Hello everybody.

We installed the Zabbix Proxy server on a Linux box (see the "Environment") which has a couple of IP (eg, 10.0.2.20 and 10.0.2.22 - the latter is a virtual one). The "main" host (10.0.2.20) is checked via the Zabbix Proxy Server and the "Ping" item is defined as follows:

icmppingsec[,,,,1000]

The trigger kicks in when:

<name_of_the_server>.:cmppingsec[,,,,1000].last(0)}=0

Problem is that the rensponse times returned by "fping" are really low and that seems to fool Zabbix into thinking fping returned 0, thus cause the triggers to fire.

I raised the "pinger" log_level and I found out the following for 10.0.2.20 (the host which "hosts" the Zabbix Proxy Server):

26803:20160406:182235.742 read line [10.0.2.20 : [0], 96 bytes, 0.07 ms (0.07 avg, 0% loss)]
26803:20160406:182235.742 read line [10.0.2.20 : [1], 96 bytes, 0.03 ms (0.05 avg, 0% loss)]
26803:20160406:182235.742 read line [10.0.2.20 : [2], 96 bytes, 0.09 ms (0.06 avg, 0% loss)]
26803:20160406:182235.742 read line []
26803:20160406:182235.742 read line [10.0.2.20 : 0.07 0.03 0.09]
26803:20160406:182235.743 End of process_ping()
26803:20160406:182235.743 End of do_ping():SUCCEED
26803:20160406:182235.743 In process_values()
26803:20160406:182235.743 host [10.0.2.20] cnt=3 rcv=3 min=0.000030 max=0.000090 sum=0.000190

If you compare the very same data gathered from another system (10.0.2.21, reached via LAN, not via the local interface):

26803:20160406:182238.758 read line [10.0.2.21 : [0], 96 bytes, 0.50 ms (0.50 avg, 0% loss)]
26803:20160406:182238.758 read line [10.0.2.21 : [1], 96 bytes, 0.31 ms (0.40 avg, 0% loss)]
26803:20160406:182238.758 read line [10.0.2.21 : [2], 96 bytes, 0.33 ms (0.38 avg, 0% loss)]
26803:20160406:182238.758 read line []
26803:20160406:182238.758 read line [10.0.2.21 : 0.50 0.31 0.33]
26803:20160406:182238.759 End of process_ping()
26803:20160406:182238.759 End of do_ping():SUCCEED
26803:20160406:182238.759 In process_values()
26803:20160406:182238.759 host [10.0.2.21] cnt=3 rcv=3 min=0.000310 max=0.000500 sum=0.001140

Please notice the last lines:

26803:20160406:182235.743 host [10.0.2.20] cnt=3 rcv=3 min=0.000030 max=0.000090 sum=0.000190
26803:20160406:182238.759 host [10.0.2.21] cnt=3 rcv=3 min=0.000310 max=0.000500 sum=0.001140

So it seems that once a server has min and max response times of 0.00XX, the box is supposed to be up whereas when it has 0.000X, the host is considered down.

Thanks for your comments about that.

Cheers,
Roberto