Resolved messages are sent even though the problem is not resolved.

[Baymon]

We are monitoring a log file. A problem should be triggered if there is no expected log entry within a defined time range. The trigger looks like this:

{Zabbix server:log[/var/log/zabbix/monitor.log,expected log entry].nodata(10800)}=1
and
{Zabbix server:system.cpu.util[,user].time()}>114500
and
{Zabbix server:system.cpu.util[,user].time()}<235900

OK event generation: Expression
Problem event generation mode: single
OK even closes: All problems

The trigger fires and creates a problem if there is no data within this time range and 3 hours before, so far so good, but at 23.59 the system sends a "Problem has been resolved" Email, even though there is no change. Problem still exists, no update in the logfile and in the dashboard the problem remains unchanged and open.

Problem duration: 12h 14m

What is wrong here? Why sends Zabbix a resolved email?

Thanks for any suggestion?

[Baymon]

Thanks for the suggestion. I will try with these items:

{Zabbix server:system.localtime.time()}>114500
and
{Zabbix server:system.localtime.time()}<235900

That is what you mean?

[cyber]

I would eliminate dependency on those cpu.utl items. Just use the same log item with time().

[cyber]

Does it eliminate dependency on other items besides one log item? No!

I meant
{Zabbix server:log[/var/log/zabbix/monitor.log,expected log entry].time()}>114500 etc...