Zabbix triggers use tutorial detailed

First, create triggers
Triggers can be associated with a template, or it can be associated with a host. That is, when you create the template, you set the appropriate trigger. The host associated with the template also has a trigger associated with it, and once the condition is met the corresponding operation (such as the alarm) can be considered as global; the trigger associated with the host is a localized trigger, which is only valid for the specially set host. is not valid for other hosts.

For the difference between global and localized triggers, it can be configured trigger in the hosts under configuration, or trigger can be configured in Tmplates under configuration. Regardless of the configuration, the interface is similar to the following:

As shown in the figure above, you can complete the addition of a trigger by saving and enabling the name, condition, description, alarm level, and so on.

Second, the expression of trigger
The expression of the trigger is what is filled in the expression above, in the form of:

The code is as follows	Copy Code
{<server>:<key>.<function> (<parameter>)}<operator><constant>

Take the screenshot above as an example, key is Icmppingloss, function function is min, parameter parameter value is 5 minutes, operator is greater than.

1. Time parameter

Zabbix trigger conditions, many of the unit time in the number of parameters to express the expression, which involves the common time units are as follows:

S-seconds (when used, works the same as the raw value)
M-minutes
H-hours
D-days
W-weeks
2, operator

operator corresponds to the operator part of an expression, the operators you can use are:

PRIORITY	OPERATOR	DEFINITION
1	/	Division
2	*	Multiplication
3	-	Arithmetical minus
4	+	Arithmetical Plus
5	<	Less than. The operator is defined as: A<b⇔ (a<=b-0.000001)
6	>	More than. The operator is defined as: A>b⇔ (a>=b+0.000001)
7	#	Not equal. The operator is defined as: A#b⇔ (a<=b-0.000001) | (a>=b+0.000001)
8	=	is equal. The operator is defined as: A=b⇔ (a>b-0.000001) & (a<b+0.000001)
9	&	Logical and
10	|	Logical OR

Example:

code is as follows

copy code

{www.zabbix.com:system.cpu.load[all,avg1].last (0)}>5 #系统负载大于5 {www.zabbix.com:system.cpu.load[all,avg1].last (0)}>5| {www.zabbix.com:system.cpu.load[all,avg1].min (10m)}>2 #cpu负载大于5或者最后10分钟负载大于2的时候都会报警. {Www.zabbix.com:vfs.file.cksum[/etc/passwd].diff (0)}>0 #/etc/passwd file change will alert {www.zabbix.com:net.if.in[eth0,bytes].min (5m)}>100k #在最后5分钟, the network card eth0 traffic is greater than 100K alarm {smtp1.zabbix.com:net.tcp.service[smtp].last (0)}=0&{smtp2.zabbix.com:net.tcp.service[smtp].last (0)}=0 #两个节点上的smtp服务都宕机才会报警, this expression takes two hosts {Zabbix.zabbix.com:icmpping.count (30m,0)}>5 #在最后30分钟主机不能ping通的次数大于5就报警 {server:system.cpu.load.avg (1h)}/{server:system.cpu.load.avg (1h,1d)}>2 ({TRIGGER. Value}=0&{server:temp.last (0)}>20) | ({TRIGGER. Value}=1&{server:temp.last (0)}>15)

Refer to the official documentation above.

Third, expression function
The expression function is also a part of the expression, but the content is more, here is a separate summary.

Abschange

Parameters: Ignoring
Support Type: Float,int,str,text,log
Function: Returns the absolute value of the most recent and previously obtained value, for string type: 0 for equality, 1 for different
Avg

Parameters: Seconds or #num
Support Type: Float,int
Function: Returns the average of a period of time
Example:

AVG (5): Average of the last 5 seconds

AVG (#5): Represents the average value of the last 5 times

AVG (3600,86400): Represents the average of one hours before a day

If there is only one argument that represents the average of the specified time, from now on, if there is a second argument that represents drift, start counting the time before the second argument,

#n表示最近n次的值

Max

Parameters: Seconds or #num

Support value type: Float,int

Description: Returns the maximum value for the specified time interval. The time interval is the number of seconds or collection of values (prefixed with #) that can be the first argument. Starting with Zabbix1.8.2, the function supports the second optional parameter time_shift, and you can view the AVG () function to obtain its usage.

Min

Parameters: Seconds or #num

Support value type: Float,int

Description: Returns the minimum value for the specified time interval. The time interval is the number of seconds or collection of values (prefixed by #) as the first argument. Starting with Zabbix1.8.2, the function supports the second optional parameter time_shift, and you can view the AVG () function to get its usage.

