Trigger "Alarm alerts on dasboard"

[fatih gur]

Hello Everyone,

I am Fatih and I gonna ask you something and I so excited for interaction with all of you cause It's my first post on Zabbix Forum.
Recently I created item and following this attemp created trigger too. My main goal is to see alarm "ALARM_CRITICAL" on dashbord when "ALARM_CRITICAL" comes from /var/log/syslog and yes it works.But when the alarm state is "ALARM_NORMAL" on syslog, I cannot see the alarm return to "ALARM_NORMAL" on the dasboard or "resolved" on problem tab.It still display to screen " ALARM_CRITICAL" even problem resolved. It captured healthy "ALARM_CRITICAL" ,and "ALARM_NORMAL in monitoring>latestdata>log history.". It may has a problem on recovery expression as I think.How can I fix this problem? I did effort to solve it many times , honestly I've been trying for more than 15 days. I will be shared ss at the attachment about what I did in trigger and item pages.

[Hamardaban]

At first glance, everything is correct. I can advise you to reduce the update interval to 1 second so that the active agent passes values as quickly as possible and does not accumulate them in large portions. Otherwise, the CRITICAL and NORMAL strings may appear in the same portion, which will lead to incomprehensible work because the order of processing the strings may be arbitrary.
for example https://www.zabbix.com/documentation...lation/trigger

[fatih gur]

I found a solution yesterday. It is working for now. I want to share the solution that I find with you. Of course I will apply the solution which you shared.

################################
May 28 15:12:21 localhost cnrnrf[20490]: cnrnrf[20490]: 2020/05/28 15:12:21 733811 ALARM_CRITICAL [140179452987136 xxxxxxxxxxxxx,"eventType":"DATABASE_ACCESS_FAILURE ",xxxxxxxxxxxxxxxxx":" CRITICAL","probableCause":"DB is unreachable",x8e08597be99d",
May 28 15:28:38 localhost cnrnrf[20490]: cnrnrf[20490]: 2020/05/28 15:28:38 076360 ALARM_NORMAL [140179452987136xxxxxxxxxxxx] xxxxxxxxxxxxxx,"eventType":"DATABASE_ACCESS_FAILURE","info":"DB connection is done, xxxxxxxxxxxxxxxxxxxxx:"CLEARED","probableCause":"D B is reachablexxxxxxxxxx
###############################
This is my syslog which is mentioned above.

I created a new ıtem which key is log[/var/log/syslog,cnrnrf.*\bDATABASE_ACCESS_FAILURE\b]

Then following attemp , I created a trigger like ;

"Problem expression
{Cinar NRF Template:log[/var/log/syslog,cnrnrf.*\bDATABASE_ACCESS_FAILURE\b].regexp(ALARM_CRITICAL)}=1 and
{Cinar NRF Template:log[/var/log/syslog,cnrnrf.*\bDATABASE_ACCESS_FAILURE\b].regexp(ALARM_NORMAL)}=0

recovery expression
{Cinar NRF Template:log[/var/log/syslog,cnrnrf.*\bDATABASE_ACCESS_FAILURE\b].regexp(ALARM_NORMAL)}=1 "

Then It worked.I owe it to second problem expression which I add secondly. What do you think this way ?

Thanks alot again,
Have a nice day!!!