Help createing semi-advanced triggers for backup monitoring

[Simon Bjerre]

Hi, forum.

I'm trying to create a trigger for our backup system.
Currently, I have Zabbix look at the Windows event log and have made three separate items for this:

• Name - Key
• BackupSoftwareName Image Successful - eventlog[BackupSoftwareName/Operational,,Information,,812]
• BackupSoftwareName Image Start- eventlog[BackupSoftwareName/Operational,,Information,,801]
• BackupSoftwareName Errors - eventlog[BackupSoftwareName/Operational,,Information,,813]

From these I have some Preprocessing that makes it only display the server name as the value.

I was hoping to create a trigger that would fire on ANY value from the error item and only recover when a Successful item was found with the same name.
Currently I have this as my trigger:

• Name - Expression
• Backup failed on {ITEM.LASTVALUE}
  • Problem: {BackupSoftwareName:eventlog[BackupSoftwareName/Operational,,Error,,813].str(*)}=1
  • Recovery: {BackupSoftwareName:eventlog[BackupSoftwareName/Operational,,Information,,812].str({ITEM.LASTVALUE})}=0

In my mind, this would trigger on any value from the Error item and only recover when a value of the correct server name is found in the Recovery.

Is anyone that can help me here?
Sorry for obfuscating the software name, cannot share this.

If we can make this work I will submit all the working code along with the other items for this software

[tim.mooney]

The thing to keep in mind about Recovery expressions is that if the Problem expression is still true, then the Recovery expression does not matter. If you're going to use a Recovery expression, then you need to write your expressions so that the Problem expression becomes false AND the Recovery expression evaluates to true.

My guess is that the Problem expression is continuing to remain in the "true" state. Assuming you're running a new enough version of Zabbix (you don't say anything about your environment...) you may want to use the expression testing functionality to test your logic.