Problem E-mail Template showing "*UNKNOWN* history values following 6.0 Upgrade

[alexw-z]

I recently upgraded our Zabbix version from 4.4 to 6.0, and a strange problem has been flagged in relation to our e-mail alerts. They used to contain history values for various time intervals, but across the board these values are now showign up as *UNKNOWN*: for exmaple:

E-mail Title: PROBLEM on dca-mem01.redacted.com: Inbound Set commands Per Second Above 50k on dca-mem01.redacted.com

dca-mem01.redacted.com

Monitor:
Command Set

Latest value:
83598

Recent history:
*UNKNOWN* (5m ago)
*UNKNOWN* (15m ago)
*UNKNOWN* (1h ago)
*UNKNOWN* (2h ago)
*UNKNOWN* (24h ago)

Number of inbound Set commands being sent to Memcache on goes above 50k per second.

I've gone digging in our e-mail Message templates to see if I can track this down to a deprecated macros or something along those lines, but stranger still the content/macros of the templates don't look to match the e-mails that are being sent out, for example te template for Problemss problem looks like the following:

Subject: Problem: {EVENT.NAME}

Problem started at {EVENT.TIME} on {EVENT.DATE}
Problem name: {EVENT.NAME}
Host: {HOST.NAME}
Severity: {EVENT.SEVERITY}
Operational data: {EVENT.OPDATA}
Original problem ID: {EVENT.ID}
{TRIGGER.URL}

Does anybody know where I can go next with investigating this?

TIA.

[alexw-z]

Wait, interim update, I've just this minute found the following within a Trigger Action Operation, that at least confirms what's generating the body of the e-mail:

Recent history:
{?last(//{TRIGGER.KEY},#1:now-300s)} (5m ago)
{?last(//{TRIGGER.KEY},#1:now-900s)} (15m ago)
{?last(//{TRIGGER.KEY},#1:now-3600s)} (1h ago)
{?last(//{TRIGGER.KEY},#1:now-7200s)} (2h ago)
{?last(//{TRIGGER.KEY},#1:now-86400s)} (24h ago)

I know there were some trigger syntax changes in 5.4, and that Zabbix would attempt to convert these automatically (these also look like the newer format judging by https://www.zabbix.com/documentation...on/whatsnew540), so maybe it's not quite got the conversion right?

[cyber]

Current docs say

{ITEM.KEY}

→ Trigger-based notifications and commands → Problem update notifications and commands → Internal notifications → Script type item, item prototype and discovery rule parameter names and values6 → HTTP agent type item, item prototype and discovery rule fields: URL, query fields, request body, headers, proxy, SSL certificate file, SSL key file → Manual event action scripts → Description of item value widget

Key of the Nth item in the trigger expression that caused a notification. This macro may be used with a numeric index e.g. {ITEM.KEY<1-9>} to point to the first, second, third, etc. host in a trigger expression. See indexed macros. {TRIGGER.KEY} is deprecated.

But that TRIGGER.KEY was deprecated already in 4.4 docs... oh .. even in 2.0 docs.. Since when you have that action there? Seems like 1.8 was the version, where it last time existed..
So maybe you get away with very simple fix here..

[alexw-z]

Hah, it's quite possible. I've had to do a lot of modernisation since I took over ownership of this Zabbix install, so it may well have been out of date for a while...

[alexw-z]

So I've now tried quite a number of possibilities now:

There seem to be at least two possible general formats, either {<macro>.<func>(<params>)} or func(xxxx), and a number of possible functions (for example history, time, timeago, time_shift), although some of them appear to work on formatting dates rather than time shifting values.

{ITEM.VALUE}
{ITEM.VALUE, timeago(5m)}
{ITEM.VALUE, time()-300)}
last("{$ITEM.VALUE}", time()-300)
last("{ITEM.VALUE}", time()-300)

history("$ITEM.VALUE$", now() - 300)
history("{$ITEM.VALUE}", now() - 300)
history("{ITEM.VALUE}", now() - 300)
history({ITEM.VALUE}, now() - 300)

last(/{ITEM.VALUE},#1:now-300s)} (5m ago)

{ITEM.VALUE} on it's own works, but I can't seem to figure out how to move this value back in time a few minutes. The documentation is a little convoluted and I think I've gone slightly snowblind from staring at this over the last few days. Is anybody able to point out where I'm going wrong/help with what the correct syntax should be? I'm sure it must be something fairly simple but I'm just not finding it.

[cyber]

functions work with keys...not values...
Last one might work if you replace ITEM.VALUE with ITEM.KEY... "give me last value of ITEM.KEY, #yes last one: from 300s ago"

There is not such functions as you try here ... timeago() or history()... time() is, but it returns values in HHMMSS format, so trying to do math with it is useless..

Only thing you can do with ITEM.VALUE is customizing it... https://www.zabbix.com/documentation...acro_functions
only those selected functions...


EDIT: Did you try just changing TRIGGER.KEY to ITEM.KEY`?
{?last(//{ITEM.KEY},#1:now-300s)} (5m ago)
{?last(//{ITEM.KEY},#1:now-900s)} (15m ago)
{?last(//{ITEM.KEY},#1:now-3600s)} (1h ago)
{?last(//{ITEM.KEY},#1:now-7200s)} (2h ago)
{?last(//{ITEM.KEY},#1:now-86400s)} (24h ago)