Ad Widget

Collapse

How can this trigger possibly be UNKNOWN??!?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • peter_field
    Member
    • Jun 2006
    • 71

    #1

    How can this trigger possibly be UNKNOWN??!?

    I have an item 'uLastWinUpdate' which is working and collecting data. Currently for a particular server, the value is 120. I have a trigger, which reads '{Windows_t:uLastWinUpdate.last(0)}>60'. Now on this server, where the value is 120, the trigger reads as UNKNOWN. What the?! The value is 120, the trigger is quite simple, if 120>60 HOW CAN THIS BE UNKNOWN?

    It has been TRUE in the past, I suspect it is something to do with either the Zabbix server or the server in question rebooting. The item is only checked daily. However, looking at when the Zabbix box rebooted and when the item become UNKNOWN it doesn't make sense either, the trigger went from TRUE to UNKNOWN at 2006.Nov.29 08:13:32, however, the Zabbix servers last reboot was 2006.Nov.23 12:54:46, well before the trigger changed.

    The server that the trigger is associated was rebooted right before the trigger last became unavailable, but it doesn't explain the earlier UNKNOWN that occured at 2006.Nov.19 16:28:49, in fact, I can't see anything that would cause this trigger to change at this time, the Zabbix server was running for this entire period, as was the server in question, and data was being collected during this time.

    When are triggers checked? Is it when the item value is updated? Does it happen when the Zabbix server comes up? Does rebooting the server the trigger is associated with have any effect on this? If so WHY?? This is driving me batty. Am I right off the track here? Anyone have any ideas?

    I have screenshots of item and trigger config's, as well as the value and trigger status, I'll post them if anyone thinks it will help. Running 1.1.3.

    Item config:
    Desc: Windows Updates (days since installation)
    Type: Zabbix Agent
    Key: uLastWinUpdate
    Type: INT64
    Units: (none)
    Mult: no not use
    Interval/Hist/Trends: 86400/30/365
    Status: Monitored
    Store: As is
    Throw map: As is
    Apps: none

    Trigger config:
    Name: Windows Updates have not been installed in 60 days
    Expr: {Windows_t:uLastWinUpdate.last(0)}>60
    Deps: none
    Severity: Warning
    No comments, no url, not disabled.

    Agent config (item is working so probably not useful):
    UserParameter=uLastWinUpdate,cscript.exe /nologo "C:\SWatch\uLastWinUpdate.vbs"

    Latest data for server in question:
    Last Check: 28 Nov 16:28:49
    Last Value: 120

    Trigger status for server in question:
    Expr: {bws_tssrv:uLastWinUpdate.last(0)}>60
    Status: UNKNOWN
    Last Change: 20 Nov 09:08:02

    History of trigger for server in question:
    2006.Nov.29 08:13:32 UNKNOWN
    2006.Nov.20 09:08:02 TRUE
    2006.Nov.19 16:28:49 UNKNOWN
    2006.Nov.15 10:53:15 TRUE

    Times the Zabbix server has rebooted:
    2006.Nov.23 12:54:46
    2006.Nov.21 12:34:45
    2006.Nov.20 09:04:39
    2006.Nov.14 16:21:08

    Times the server in question has rebooted:
    2006.Nov.29 08:21:59


    Thanks guys

    Peter
  • peter_field
    Member
    • Jun 2006
    • 71

    #2
    Bump... Alexei? Anyone?

    Alexei? Anyone?

    This is driving me crazy at the moment...

    Thanks guys

    Comment

    • RobertS
      Member
      • Aug 2006
      • 57

      #3
      You can try the following:

      1. disable the item
      2. clean the history
      3. enable the item again

      Sometime this helps. You can also try to delete the trigger after step 2 and recreate it after 3

      Comment

      • peter_field
        Member
        • Jun 2006
        • 71

        #4
        Is nobody else having this problem?

        I am experiencing this with multiple items across multiple servers. Surely someone else has come across this?

        Even after deleting and recreating this problem happens.

        Help!?!

        Comment

        • Alexei
          Founder, CEO
          Zabbix Certified Trainer
          Zabbix Certified SpecialistZabbix Certified Professional
          • Sep 2004
          • 5654

          #5
          Trigger can be UNKNOWN because of:

          1. Trigger expression cannot be calculated. For example, one of trigger's items does not have data.
          2. When host become unreachable, ZABBIX changes status of all triggers related to this host to UNKNOWN.
          Alexei Vladishev
          Creator of Zabbix, Product manager
          New York | Tokyo | Riga
          My Twitter

          Comment

          • peter_field
            Member
            • Jun 2006
            • 71

            #6
            There is data available

            Thanks for the reply Alexei, however:

            - This issue does occur around server reboots, however, when should the trigger change from Unknown to ON or OFF? When the server becomes available? On the next check of the item? This doesn't happen, it stays UNKNOWN indefinately, or possibly until the Zabbix server is restarted.
            - There is data available, the item works fine.
            - I don't see any reason why the trigger could not be calculated (I'm no expert on this matter, but an example of a trigger is '{Windows_t:uLastWinUpdate.last(0)}>60', its not complex, only relys on data from one item.

            I might try rebooting the Zabbix box every night as a workaround, but its far from elegant.

