Zabbix trigger math

I have a number of more complex or compound triggers in my Zabbix environment.  I regularly create trigger expressions using OR ( | ) to test for multiple conditions.  It makes me feel better that I can watch for a particular value in a result as well as whether no data has been received by the Zabbix server and alert accordingly.

I recently had a request to monitor the number of results in a log file.  If this results number dropped by, say, 10 percent since the last check then the trigger should fire an alert.  I wasn’t quite sure how to accomplish this so I visited the Zabbix Triggers page once again.  Usually, I reference the functions section but the expression operators section caught my eye this time.

I knew that I was going to have to do some trigger math to solve my problem but I wasn’t even sure that it could be done.  I questioned the Mighty Zabbix and should have known better.  Mixed in with the well-known OR, AND, less than, and greater than is the ability to use addition, subtraction, multiplication, and division in your trigger expressions.  Exactly what I needed.

The trigger ended up being this simple.  We all learned this type of arithmetic in grade school.

({Host_1:item_A.last(0)}/{Host_1:item_A.prev(0)})<0.90

This trigger basically says, take the current result (last) divided by the last result (prev) and if it is less than .90 (a 10%+ change since the last result) the trigger is true.

This is exactly what I was looking for.  I added an OR that checked for no data over the last 10 minutes for additional monitoring and I was all set.

| {Host_1:item_A.nodata(600)}=1

This trigger math will come in handy in the future for sure.  I may even look through some of my triggers to see which ones may be improved by different logic.

Give this trigger arithmetic a try when you have a chance.  I’m sure you’ll find it as helpful as I did.

 

Advertisements

5 Comments on “Zabbix trigger math”

  1. Authex says:

    You know, its funny. Zabbix is such a great tool, but I’m having a tough time understanding the triggers. Would you happen to know how to change the default Windows OS template’s low file system alert from 20% to 10%?

    • Chris says:

      Authex,

      Super simple,

      – go to Configuration – Templates – Template_OS_Windows
      – Select the Discovery link, then in the Mounted Filesystem Discovery row, click Trigger prototypes
      – Click on the ‘free disk space…’ name and you’ll be able to change the 20 to a 10

      {Template OS Windows:vfs.fs.size[{#FSNAME},pfree].last(0)}<20

      becomes

      {Template OS Windows:vfs.fs.size[{#FSNAME},pfree].last(0)}<10

      Save and you’re good to go.

  2. Costel Olteanu says:

    Thanks so much it worked for me!!


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s