Need help with wrong Zabbix event content

[AndreyOleyneek]

Hello everyone,

Need your help or suggestion.
I have several configured triggers to monitor if disk space is critically low or not. We use Zabbix event API to receive this information.
There are 2 types of events (eventStatus parameter): 'Problem' or 'Resolved'

For 'Problem' event all values I get look correct and consistent (you can see from the log below for EventOpData param):
{"URL":"https://example.com/api/v1/service-monitoring/zabbix-events","HTTPProxy":"","To":"https://example.com/api/v1/service-monitoring/zabbix-events","Subject":"Problem: Profiles(E: Disk space is critically low (used > 5%)","Message":"Problem started at 19:12:32 on 2025.08.22\r\nProblem name: Profiles(E: Disk space is critically low (used > 5%)\r\nHost: AC-test-cononly--ac-ci-dc-9lmx9j\r\nSeverity: Average\r\nOperational data: Space used: 90.78 MB of 1022.93 MB (8.87 %)\r\nOriginal problem ID: 852716\r\n","EventId":"852716","EventName":"Profil es(E: Disk space is critically low (used > 5%)","EventOpData":"Space used: 90.78 MB of 1022.93 MB (8.87 %)","EventStatus":"PROBLEM","EventTagJson":"[{"tag":"scope","value":"capacity"},{"tag\ ":"component","value":"storage"},{"tag":" filesystem","value":"E:"},{"tag":"jbbf_env ","value":"test"}]","ItemId":"184586","ItemKey":"vfs.fs.size[E:,pused]","ItemKeyOrigin":"vfs.fs.size[E:,pused]","TriggerName":"Profiles(E: Disk space is critically low","TriggerNameOrigin":"Profiles(E: Disk space is critically low","WEBHOOK_KEY":"ss","EventDuration":"3s", "HostId ":"12787","HostName":"AC-test-cononly--ac-ci-dc-9lmx9j","EventValue":"1","ItemValue":"8.87 %","ItemLastValue":"8.87 %","ActionName":"webhook-trigger-actions--test1","ActionId":"11","EventObject":"0","ItemLast Value1":"8.87 %","ItemLastValue2":"1022.93 MB","ItemLastValue3":"90.78 MB","ItemLastValue4":"8.87 %","ItemLastValue5":"*UNKNOWN*","ItemLastValue6 ":" *UNKNOWN*","ItemLastValue7":"*UNKNOWN*","ItemLastV alue8":"*UNKNOWN*","ItemLastValue9":"*UNKNOWN*"}

For 'Resolved' event Space used value is wrong and looks like a bug (highlihted in red, image attached):
{"URL":"https:/example.com/api/v1/service-monitoring/zabbix-events","HTTPProxy":"","To":"https://example.com/api/v1/service-monitoring/zabbix-events","Subject":"Resolved in 9m 54s: Profiles(E: Disk space is critically low (used > 5%)","Message":"Problem has been resolved at 19:22:26 on 2025.08.22\r\nProblem name: Profiles(E: Disk space is critically low (used > 5%)\r\nProblem duration: 9m 54s\r\nHost: ExampleVM\r\nSeverity: Average\r\nOriginal problem ID: 852716\r\n","EventId":"852716","EventName":"Profil es(E: Disk space is critically low (used > 5%)","EventOpData":"Space used: 90.78 MB of 1022.93 MB (1.65 %)","EventStatus":"RESOLVED","EventTagJson":"[{"tag":"scope","value":"capacity"},{"tag\ ":"component","value":"storage"},{"tag":" filesystem","value":"E:"},{"tag":"jbbf_env ","value":"test"}]","ItemId":"184586","ItemKey":"vfs.fs.size[E:,pused]","ItemKeyOrigin":"vfs.fs.size[E:,pused]","TriggerName":"Profiles(E: Disk space is critically low","TriggerNameOrigin":"Profiles(E: Disk space is critically low","WEBHOOK_KEY":"ss","EventDuration":"9m 54s","HostId":"12787","HostName":"AC-test-cononly--ac-ci-dc-9lmx9j","EventValue":"0","ItemValue":"1.65 %","ItemLastValue":"1.65 %","ActionName":"webhook-trigger-actions--test1","ActionId":"11","EventObject":"0","ItemLast Value1":"1.65 %","ItemLastValue2":"1022.93 MB","ItemLastValue3":"90.78 MB","ItemLastValue4":"1.65 %","ItemLastValue5":"*UNKNOWN*","ItemLastValue6 ":" *UNKNOWN*","ItemLastValue7":"*UNKNOWN*","ItemLastV alue8":"*UNKNOWN*","ItemLastValue9":"*UNKNOWN*"}

For Resolved event percentage returned is correct, but 'Space used' value seems not updated since the previous Problem event.


Maybe you can help how to wrokaround or should I report this in Bug report menu?

Thanks in advance for the response! Ready to provide more information on this case.

[cyber]

Let me guess... you are using multiple item values in your trigger to construct that event name, but the only actual calculation is done based on "pused" ?
All triggers are recalculated every time when any of used items receives a new value. So when your "pused" receives a new value, other ones may still not have received.. and as your trigger is calculated to false, it just sends those last values, what it has... They can be milliseconds apart. But they will be displayed "as on the recalculation moment"..

[AndreyOleyneek]

I was able to resolve this issue. Mostly due to:
1) I changed 'Operational data' parameter from:
OLD: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})'
NEW: 'Space used: {ITEM.VALUE3} of {ITEM.VALUE2} ({ITEM.VALUE1})'
2) Additionally, I adjusted the expression:
OLD: last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and
((last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or timeleft(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
NEW: 'min(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],2m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and
((min(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},total],2m)-min(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},used],2m))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)'

And finally "ItemLastValue3" hast started to bring the correct value.