TCP port check

[derli1988]

Hello everybody.

I'm trying to monitor TCP checks on specific ports for specific IPs...
I'm using google DNS for testing purposes...
So far I am having great success with the below trigger...
However, I'd like to have the alert to be triggered after some failed attempts, the way I am doing now, as soon as 1 failed check happens, I'm getting an alert...
This could lead to false positives.

last(/Template host1/net.tcp.service[tcp,8.8.8.8,443])=0

Can anyone, please, tell me how I can make my checks better?

[cyber]

For example, you can use function max().
max (/host/key,(sec|#num)<:time shift>)
if max value for time period X is 0 (considering, that it only returns 1 or 0), it means all checks are failed and you have an issue. If at least one check returned 1 during that period, trigger will not activate.

[derli1988]

That's a very odd and different approach... I'll try it out, thanks.

[cyber]

You can also use count(), it gives a bit different result. This allows you have some failures. Like, say, if we have 2 fails during 5m period, it is ok, but if its more, fire a trigger. It does not care if fails are after each other, it just looks for a count during a period of time