Zabbix 4.0 - need a trigger that compares current value with avg of last 4 weeks

[anaikb]

Hello All,

Customer has a case where they want the current value to be compared with average of last 4 weeks. If it falls within +-5% of the average then an alert needs to be raised.

Data:

31-Jan 10:05	7-Feb 10:05	14-Feb 10:05	21-Feb 10:05	Average (31-Jan, 7-Feb, 14-Feb,21-Feb)	Threshold	28-Feb 10:05
5	4	6	4	4.75	Mini - 4.5125 Max - 4.9875	4.5

So if the value is lesser than mini or max an alert needs to be raised.

I created a sample trigger like this -
({Test KPI:test.item_key.avg(1h,)}/(
{Test KPI:test.item_key.avg(1h,7d)}+{Test KPI:test.item_key.avg(1h,14d)}+{Test KPI:test.item_key.avg(1h,21d)}+{Test KPI:test.item_key.avg(1h,28d)}/4))>=1.0
or
({Test KPI:test.item_key.avg(1h,)}/(
{Test KPI:test.item_key.avg(1h,7d)}+{Test KPI:test.item_key.avg(1h,14d)}+{Test KPI:test.item_key.avg(1h,21d)}+{Test KPI:test.item_key.avg(1h,28d)}/4))<=0.95

It is creating alarms for all values.
I searched online and could see the order of arithmetic operations - division will be done first.
To avoid that i tried using ( ) to group the operations together -
(
{Test KPI:test.item_key.avg(1h,7d)}+{Test KPI:test.item_key.avg(1h,14d)}+{Test KPI:test.item_key.avg(1h,21d)}+{Test KPI:test.item_key.avg(1h,28d)}/4)
I wanted the average of last 4 weeks to be calculated first, then it should do this
{Test KPI:test.item_key.avg(1h,)}/AVG_CALCULATED_ABOVE
then comparison - if its greater than or equal to 1.0

then an or block just to calculate it in the same way but compare it with less than or equal to 0.95
But it raises alerts for all values. I think i am missing something.

Please check and suggest what seems wrong here.
It is zabbix 4.0 so i cannot use any of the newer functions that are part of zabbix 5.0, 6.0

Regards,

[LenR]

It looks like you are comparing the same hour of the same day for the last month, that is somewhat different than the overall average of the last 28 days, if that matters.

The percent difference formula is (|a - b|)/((a + b)/2) x 100

I think you have "a" correct as key.avg(1h,7d) and "b" correct as the sum of the 4 items / 4. (I tried to copy and paste and get format errors I can't post)

I don't understand your test >=1 or <= .95.

I don't think Zabbix 4.0 has the abs() math function, it's documented in 6.0, if it's not if 4.0, that makes this harder. (in the function above |...| is abs). I would create calculated items for a and b to make your trigger expression simpler. Then take the formula f(x) above and test f(x) > 5 or f(x) < -5.

This is likely to be an expensive trigger, the more frequent the keys are sampled, the more expensive. If this is a lot of items, it could be a problem.