Help get recovery expression to work.

[toj]

Hi

Version: Zabbix 6lts

Im trying to auto resolve problem if count of item values the last 2min is less that one(1).

My recovery expression,
count(/Zabbix server/log[/var/log/my.log],2m,"regexp","ERROR")<1

Also tried find & nodata.... but no cigar there either.

find(/Zabbix server/log[/var/log/my.log],2m,"like","ERROR")=0
nodata(/Zabbix server/log[/var/log/my.log],2m)=1

Any help here to what im missing/not getting will be much appreciated.

[cyber]

What's your problem expression?
I am getting a bit tired of writing this so many times already.... but do you remember, that recovery expression is ADDITIONAL condition that has to calculate to TRUE after your problem expression is calculated to FALSE. It is not separate expression that just cancels problem... If your initial problem has not calculated to false, then your recovery is ignored. If your problem is calculated to false, then problem stays open until recovery is calculated to true...

https://www.zabbix.com/documentation...iggers/trigger

Recovery expression

Logical expression (optional) defining additional conditions that have to be met before the problem is resolved, after the original problem expression has already been evaluated as FALSE. Recovery expression is useful for trigger hysteresis. It is not possible to resolve a problem by recovery expression alone if the problem expression is still TRUE. This field is only available if 'Recovery expression' is selected for OK event generation.

[cyber]

What's your problem expression?
I am getting a bit tired of writing this so many times already.... but do you remember, that recovery expression is ADDITIONAL condition that has to calculate to TRUE after your problem expression is calculated to FALSE. It is not separate expression that just cancels problem... If your initial problem has not calculated to false, then your recovery is ignored. If your problem is calculated to false, then problem stays open until recovery is calculated to true...

https://www.zabbix.com/documentation...iggers/trigger

Recovery expression

Logical expression (optional) defining additional conditions that have to be met before the problem is resolved, after the original problem expression has already been evaluated as FALSE. Recovery expression is useful for trigger hysteresis. It is not possible to resolve a problem by recovery expression alone if the problem expression is still TRUE. This field is only available if 'Recovery expression' is selected for OK event generation.

[toj]

Well i can understand that because this was precisely what i was trying to achieve, "recovery" with recovery expression.

Thanks for your time.

[GarrettCO]

I am looking at the same issue where using the find() to look for regex expressions within a certain period of time. When I read the hysteresis explanation it sounds like when a problem is triggered from a SNMP trap using find(), there is not a way to "hold" that for certain period waiting for the recovery expression to be TRUE. I am testing using a quicker time shift for recovery expression:

Problem:
find(/xxxxxxxxxxx/snmptrap["sysUpTimeInstance"],3m,"regexp","\bUnReachable\b")=0

Recovery:
find(/xxxxxxxxxxx/snmptrap["sysUpTimeInstance"],1m,"regexp","\bReachable\b")=1