CODEWITHSUNDEEP
zabbix
bur
bur

Reputation: 11

Zabbix icmpping issue

I am running Zabbix 3.2 on Debian Jessie. Installation runs smooth and I am able to monitor some public IP using simple check. My problem is even though the IP is down, I still see it as up in my Map. Below is my configuration for the IP:

Host name: 192.168.50.14

Visible name: Wifi 4

Groups: VLAN 17

Agent interfaces: 192.168.50.14 (IP)

In "items":

Name: Ping Wifi 4

Type: Simple check

Key: icmppingsec

In "triggers":

Name: icmp_ping_trigger_wifi_4

Problem expression:

({TRIGGER.VALUE}=0 and {192.168.50.14:icmppingsec.last(0)}=0)

Recovery expression:

({TRIGGER.VALUE}=1 and {192.168.50.14:icmppingsec.last(0)}<100)

However, I am still seeing that the IP (192.168.50.14) is up even though that it is down. Is there anything I left out for simple ICMP ping?

Thanks in advance.

Bur

Upvotes: 1

Views: 3557

Answers (1)

Richlv
Richlv

Reputation: 4153

For the new separation of problem/recovery expressions in 3.2, you don't have to use the TRIGGER.VALUE macros/variables - remove everything up to and including and in both fields.

As for the expressions themselves, the combination does not seem to be very good. The recovery expression limits values to < 100. If the item goes 0-150, the trigger won't recover. If the item goes 0-50-150, it will recover and won't fire again. As a result you will have two sort of identical conditions but completely different trigger outcome. The purpose of the recovery expression might be to consider hosts with icmppingsec result above 100 as down, but that would be better achieved in the main expression. As a test, the trigger might work as expected if you completely remove the recovery expression.

As for determining whether the host is considered to be up or down in a general case, always check the item values, only use triggers as indicators to investigate. In this case, if item values are 0, the host is considered to be down. If the item values are above 0, the host is considered to be up (but your trigger could still alert if it takes longer than expected to ping the host).

Upvotes: 0

Related Questions