Fake alerts

[TShepitko]

Hi,

I am receiving fake alerts from Zabbix that there is a problem, but actually trigger in OK state. What can cause this issue?

[Mechanix]

Please post your trigger configuration.

[TShepitko]

{host:proc.num[voipmonitor].min(#3)}<1

[Mechanix]

{host:proc.num[voipmonitor].min(#3)}<1

OK, so the triggers fires if the value of voipmonitor is <1 after 3 cycles. What is the normal state/value of the item?

You should consider "trigger hysterisis" to avoid false/flapping triggers

http://blog.zabbix.com/no-more-flapping-define-triggers-the-smart-way/1488/

[TShepitko]

You didn't understand me. My trigger is not flapping from PROBLEM to OK state back and forth. Trigger is in OK state without flapping for the last 24 hours, but I am still receiving notifications every one hour.

[Mechanix]

What value do you see for that item in "Monitoring -> Latest Data"?

[TShepitko]

The value is one (number of running voipmonitor processes). I suspect that I am receiving notifications every one hour because zabbix-server think that trigger in PROBLEM state (it is how escalation works in Zabbix), but actually at the server and at web panel I see trigger in OK state. So I do not understand where is the problem

[allexpetrov]

Could you show the Action of that trigger, please ?

[TShepitko]

zabbix=> select actionid from actions where name='Linux admins other hosts';
actionid
----------
64
(1 строка)

zabbix=> select eventsource from actions where name='Linux admins other hosts';
eventsource
-------------
0
(1 строка)

zabbix=> select evaltype from actions where name='Linux admins other hosts';
evaltype
----------
3
(1 строка)

zabbix=> select status from actions where name='Linux admins other hosts';
status
--------
0
(1 строка)

zabbix=> select esc_period from actions where name='Linux admins other hosts';
esc_period
------------
3600
(1 строка)

zabbix=> select def_shortdata from actions where name='Linux admins other hosts';
def_shortdata
----------------------------------
{TRIGGER.STATUS}: {TRIGGER.NAME}
(1 строка)

zabbix=> select def_longdata from actions where name='Linux admins other hosts';
def_longdata
--------------------------------------------------------
Trigger: {TRIGGER.NAME}\r +
Trigger status: {TRIGGER.STATUS}\r +
Trigger severity: {TRIGGER.SEVERITY}\r +
Trigger URL: {TRIGGER.URL}\r +
Action name: Linux admins other hosts\r +
\r +
{ITEM.NAME1} ({HOST.NAME1}:{ITEM.KEY1}): {ITEM.VALUE1}
(1 строка)

zabbix=> select recovery_msg from actions where name='Linux admins other hosts';
recovery_msg
--------------
1
(1 строка)

zabbix=> select r_shortdata from actions where name='Linux admins other hosts';
r_shortdata
----------------------------------
{TRIGGER.STATUS}: {TRIGGER.NAME}
(1 строка)

zabbix=> select r_longdata from actions where name='Linux admins other hosts';
r_longdata
--------------------------------------------------------
Trigger: {TRIGGER.NAME}\r +
Trigger status: {TRIGGER.STATUS}\r +
Trigger severity: {TRIGGER.SEVERITY}\r +
Trigger URL: {TRIGGER.URL}\r +
Action name: Linux admins other hosts\r +
\r +
{ITEM.NAME1} ({HOST.NAME1}:{ITEM.KEY1}): {ITEM.VALUE1}
(1 строка)

zabbix=> select formula from actions where name='Linux admins other hosts';
formula
-------------------------------------------------------------------------------------------------------------------------------------------------
{492} and {493} and {494} and {495} and {496} and {523} and {528} and {606} and {607} and {613} and ({620} or {621} or {636} or {665} or {702})
(1 строка)

[Mechanix]

Try this one:

({TRIGGER.VALUE}=0 and {host:proc.num[voipmonitor].last(#3)}=1) or ({TRIGGER.VALUE}=1 and {host:proc.num[voipmonitor].last(#3)}<1)