Disk Space Trigger problems (falsely resolving)

[cszikszoy]

I'm observing some strange behavior related to the "Disk Space" triggers for both Linux and Windows hosts. Examining the trigger shows the following conditions:

The description of the trigger says:

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.
Second condition should be one of the following:
- The disk free space is less than 5G.
- The disk will be full in less than 24 hours.

The first and second condition is straight forward, but I'm looking for some help with the 3rd condition.

What is the purpose / function of this? It seems to not be working correctly because what I'm seeing is the following:

1. Host with high disk usage has this trigger asserted
2. Trigger resolves when disk usage does not increase further, but is still above threshold

Consider the following event for a particular server:

The event is shown being triggered and cleared multiple times. However, the graph of the data shows this:

Every spike on the graph corresponds to the trigger being asserted, however, the trigger is resolved when the disk usage stops increasing. It seems like this shouldn't happen. The disk usage never dropped below the threshold (90%) so the trigger should never resolve. I suspect it's the 3rd expression that's causing the trigger to no longer evaluate to true, but why?

[tim.mooney]

Every spike on the graph corresponds to the trigger being asserted, however, the trigger is resolved when the disk usage stops increasing. It seems like this shouldn't happen. The disk usage never dropped below the threshold (90%) so the trigger should never resolve. I suspect it's the 3rd expression that's causing the trigger to no longer evaluate to true, but why?

The logic for the triggers is "A and (B or C)", so the first condition must be true and at least one of the 2nd or 3rd conditions must also be true for the trigger to fire.

Condition A is true for all of the graph you show.

Condition B is is only true for a short period right as utilization is very close to 100%. Most of the time, it is not true, so it does not contribute to the trigger.

Condition C is true whenever there's a brief spike in utilization, because the predictive nature of the trigger is looking at growth from a 1 hour time period. Once the growth subsides and you're back to a steady state, Condition C becomes false again, so at that point A is still true, B is false, and C is back to being false, so you have "true and (false or false)", which is false, so the trigger resolves.

[cszikszoy]

Condition C is true whenever there's a brief spike in utilization, because the predictive nature of the trigger is looking at growth from a 1 hour time period. Once the growth subsides and you're back to a steady state, Condition C becomes false again, so at that point A is still true, B is false, and C is back to being false, so you have "true and (false or false)", which is false, so the trigger resolves.

I see - this is the condition that's clearing the trigger. I think I understand the purpose of it, essentially "reset the trigger if disk usage has stopped increasing".

https://www.zabbix.com/documentation...ers/prediction

https://zabbix.org/mw/images/1/18/Prediction_docs.pdf

Thank you - those were informative.