-
Incident report
-
Resolution: Won't fix
-
Major
-
None
-
3.2.1
-
None
-
Centos
Hello,
We have an template with a custom discovery rule named "NTP_SERVERS", it discover ntp servers, with a custom key ntp.offset[{#NTPSERVER}]
We have a host where a discovered item is not discovered any more,
but triggers event associated
are being created every 30 seconds more or less (150 times by hour)
I think that one trigger which have an item not discovered should no generate any event since the item is not discovered. It is like zabbix is reevaluating the expression even having the item not discovered , and it does not identify that the event should not be repeated every time (is really the same event)
When asked by such trigger, zabbix api return:
[{u'comments': u'',
u'correlation_mode': u'0',
u'correlation_tag': u'',
u'description': u'{HOST.NAME} MF NTP - Sin informaci\xf3n de SVRDC02.sae.junta-andalucia.es',
u'error': u'',
u'expression': u'{SAESERVER7:ntp.offset[SVRDC02.sae.junta-andalucia.es].nodata(300)}=1',
u'flags': u'4',
u'lastchange': u'1482225374',
u'manual_close': u'0',
u'priority': u'2',
u'recovery_expression': u'',
u'recovery_mode': u'0',
u'state': u'0',
u'status': u'0',
u'templateid': u'0',
u'triggerid': u'142782',
u'type': u'0',
u'url': u'',
u'value': u'1'}]
I have just select on the bbdd and see the events generated:
select DAY(FROM_UNIXTIME(clock)),HOUR(FROM_UNIXTIME(clock)), count(1) from events where objectid = 142782 and month(FROM_UNIXTIME(clock)) = 12 group by DAY(FROM_UNIXTIME(clock)),HOUR(FROM_UNIXTIME(clock)); | 20 | 0 | 150 | | 20 | 1 | 150 | | 20 | 2 | 150 | | 20 | 3 | 150 | | 20 | 4 | 150 | | 20 | 5 | 137 | | 20 | 6 | 150 | | 20 | 7 | 150 | | 20 | 8 | 150 | | 20 | 9 | 150 | | 20 | 10 | 150 | | 20 | 11 | 150 | | 20 | 12 | 150 | | 20 | 13 | 150 | | 20 | 14 | 150 | | 20 | 15 | 150 | | 20 | 16 | 137 | +---------------------------+----------------------------+----------+ 471 rows in set (2 min 11,97 sec)
We will update to zabbix 3.2.2 but I did not find any bug related on releases notes.
Thank you very much
PD: Sorry for my english
