Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-11614

Events: wrong calculation of ITEM.VALUE macro in case there were several values with the same timestamp

    XMLWordPrintable

Details

    • Incident report
    • Status: Closed
    • Trivial
    • Resolution: Duplicate
    • 3.2.1
    • None
    • None
    • None

    Description

      If several messages were send to the log item one after another in a short time, and one of it matches trigger condition, than macro {ITEM.VALUE} for the corresponding event won't be calculated correctly.

      Steps to reproduce using zabbix_sender:

      1. Create log item (for example log[D:\datalog\test3.log]) and create a trigger for this item: {test_host:log[D:\datalog\test3.log].regexp(ERROR)}<>0
      2. Create an action for this trigger with the {ITEM.VALUE} macro in "Operations"
      3. Create txt file (data_values.txt) with the following contents:
         "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:40:49,187 WARN  [Test] TestMessage1"
            "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:41:12,187 WARN  [Test] TestMessage2"
            "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:42:13,187 ERROR  [Test] TestMessage3"
            "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:43:44,187 WARN  [Test] TestMessage4"
            "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:44:05,187 WARN  [Test] TestMessage5"
            "test_host" "log[D:\datalog\test3.log]" 1481805381 "2016-12-15 14:45:19,187 WARN  [Test] TestMessage6"
      4. Send command:
        zabbix_sender -z 127.0.0.1 -i /tmp/data_values.txt -T

      Results:

      Trigger as expected turnes to the "Problem" state. But {ITEM.VALUE} macro in it's event is calculated wrongly. As {ITEM.VALUE} macro is displayed the last message (TestMessage6), not the one, that matched the trigger condition (TestMessage3). See screenshot event1.png.

      Notes:

      1. May be it's related to an issue I opened earlier - ZBX-11525
      2. All values in this example have same nanoseconds too

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              Ekaterina Letova Ekaterina Letova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: