[comment]: # ({188108fa-226b9489}) # 1 Trigger examples This page is a collection of trigger examples. Examples are sorted by use case: - [Unavailable host](#detect-unavailable-host) - [Unavailable proxy](#detect-unavailable-proxy) - [Unavailable SMTP cluster](#detect-unavailable-smtp-cluster) - [Unreachable host](#detect-unreachable-host) - [Unexpected reboot](#detect-unexpected-reboot) - [Changes in important files](#detect-changes-in-important-files) - [Changes in DNS query](#detect-changes-in-dns-query) - [Non-matching software on different hosts](#detect-non-matching-software-on-different-hosts) - [Unsynchronized clocks](#detect-unsynchronized-clocks) - [Outdated agent](#detect-outdated-agent) - [Flapping interface](#detect-flapping-interface) - [High incoming traffic](#detect-high-incoming-traffic) - [Low disk space](#detect-low-disk-space) - [Low disk space (dynamic threshold)](#detect-low-disk-space-dynamic-threshold) - [High CPU load](#detect-high-cpu-load) - [CPU load comparison](#compare-cpu-loads) - [Long-term CPU load comparison](#compare-cpu-loads) - [String containing special characters](#detect-string-containing-special-characters) [comment]: # ({/188108fa-226b9489}) [comment]: # ({2116104b-1b661572}) ##### Detect unavailable host ```default max(/host/zabbix[host,agent,available],5m)=0 ``` This trigger fires if Zabbix agent on the host has been unavailable for 5 minutes.
Function: [`max`](/manual/config/triggers/expression/aggregate#max)
Data item: [`zabbix[host,agent,available]`](/manual/config/items/itemtypes/internal#host.available) Alternative: ```default nodata(/host/agent.ping,5m)=1 ``` This trigger fires if no data has been received from Zabbix agent for 5 minutes.
Function: [`nodata`](/manual/config/triggers/expression/history#nodata)
Data item: [`agent.ping`](/manual/config/items/itemtypes/zabbix_agent#agent.ping) [comment]: # ({/2116104b-1b661572}) [comment]: # ({fedc75b0-de5361b9}) ##### Detect unavailable proxy ```default fuzzytime(/host/zabbix[proxy,{$PROXY_NAME},lastaccess],1m)=0 ``` This trigger fires if Zabbix proxy data lags behind Zabbix server time by 1 minute.
Function: [`fuzzytime`](/manual/config/triggers/expression/history#fuzzytime)
Data item: [`zabbix[proxy,{$PROXY_NAME},lastaccess]`](/manual/config/items/itemtypes/internal#proxy) [comment]: # ({/fedc75b0-de5361b9}) [comment]: # ({a2a7ab26-7956e04e}) ##### Detect unavailable SMTP cluster ```default last(/smtp1.example.com/net.tcp.service[smtp])=0 and last(/smtp2.example.com/net.tcp.service[smtp])=0 ``` This trigger fires if both SMTP servers are down.
Function: [`last`](/manual/config/triggers/expression/history#last)
Data item: [`net.tcp.service`](/manual/config/items/itemtypes/simple_checks#nettcpservice) [comment]: # ({/a2a7ab26-7956e04e}) [comment]: # ({c2c339fa-567b88a9}) ##### Detect unreachable host ```default count(/host/icmpping,30m,,"0")>5 ``` This trigger fires if the host is unreachable by ping more than 5 times in the last 30 minutes.
Function: [`count`](/manual/config/triggers/expression/history#count)
Data item: [`icmpping`](/manual/config/items/itemtypes/simple_checks#icmpping) [comment]: # ({/c2c339fa-567b88a9}) [comment]: # ({e9862861-b356d712}) ##### Detect unexpected reboot ```default change(/host/system.uptime)<0 ``` This trigger fires if a negative change in the system uptime value is encountered (indicating a reboot).
Function: [`change`](/manual/config/triggers/expression/history#change)
Data item: [`system.uptime`](/manual/config/items/itemtypes/zabbix_agent#system.uptime) [comment]: # ({/e9862861-b356d712}) [comment]: # ({1ee22f8b-49592749}) ##### Detect changes in important files ```default last(/host/vfs.file.cksum[/etc/passwd],#1)<>last(/host/vfs.file.cksum[/etc/passwd],#2) ``` This trigger fires if `/etc/passwd` has been changed. The expression is true when the previous `/etc/passwd` checksum differs from the most recent one. Similar expressions could be useful to monitor changes in important files, such as `/etc/passwd`, `/etc/inetd.conf`, `/kernel`, etc.
