How to close a problem after x time

[LgAltair]

Hey guys,

How can i close a trigger after x time. I have some "NTFS corruption" Template with this trigger "logeventid(/Template Eventlog Hardwareproblems/eventlog[System,,,,^55$,,skip],,"55")=1" Can i do this with "Recovery expression"? i found some documentation with "time() function" but i dont now how to do this. Somebody can help me thx?

[vicbc]

Hey there LgAltair.

There's two different things here.

When you set a recovery expression if your item reach it's condition, the problem will be solved. Simple as that.

If your trigger fires with this condition:

"logeventid(/Template Eventlog Hardwareproblems/eventlog[System,,,,^55$,,skip],,"55")=1" -> Problem

It means that the opposite logic can be applied to a recovery:

"logeventid(/Template Eventlog Hardwareproblems/eventlog[System,,,,^55$,,skip],,"55")[B]<>[/B]1" -> Resolved

With this you can quickly get rid of the problem in your Dashboard.
Thing is, this can result in what we call Flapping.
Take a look at this post to understand it better, and how to avoid this kind of problem.

https://blog.zabbix.com/no-more-flap...mart-way/1488/


Now, if you only want the problem to disappear after X minutes, that doesn't make much sense.
I say that because, if you managed a way to clear you trigger from the screen after, let's say, 1 hour, after it disappears, if the value of that item remains the same, a new problem will pop-out.

You need to take a look at how your Item is configured.
What's the update interval?
If it's like, 30 minutes, a new value will only be collected after 30 minutes. And until them, if your trigger has fired, it will remain there for at least 30 minutes, until a new value be collected and evaluated againg by Zabbix in the trigger.

[LgAltair]

Hey thx a lot. If i get the problem so i send some remote command what solve the problem at midnight so i want autoclose the problem after 30 minutes. The update interval i will set to 8 hours or ones a day.

My problem is with recovery option im reading only the eventlog where the trigger is createt if the "ID55" is present in the log "yes" or "not" if yes i get the error if "not" i dont get any error. So i cant close it with a normal recovery expression so i want to do this with simple time close.