            Comment

            • Alexei
              Founder, CEO
              Zabbix Certified Trainer
              Zabbix Certified SpecialistZabbix Certified Professional
              • Sep 2004
              • 5654

              #7
              ZABBIX updates value of a trigger only when it gets new value for one of the trigger's item.
              Alexei Vladishev
              Creator of Zabbix, Product manager
              New York | Tokyo | Riga
              My Twitter

              Comment

              • peter_field
                Member
                • Jun 2006
                • 71

                #8
                Thanks Alexei

                Thanks Alexei,

                Sorry about the delay in replying, I really needed a holiday. I hope everyone had a good break, and wish everyone the best for the new year.

                After some more investigation, I can confirm its working as it should as far as status. However, I'm not sure its triggering properly. Should a trigger be fired when the status changes from UNKNOWN to ON? Or does it only fire if the triggers last known status was OFF?

                Comment

                • peter_field
                  Member
                  • Jun 2006
                  • 71

                  #9
                  No sooner I thought it was working.......

                  OK. I've just gone to another site, this time neither the server in question, nor the Zabbix server have been rebooted (in more than a month), and the server has a bunch of UNKNOWN triggers for items that it has current data for.

                  What did happen was an item jammed the queue. This happened at about at 2007.Jan.10 21:09:42, which is when the problem occured. I suppose a jammed queue probably means the host is considered unavailable, and hence, all triggers to UNKNOWN, so I suppose I'm probably ranting here. Why does a jammed queue change triggers to UNKNOWN? OK, its probably fair enough, but this is a real pain for me. Why not change it so that when the host becomes available again, check all items again or at least just the items related to UNKNOWN triggers, or perhaps just items that are set with an interval or more than 4 hours or something. Or just get rid of UNKNOWN, it does seem a bit unnessesary, or perhaps make it an option? I dont know, thanks for at least reading my rant.

                  BTW the item (on a Windows agent) "vfs.file.size[C:\Program Files\Exchsrvr\MDBDATA\priv1.edb]" on a file that doesn't exist simply jams the queue, but I think you already know that. Rant rant rant.

                  Here is the supporting data. NOTE: Every Zabbix agent trigger on this Zabbix server went to UNKNOWN at 2007.Jan.10 21:09:42, except it seems for triggers on the Zabbix server itself:
                  Products Outdated
                  {tssrv:uProdChk.last(0)}>0

                  Item Values
                  2007.Jan.10 15:54:00 0
                  2007.Jan.10 13:11:57 0

                  Trigger Changes
                  2007.Jan.10 21:09:42 UNKNOWN - 14.4 hours 14.4 hours 100%
                  2007.Jan.10 13:11:57 FALSE - 8 hours 8 hours 35.61%
                  2006.Dec.11 15:22:56 UNKNOWN - 29.9 days 30.5 days 98.92%

                  Host uptime 11 Jan 11:30:08 1m17h20m7.83141699992s

                  ALARMS:Host restarted
                  {tssrv:system.uptime.last(0)}<600 Show all Show only last 100
                  Time Status Acknowledged Duration Sum %
                  2007.Jan.10 21:16:23 FALSE - 14.3 hours 14.3 hours 100%
                  2007.Jan.10 21:09:42 UNKNOWN - 6.7 mins 6.7 mins 0.77%
                  2006.Dec.11 18:20:08 FALSE - 30.1 days 30.7 days 99.98%
                  2006.Dec.11 18:13:23 TRUE - 6.8 mins 6.8 mins 0.02%

                  ALARMS:Agent is not collecting data
                  {tssrv:agent.ping.nodata(240)}=1 Show all Show only last 100
                  Time Status Acknowledged Duration Sum %
                  2007.Jan.11 08:36:55 FALSE - 3 hours 3 hours 100%
                  2007.Jan.10 21:20:47 TRUE - 11.3 hours 11.3 hours 78.83%
                  2007.Jan.10 21:16:46 FALSE - 4 mins 3.1 hours 21.54%
                  2007.Jan.10 21:16:23 TRUE - 23 secs 11.3 hours 78.47%
                  2007.Jan.10 21:16:18 UNKNOWN - 5 secs 5 secs 0.01%
                  2007.Jan.10 21:12:16 TRUE - 4 mins 11.3 hours 78.56%
                  2007.Jan.10 21:10:16 FALSE - 2 mins 3.1 hours 21.61%
                  2007.Jan.10 21:09:42 UNKNOWN - 34 secs 39 secs 0.07%
                  2006.Dec.11 18:13:40 FALSE - 30.1 days 30.3 days 98.46%

                  Here is data from the Zabbix server:
                  Host uptime 11 Jan 11:30:12 2m19d2h11m52s

                  ALARMS:Host restarted
                  {sitewatch:system.uptime.last(0)}<600 Show all Show only last 100
                  Time Status Acknowledged Duration Sum %
                  2006.Nov.23 11:48:49 FALSE - 49 days 49 days 100%

                  Heres another server, its triggers went to UNKNOWN at 2007.Jan.10 21:10:22 also, it also has not rebooted in this timeframe:
                  ALARMS:Host restarted
                  {imss:system.uptime.last(0)}<600 Show all Show only last 100
                  Time Status Acknowledged Duration Sum %
                  2007.Jan.10 21:15:54 FALSE - 14.5 hours 14.5 hours 100%
                  2007.Jan.10 21:10:22 UNKNOWN - 5.5 mins 5.5 mins 0.63%
                  2007.Jan.10 15:36:04 FALSE - 5.6 hours 20.1 hours 99.54%


                  Thanks Alexei.

                  Comment

                  Working...