prediction trend forecast in V3 is it ready for prime time

[glebs.ivanovskis]

Could you provide a bit more insight on how to do this?

Have you ever used calculated items? You need to put expression in the "Formula" field and in the "Key" field you just put something unique.

[sga]

Have you ever used calculated items? You need to put expression in the "Formula" field and in the "Key" field you just put something unique.

Hello glebs.ivanovskis, how are you? I tried to create the item calculated with the formula you posted above and the item is not supported. The error I get is the following: Can not evaluate function "timeleft (7d,, 10)": item "hostname: vfs.fs.size [/, pfree]" does not exist.

Can you help me in this matter? Thank you and sorry for my bad English.

[glebs.ivanovskis]

Thank you, I am fine. Don't apologise, your English is good!

Apparently, you don't have such an item. Create it and ensure that you use the same key (literally the same) in calculated item.

[sga]

Thank you, I am fine. Don't apologise, your English is good!

Apparently, you don't have such an item. Create it and ensure that you use the same key (literally the same) in calculated item.

Thanks in advance for your support on this issue, it has now worked here. I'll take a look now to really understand how to use and what I can achieve with this functionality. LOL.

[akincer]

What's wrong with the first example here for a start?

Here's what I did that did not produce what I would consider an expected result:

1. Installed fresh Zabbix 3.2.3 version on Ubuntu 16.04
2. Configured a Windows 2012 host using the Zabbix client
3. Configured a "Trigger" with default settings with this expression:
   

   {MYHOSTNAME:vfs.fs.size[E:,pfree].timeleft(1h,,0)}<1h and {MYHOSTNAME:vfs.fs.size[E:,pfree].timeleft(1h,,0)}<>-1

4. Added enough dummy data to guarantee that at the current rate of adding, the "E" drive would be full within hours.

I tried several times using different rates of data addition, but the trigger was never fired. Am I missing something?

NOTE: I also added enough data to guarantee that the drive would be filled in less than an hour at the rate of data adding and that didn't work either.

[glebs.ivanovskis]

For how long were you dumping data on the drive? Can you show the graph of free space on it during your experiment? Have you tried to create a calculated item to see what it actually calculates?

timeleft("vfs.fs.size[E:,pfree]",1h,,0)

[akincer]

I've attached a portion of the graph showing my efforts.

I have not tried a calculated item. I'll see if I can get that to provide some information.

[akincer]

For how long were you dumping data on the drive? Can you show the graph of free space on it during your experiment? Have you tried to create a calculated item to see what it actually calculates?

timeleft("vfs.fs.size[E:,pfree]",1h,,0)

I did this and watched the value shrink and shrink. Eventually, it got as low as sub-500 (it started out at 999999999).

Interestingly, at some point the trigger did actually fire. I'm going to have to learn more about how to leverage that, what to name it, how to get the warning window to something that allows us to do something about it and how to tweak for different use cases. I know there is some documentation out there discussing this a bit more in depth, but does anyone know of some concrete examples with detailed explanations?

Thanks for the help.

[akincer]

One more random question -- must we create a rule per host or can we create generic definitions that we can simply apply to a template?

We have over 800 servers in our environment I'd like to monitor. Creating a rule per drive per server is ... not optimal to say the least.

[glebs.ivanovskis]

You see, your experiments last five to ten minutes, but you say timeleft() to take one hour period to analyse. It "sees" that predominantly there is no activity with a few short "bursts" so the average rate of change it calculates is far less than the rate during these "bursts". That "1h" in timeleft() parameters results in very pretty forecasts which are not affected by short-term oscillations in item values. But it is too large for you if you need triggers that react faster.

I hope my explanation provides some "feel" of the process underneath. After all, there is nothing fancy, just straight line approximation in case of default parameters. It is very simple and robust, but won't probably suit every scenario. So you need to play around with parameters a bit and maybe combine several timeleft()/forecast() functions + other trigger functions to get what you want.