right "Event source" drop-down is set to "Triggers"] -> [click the action that relates to your trigger] -> Operations [tab]" and add this macro to "Default message" textbox:

Value: {ITEM.LASTVALUE}

hi dimir
i did what you suggested
and i still recieve mails for wrong/false notifications, while the reigger is set to 100M i get mails for 85 and 70M exceeded