dependent items values inconsistent

[geib]

I am new to zabbix and I am currently evaluating zabbix for monitoring data provided in snmp traps from a number of snmp agents. I have been able to receive the traps in zabbix and can see the default data for each host in the latest data page. I need to provide a couple of pieces of information from the trap, more than one OID value, for the users to see in the problem. I created a master item which correctly selects the traps of interest with regex. Next I create a few dependent items which extract the values from a couple of different OIDs, again using regex in preprocess of the item. So, for example, I have <trap>.details, <trap>.device, <trap>.device_ip, <trap>.severity from the dependent items.

In my trigger my expression compares the severity with an interger to determine the alarm condition, then check the device and device_ip bytelength for a value greater that zero in order to get those items into the trigger. I then set the trigger name to {ITEM.VALUE1}, and the operational data to {ITEM.VALUE2}:{ITEM.VALUE3} in the trigger.

However, when I see a new problem in the dashboard, the problem name comes from a different trap instance that do the operation data. It appears that the dependent items are independently processing different traps at different times, and the trigger expression includes values from different traps.

An example of one of my triggers:
Name:" Loss Of Input Sync {ITEM.VALUE3}"
Operation Data: "{ITEM.VALUE2}"
Expression:
last(/NMX Traps Template/loss-of-input-sync.severity)=1
and bytelength(last(/NMX Traps Template/loss-of-input-sync.device))>0
and bytelength(last(/NMX Traps Template/loss-of-input-sync.details))>0

In the problems from this trigger the Name and Operation Data contain data from two different traps.

Is there a setting that will force all the dependent items to process the same trap.??

Thanks for any help.

[splitek]

This only hapens when using logical "and" in trigger.

Workaround - calculated item.
Put your trigger logic in calculated item. Calculated item should return 0/1 (OK/Problem). Make simple trigger on this item. If you need to show other items values then add them to the trigger (but logic for them shoud be "never fire trigger").

Workaround - preprocessing.
Add dependent item with Javascript. In that script put trigger logic. So item get only 0/1 values (OK/Problem). Now add a simple trigger on this item.
If you need also some other values then you need a cascade of dependent items or a text item. Second is simpler so: dependent item (type character) can return something like "1,some_text1,some_text_2".
The "1" is a OK/Problem (logic from trigger).
"some_text1,some_text_2" are strings to show in events.
In trigger that will work on a string value like "1,some_text1,some_text_2" you can use string functions: https://www.zabbix.com/documentation...nctions/string
You can compare strings in trigger, ie.: left(last(/host/key),1)="1"
Also you can try to extract part of value with function "regsub": https://www.zabbix.com/documentation...acro_functions

[geib]

As I said, I am new to zabbix, so bear with me.

In my trigger only the .sevrity is "really" used in the expression. I only include the "and" on the .details and .device so that I can include that info in the problem name, {ITEM.VALUE3}, and the operational data, {ITEM.VALUE2}. I am not sure I follow your suggestion to add the additional items to the trigger, but logic should be "never fire trigger". Do you mean that sub-expression should always return false.?

[splitek]

I'm with you Keep experimenting with Zabbix maybe it is hard at start but it is very flexible (IMO).
Yes, in this logic only one item is used to check trigger, the other sub-expressinons are always false and only for using indexed macros (ITEM.VALUE2, ITEM.VALUE3...). This indexed macros are to get somethig additional (and dynamic). When we use them in in trigger name then generated events will have "dynamic" names.