Trigger Recovery Expression not working

[ZBX-User_UK]

I'm trying to create a trigger that fires when the system reboots (Event entry 6006 - Information - in the system log records Event Log stopped), and recovers when the system has been rebooted for a period of time (210s) in this example. However, when I reboot the device the trigger fires, but it never recovers.

Problem Expression:
({.Windows Shutdown Pending or in Progress:eventlog[System,,"Information",,6006,,skip].str("stopped")}=1)

Recovery Expression:
({.Windows Shutdown Pending or in Progress:system.uptime.last()}>210)



I'm absolutely baffled as to why it's not clearing. I simplified it down to this, as I originally checked for Event 6005 (Event log started) as well on recovery, and event 1074 (...initiated the restart...) as an alternative trigger.

Does anyone have any ideas?

[ingus.vilnis]

Hi,

Right, you can't recover a trigger while the Problem expression is still true. And it can't be anything else because event ID 6006 is exactly "The Event log service was stopped." thus the only thing you'll get in your data is stopped stopped stopped.

How about collecting "Event ID 6005: The event log service was started." as well? In your item key just modify the event id parameter to "(6005|6006)" thus the event sequence would go like started -> stopped -> started etc. And in such case maybe you don't need the recovery expression at all if you trigger on the word "stopped".

[ZBX-User_UK]

Thanks for that. I'd mistakenly assumed that once it triggered, unless a new trigger occurred it would reset. Back to the drawing board. :-)