Sum

Parameters: Seconds or #num

Support value type: Float,int

Description: Returns the sum of the values collected in the specified time interval. The time interval is the number of seconds or collection values (starting with #) that are supported by the first parameter. Starting with Zabbix1.8.2, this function supports Time_shift as the second argument. You can view the AVG function to get its usage

Change

Parameters: Ignoring
Support Type: Float,int,str,text,log
Function: Returns the difference between the recently obtained value and the previously obtained value, for string 0 for equality, and 1 for different
Example:

Change (0) >n: Ignore parameter General input 0, indicates the difference between the recently obtained value and the previous value is greater than n

Count

Parameters: Seconds or #num
Support Type: Float,int,str,text,log
Function: Returns the statistics for the values in the specified time interval.
Example:

COUNT (600) Gets the number of values in the last 10 minutes
Count (600,12) the number of values in the last 10 minutes equals 12
Count (600,12, "GT") the number of values obtained in the last 10 minutes is greater than 12
Count (#10,, "GT") the last 10 values, the number of values greater than 12
Count (600,12, "GT", 86400) the number of values greater than 12 in 10 minutes before 24 hours
Count (600,6/7, "band")-thenumberofvaluesforlast10minuteshaving ' inthe3leastsignificantbits ' (inbinary).
Count (,,, 86400) The number of 10-minute data values before 24 hours
First parameter: Specify a time period

Second parameter: Sample data

Third parameter: Operation parameter

Fourth parameter: Drift parameter

#支持的操作类型
EQ: Equal
NE: Not Equal
GT: Greater Than
GE: greater Than or equal
LT: less than
Le: less than or equal
Like: Content matching
Diff

Parameters: Ignoring
Support value type: Float,int,str,text,log
Function: The return value of 1 indicates that the nearest value is different from the previous value, and 0 is the other case
Last

Parameters: Seconds or #num
Support value type: Float,int,str,text,log
Function: The most recent value, if seconds, is ignored, #num表示最近第N个值, note that the current #num and some other functions of the #num meaning is different
Example:

Last (0) is equivalent to (#1)

Last (#3) represents the most recent 3rd value (not the nearest three) This function also supports the second argument time_shift, such as Last (0,86400) returns the nearest value a day ago
If multiple values exist in the same second in history, Zabbix does not guarantee a precise order of values
#num从Zabbix1.6.2 Start Support, timeshift from 1.8.2 its start support, you can query Avg () function to obtain its use method

Logeventid

Parameters: String

Support Value type: Log

Description: Checks to see if the EventID of the most recent log entry matches the regular expression. The parameter is a regular expression, POSIX extends the style. When the return value is 0, it does not match, and 1 indicates a match. This function is supported from the beginning of the Zabbix1.8.5.

LogSeverity

Parameters: Ignoring

Support Value type: Log

Description: Returns the log level (logseverity) of the most recent log entry. When the return value is 0, the default level is represented, n is the specific corresponding rank (integer, commonly used in windowseventlogs). The Zabbix log level is derived from the information column of Windowseventlog.

Logsource

Parameters: String

Support Value type: Log

Description: Checks whether the most recent log entry matches the log source of the parameter. When the return value is 0, the mismatch is indicated, and 1 indicates a match. The pass field is used for windowseventlogs monitoring. For example logsource["Vmwareserver"]

Prev

Parameters: Ignoring

Support value type: Float,int,str,text,log

Description: Returns the previous value, similar to last (#2)

Regexp

Parameters: The first argument is string, and the second parameter is seconds or #num

Support value type: Str,log,text

Description: Checks to see if the nearest value matches the regular expression, the parameter's regular expression is POSIX-extended, the second parameter is seconds or the number of collected values, and multiple values are processed. This function is case-sensitive. When the return value is 1, it is found, and 0 is the other.

Str

Parameters: The first argument is string, and the second parameter is seconds or #num

Support value type: Str,log,text

Description: Finds a string in the most recent value. The first parameter specifies the string to find, case sensitive. The Second optional parameter specifies the number of seconds or collection of values, and multiple values will be processed. When the return value is 1, it is found, and 0 is the other.

Strlen

Parameters: Seconds or #num

Support value type: Str,log,text

Description: Specifies the string length (not bytes) of the most recent value, and the parameter value is similar to the last function. For example strlen (0) is equivalent to strlen (#1), strlen (#3) represents the most recent third value, strlen (0,86400) Represents the most recent value from a day ago. This function starts from the Zabbix1.8.4 support

Time

Parameters: Ignoring

Support value type: any

Description: Returns the current time, formatted as HHMMSS, for example 123055

Date

Parameters: Ignoring
Support Type: any
Function: Returns the current time, format YYYYMMDD
DayOfMonth

Returns the day ordinal of the current month

DayOfWeek

Returns the current day of the week

Delta

Parameters: Seconds or #num
Support Type: Float,int
Function: Returns the difference between the maximum and the minimum in the time interval
NoData

Parameters: Seconds

Support value type: any

Description: When the return value of 1 indicates that the specified interval (interval should not be less than 30 seconds) does not receive the data, 0 represents the other.

Now

Parameters: Ignoring

Support value type: any

Description: Returns the number of seconds from the epoch (January 1, 1970 00:00:00UTC) time

Fuzzytime

Parameters: SEC
Supports value types: Float,int
Effect: The return value of 1 indicates that the timestamp of the monitor item value is more than n seconds for the zabbixserver time. 0 for others. Often use System.localtime to check whether local time is the same as zabbixserver time.