Function: [`last`](/manual/config/triggers/expression/history#last)
Data item: [`vfs.file.cksum`](/manual/config/items/itemtypes/zabbix_agent#vfs.file.cksum) [comment]: # ({/1ee22f8b-49592749}) [comment]: # ({7df0f916-c2b4949f}) ##### Detect changes in DNS query ```default last(/Zabbix server/net.dns.record[192.0.2.1,{$WEBSITE_NAME},{$DNS_RESOURCE_RECORD_TYPE},2,1])<>"{$WEBSITE_NAME} {$DNS_RESOURCE_RECORD_TYPE} 0 mail.{$WEBSITE_NAME}" ``` Notice the quotes around the second operand. This trigger fires if the query result is not equal to what it normally returns: ```default example.com MX 0 mail.example.com ``` Function: [`last`](/manual/config/triggers/expression/history#last)
Data item: [`net.dns.record[192.0.2.1,{$WEBSITE_NAME},{$DNS_RESOURCE_RECORD_TYPE},2,1]`](/manual/config/items/itemtypes/zabbix_agent#net.dns.record), with macros defined as: ```default {$WEBSITE_NAME} = example.com {$DNS_RESOURCE_RECORD_TYPE} = MX ``` [comment]: # ({/7df0f916-c2b4949f}) [comment]: # ({0fc019ff-adfc6b9d}) ##### Detect non-matching software on different hosts ```default last(/host/vfs.file.contents[/etc/os-release])<>last(/host2/vfs.file.contents[/etc/os-release]) ``` This trigger fires if the Ubuntu version is different on different hosts. Note how operands here are functions that return strings.
Function: [`last`](/manual/config/triggers/expression/history#last)
Data item: [`vfs.file.contents`](/manual/config/items/itemtypes/zabbix_agent#vfs.file.contents) [comment]: # ({/0fc019ff-adfc6b9d}) [comment]: # ({101c1203-0e6bfc51}) ##### Detect unsynchronized clocks ```default fuzzytime(/host/system.localtime,10s)=0 ``` The trigger fires if the client local time and Zabbix server time differs by more than 10 seconds.
Function: [`fuzzytime`](/manual/config/triggers/expression/history#fuzzytime)
Data item: [`system.localtime`](/manual/config/items/itemtypes/zabbix_agent#system.localtime) Note that [`system.localtime`](/manual/config/items/itemtypes/zabbix_agent#systemlocaltime) must be configured as a [passive check](/manual/appendix/items/activepassive#passive-checks) for Zabbix agent; on Zabbix agent 2 it may be configured as an active check. [comment]: # ({/101c1203-0e6bfc51}) [comment]: # ({108d71c4-62cfb014}) ##### Detect outdated agent ```default find(/host/agent.version,,"like","beta")=1 ``` This trigger fires if Zabbix agent has beta version. Zabbix agent needs to be upgraded.
Function: [`find`](/manual/config/triggers/expression/history#find)
Data item: [`agent.version`](/manual/config/items/itemtypes/zabbix_agent#agent.version) [comment]: # ({/108d71c4-62cfb014}) [comment]: # ({b4fdf283-3f25a585}) ##### Detect flapping interface ```default changecount(/host/vfs.file.contents["/sys/class/net/eth0/operstate"],1h)>5 ``` This trigger fires if the operational state (up/down/unknown) of `eth0` has changed more than 5 times in an hour.
Function: [`changecount`](/manual/config/triggers/expression/history#changecount)
Data item: [`vfs.file.contents`](/manual/config/items/itemtypes/zabbix_agent#vfs.file.contents) [comment]: # ({/b4fdf283-3f25a585}) [comment]: # ({984a4c2f-46e72843}) ##### Detect high incoming traffic ```default min(/host/net.if.in[eth0,bytes],5m)>100K ``` This trigger fires if the number of received bytes on `eth0` within the last five minutes was always over 100 kilobytes. Someone is probably downloading a large file.
Function: [`min`](/manual/config/triggers/expression/aggregate#min)
Data item: [`net.if.in[eth0,bytes]`](/manual/config/items/itemtypes/zabbix_agent#net.if.in) [comment]: # ({/984a4c2f-46e72843}) [comment]: # ({2e223320-bddf0717}) ##### Detect low disk space ```default max(/host/vfs.fs.size[/,free],5m)<10G ``` The trigger fires if free disk space is consistently (5 minutes) below 10 GB. You can also define a recovery expression: ```default min(/host/vfs.fs.size[/,free],10m)>40G ``` The problem gets **resolved** only when free disk space is consistently (10 minutes) above 40 GB.
