"High ICMP ping response time" trigger behaving unexpectedly

[Mike_VC]

In Zabbix 6.0.2, multiple templates have triggers such as this:
avg(/Cisco IOS versions 12.0_3_T-12.2_3.5 SNMP/icmppingsec,5m)>{$ICMP_RESPONSE_TIME_WARN}
with $ICMP_RESPONSE_TIME_WARN = 0.15
I'm seeing the trigger fire at 2:00 and the self-resolve in 1m over a period with the following recorded values:

2022-04-18 02:01:15 - 0.0005433
2022-04-18 02:00:15 - 0.272
2022-04-18 01:59:16 - 0.00431
2022-04-18 01:58:15 - 0.01172
2022-04-18 01:57:15 - 0.2307
2022-04-18 01:56:15 - 0.06073
2022-04-18 01:55:15 - 0.000669

My expectation is that with sample rate 1/m it should average the last 5 values. I'm calculating the average in this case to be 0.115892.
Am I not understanding how the formula works correctly?

Thanks!

[Mike_VC]

Anyone? Am I the only one getting false alarms about high ping times from multiple devices to different zabbix proxies?

[Markku]

Have you checked that there aren't any host-level macro that would override the threshold value from the template?

Markku

[Mike_VC]

Yes, I have checked that. I've also re-created the host (just in case?). I'm still seeing this weird trigger and every time I check, it seems to me like it's actually doing that math wrong... or I'm not understanding how it's arriving at that average.

[Markku]

I'm unable to reproduce this on Zabbix 6.0.4. I created an item as Zabbix trapper and gave it your six values 1 minute apart using zabbix_sender:

2022-05-09 20:51:48	0.272
2022-05-09 20:50:48	0.0043
2022-05-09 20:49:48	0.0117
2022-05-09 20:48:48	0.2307
2022-05-09 20:47:48	0.0607
2022-05-09 20:46:48	0.0007

(For some reason the values were truncated at four decimals)

The trigger was "avg(/testhost/avgtest,5m)>0.15", and it did not fire (= correct).

If I wait for the 5-minute window to clear (= no values), and then I send it two values 0.15 and 0.16, the trigger fires (= correct because the average of all values within 5 minutes is 0.155). And when I send it third value 0.14, the trigger clears immediately (= correct because the average of the values is now 0.15, which is not greater than 0.15 anymore).

I'd recommend updating Zabbix to 6.0.4 first, and if the problem persists, then you could open a support case.

Markku

[Markku]

(For some reason the values were truncated at four decimals)

Irrelevant for the problem but I guess the reason for it may be this: "database is not upgraded to use double precision values" (this is an old installation upgraded to 6.0.4)

Markku

[Mike_VC]

Thank you for this insight! I'm going to upgrade from 6.0.2 to 6.0.4 and see if that changes things. Is there anything special I should do in regards to the DB?

[Markku]

Is there anything special I should do in regards to the DB?

There are no mentions in the upgrade notes for 6.0.3 or 6.0.4 (https://www.zabbix.com/documentation...rade_notes_604), so no.

Markku