trigger unavailable by icmp ping sends email notifications after 3-5 hours

[ssks393]

Hi,
I am monitoring multiple switches in our network and when they become offline we only receive notification after 3-5 hours. Triger previously was {Template Module ICMP Ping:icmpping.max(#10)}=0. Right now I switched to {Template Net Network Generic Device SNMPv2:icmpping.max(3m)}=0 and we receive notification after 10-15 minutes. I need to receive an email about unavailable device after 3 minutes. Could someone advise why this is hapening?

[ssks393]

any sugestions?

[Mateusz]

What is the interval of your ICMP Ping item?
If for example your item would have a 15 minute interval:

the first trigger you mentioned bases on last 10 values, that means it will trigger notification after 150minutes of unavailability

second trigger bases on last 3 minutes, but the triggers are calculated when new item value is received so "last 3 minutes" doesn't work when item has 15 minute interval

[ssks393]

Hi,
thank you for answering. Curently it has 3 minute interval but we only receive a message that the device is offline after the device is turned off for 15 minutes.

[Mateusz]

Check on the "Triggers" page, how long does it take for the desired trigger to show "Problem" status when switch is disconnected?
If the trigger does not show a Problem in desired time, you have an issue with your item+trigger configuration.

[ssks393]

this is how my items and trigers page looks like. Am I lookig at the right place?

[Mateusz]

Yes you are looking in correct places. I notice your trigger expression looks weird compared to mine, not sure if you are using correct syntax for that (why using curly brackets?), have a look at my trigger expression.
Also on the item page include time unit in update interval (so for one minute type "1m" or "60s" in there. Let me know if that helped!

[ssks393]

I tried using the expression you sent but I receive an error that expression is incorrect. I reduced the icmpping.max to 10s and update interval to 10s. No change. After turning of the switch for 10minutes no notification was received.

[Mateusz]

That's strange to me. What version of Zabbix do you use? Do you monitor the switch via Zabbix Proxy or directly from Zabbix Server? Remember that when changing any settings you need to wait for automatic cache reload (default every 60s) or reload it manually (zabbix_server -R config_cache_reload)

edit: also please check if trigger is showing a problem or not when you turn off the switch, don't expect an email only as a confirmation that Zabbix is working to rule out SMTP issues, you can do that by searching for your switch and then go either to triggers or problems

[ssks393]

It is not an smtp problem. In action log the notifaction time matches the time email was received. I dont know how to check version number. I am new to zabbix. I havent installed this setup. Maybe I should try updating to a newer version and than check if the problem persist?

[ssks393]

when I turn of the switch another switch that is conected to it shows a notification that interface is down but no email about icmp ping unavailable.

[ssks393]

for some reason messages that the problem is resolved are late.

[Mateusz]

Your version is visible on the bottom of the webpage. Install latest stable release and then see if you still have the problem

[ssks393]

Could you assist me on this process?I found this guide https://www.zabbix.com/documentation...grade/packages but I dont know if I should use Debian or Centos tutorial.

[ssks393]

I found out that I am running debian version.