Function: [`min`](/manual/config/triggers/expression/aggregate#min)
Data item: [`vfs.fs.size`](/manual/config/items/itemtypes/zabbix_agent#vfs.fs.size) [comment]: # ({/2e223320-bddf0717}) [comment]: # ({e2a732dc-bb0f5278}) ##### Detect low disk space (dynamic threshold) ```default last(/template/hrStorageFree[{#SNMPVALUE}]) [comment]: # ({/e2a732dc-bb0f5278}) [comment]: # ({643d3a74-17b607dc}) ##### Detect high CPU load ```default last(/host/system.cpu.load[all,avg1])>5 ``` The trigger fires when the average processor load has been above 5 for one minute. Variations: ```default min(/host/system.cpu.load[all,avg1],5m)>2 and time()<060000 ``` ```default min(/host/system.cpu.load[all,avg1],5m)>2 and not (dayofweek()=7 and time()>230000) and not (dayofweek()=1 and time()<010000) ``` Such triggers analyze 5 minutes of data and trigger only if CPU load is never under 2. Additionally, these triggers fire: - only at night time (00:00-06:00) - at any time except for 2 hours on week change (Sunday, 23:00 - Monday, 01:00) ```default (last(/host/system.cpu.load[all,avg1])>5) + (last(/host2/system.cpu.load[all,avg1])>5) + (last(/host3/system.cpu.load[all,avg1])>5)>=2 ``` This trigger fires if the processor load is too high on at least two of the three hosts.
Functions: [`last`](/manual/config/triggers/expression/history#last), [`min`](/manual/config/triggers/expression/aggregate#min), [`dayofweek`](/manual/config/triggers/expression/time#dayofweek), [`time`](/manual/config/triggers/expression/time#time)
Data item: [`system.cpu.load`](/manual/config/items/itemtypes/zabbix_agent#system.cpu.load) [comment]: # ({/643d3a74-17b607dc}) [comment]: # ({49f3b448-47b2e2fd}) ##### Compare CPU loads ```default avg(/Zabbix server/system.cpu.load,1h)/avg(/Zabbix server/system.cpu.load,1h:now-1d)>2 ``` The trigger fires if the average load today tops the average load of the same hour yesterday (using time shift as `now-1d`) more than two times.
Function: [`avg`](/manual/config/triggers/expression/aggregate#avg)
Data item: [`system.cpu.load`](/manual/config/items/itemtypes/zabbix_agent#system.cpu.load) [comment]: # ({/49f3b448-47b2e2fd}) [comment]: # ({e83bf5a3-6906462b}) ##### Compare long-term CPU loads ```default trendavg(/host/system.cpu.load,1M:now/M)>1.1*trendavg(/host/system.cpu.load,1M:now/M-1M) ``` This trigger fires if the CPU load on the host increased by more than 10% last month
Function: [`trendavg`](/manual/config/triggers/expression/trends#trendavg)
Data item: [`system.cpu.load`](/manual/config/items/itemtypes/zabbix_agent#system.cpu.load) You may also use the [Event name](/manual/config/triggers/trigger#configuration) field in trigger configuration to build a meaningful alert message, for example, to receive something like `"Load of Exchange server increased by 24% in July (0.69) comparing to June (0.56)"` the event name must be defined as: ```default Load of {HOST.HOST} server increased by {{?100*trendavg(//system.cpu.load,1M:now/M)/trendavg(//system.cpu.load,1M:now/M-1M)}.fmtnum(0)}% in {{TIME}.fmttime(%B,-1M)} ({{?trendavg(//system.cpu.load,1M:now/M)}.fmtnum(2)}) comparing to {{TIME}.fmttime(%B,-2M)} ({{?trendavg(//system.cpu.load,1M:now/M-1M)}.fmtnum(2)}) ``` It is also useful to allow manual closing in trigger configuration for this kind of problem. [comment]: # ({/e83bf5a3-6906462b}) [comment]: # ({4ae4641e-60fad4fc}) ##### Detect string containing special characters ```default last(/host/vfs.file.contents[/tmp/hello])={$HELLO_MACRO} ``` The trigger fires if `/tmp/hello` content is equal to the string defined in `{$HELLO_MACRO}`: ```default {$HELLO_MACRO} = \" //hello ?\" ``` Alternatively, you can compare to the string directly: ```default last(/Zabbix server/vfs.file.contents[/tmp/hello])="\\\" //hello ?\\\"" ``` Notice how the special characters (`\\` and `"`) characters are escaped when the string gets compared directly. Function: [`last`](/manual/config/triggers/expression/history#last)
Data item: [`vfs.file.contents`](/manual/config/items/itemtypes/zabbix_agent#vfs.file.contents) [comment]: # ({/4ae4641e-60fad4fc}) [comment]: # ({baa6a112-contribute}) ::: note-contribute Have a trigger expression example others might find useful?
Submit your example (including both expression and context) using our [suggestion form](#report-example) to send it to Zabbix developers. ::: [comment]: # ({/baa6a112-contribute})