1

Testing Zabbix Trigger Expressions

 2 years ago
source link: https://blog.jakubholy.net/2012/07/02/testing-zabbix-trigger-expressions/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

Testing Zabbix Trigger Expressions

July 2, 2012
When defining a Zabbix (1.8.2) trigger e.g. to inform you that there are errors in a log file, how do you verify that it is correct? As somebody recommended in a forum, you can use a Calculated Item with a similar expression (the syntax is little different from triggers). Contrary to triggers, the value of a calculated item is easy to see and the historical values are stored so you can check how it evolved. If your trigger expression is complex the you can create multiple calculated items, one for each subexpression.

Example

If we have a log item that sends us data whenever the text "ERROR" appears in a log line and the corresponding trigger expected to fire if we have got any data from the item in the last 600 sec (nodata() returns 1 if there indeed was no data):
{hive.example.com:log["/tmp/ada/hive.log","ERROR",,20].nodata(600)}=0


Then we could test it with a calculated item with the expression
nodata("hive.example.com:log[\"/tmp/ada/hive.log\",\"ERROR\",,20]", 600)


(Notice that the function comes first, taking the host:item as its 0th parameter and that this is enclosed with "", escaping any nested " with \.)

The value of the calculated item will be re-checked every <update interval> (independent on whether the source item changed or not) and stored, in this case it will either thave the value of 0 or 1. We can also construct more complex expressions with &, + etc. similarly to trigger expressions.

Are you benefitting from my writing? Consider buying me a coffee or supporting my work via GitHub Sponsors. Thank you! You can also book me for a mentoring / pair-programming session via Codementor or (cheaper) email.

Allow me to write to you!

Let's get in touch! I will occasionally send you a short email with a few links to interesting stuff I found and with summaries of my new blog posts. Max 1-2 emails per month. I read and answer to all replies.


About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK