Recovering problems with change function and throttling preprocessing

[iprok]

Hello! I have trigger with function "change(/StorageAlpha/smart.disk.attribute.reallocated_sector_ct[sdw sat])>0" the item used has "Discard if unchanged with heartbeet (6h)" preprocessing and 1m interval. The trigger with "OK event generation" set to "Expression" worked as expected closing the problems in >= 6h hours. I had supposed that using "nodata(/StorageAlpha/smart.disk.attribute.reallocated_sector_ct[sdw sat],5m)=1" will close the trigger in 5m in case of no further changes. But it closes in 6h5m usually and sometimes (rarely) in even more time. And I stopped understanding its logic completely.

Please explain how nodata works with the throttling rule and why it works as described and my situation? And is it possible to close it quicker that 6h without changing throttling rule?

[cyber]

change>0 works only if your values are growing. It is not a 0|1 answer, changed|not changed, it is a amount of difference... thus >0 must be a positive number... if it goes 1->0, change is -1. You can use "abs" funtion to make it non-negative. Then each change can be calculated with >0 (abs(change(/host/item))>0

trigger can be caclulated only if there is a incoming value. if you discard item values for 6h, there can be no trigger calculation.

[iprok]

trigger can be caclulated only if there is a incoming value. if you discard item values for 6h, there can be no trigger calculation.

But is it usually closed on 6h5m ? I though that is literally IS data on 6h and the trigger isn't counted afterwards. That's what I'm confused with.

[cyber]

you said "I had supposed that using "nodata(/StorageAlpha/smart.disk.attribute.reallocated_sector_ct[sdw sat],5m)=1" will close the trigger in 5m"
Was that in recovery expression?
thats the 5m after 6h kicking in there, I think.. recovery expression is considered only after initial expression calculates to false... so you get your value... your trigger fires.. you keep back values for 6h ... now "heartbeat value" comes in, change is not >0 any more... trigger calculates to false.... but is not closed as you have recovery expression there... after 5m you have not received any new data (discarded) and event is closed now by nodata.

I think I overlooked in my previous answer that part, that in case your trigger was was active and you receive same value (heartbeat in 6h) or smaller (change in value), your expression is not true any more... there is 0 change or negative change... both are not ">0"... so your trigger reclaculates to false and then nodata comes in 5m and recovers it... Somehow I think that if all your events are closed in 6h5m, yuor initial failure condition is still valid... thus that trigger should not be closed...

Someone say I'm wrong... I have had day full of meeting, so my head already spins... might not think straight any more...