nodata() not working as trap recovery expression

[stevencnz]

I am trying to configure trapping within Zabbix to adhere to the following logic:

• TRAP comes in to indicate a problem (interface down or something): TRIGGER moves to problem state.
  
• TRAP comes in to resolve the issue (interface up notification): TRIGGER resolves after 120s of not receiving any further traps.

This is done to prevent interfaces that are constantly flapping from resolving when they shouldn't. I'm using a recovery expression to attempt this. The details are as follows:

PROBLEM
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].str(Link down)}=1

RECOVERY
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].nodata(120)}=1

In my tests, the trigger will go off when I manually shut down an interface. However after I unshut the interface, it never recovers. Can anyone see any reason why this logic doesn't work?

As a side note, if I use nodata(120) in the PROBLEM statement

eg.
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].str(Link down)}=1
and
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].nodata(120)}=1

everything works fine... I shut down the interface and it takes 2 minutes before it triggers.

[ovas]

Hello stevencnz!

PROBLEM
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].str(Link down)}=1

RECOVERY
{snmptrap["Link (down|up) on interface {#SNMPINDEX} "].nodata(120)}=1

Say please, does the recovery message indeed arrive at the snmptrap item? In the configuration I quoted, trigger expression will still be active even if there is no fresh data 120+ seconds. Meaning the last message is Link down, therefore there is a problem. Recovery expression will not override the problem expression.

[stevencnz]

Hi Ovas,

Yes I can confirm that the trap stating that the interface is up, is indeed received. I have another trigger configured alongside this one that does not have a recovery expression. When the interface comes back up I can see that the trigger without the recovery expression moves to an OK state.

Plus I can see the trap incoming on the logs of the proxy.