Zabbix Server and Proxy Trapper processes receive data from Agents and Proxies. Then they adjust monitoring time with included timestamp.

The data from Agent, especially log or eventlog, is sent by big block. But from Proxy, is sliced in spite of reading log almost same time. By this, in a
spcific situation, data timestamp is reverted.
e.g.

Agent reading
data 1 : time a
data 2 : time b := a + 0.001
send data 1 and 2 together

Proxy receiving
data 1 : time c := a + 0.01
data 2 : time d := b + 0.01 := a + 0.011

Send data 1 and 2 separately

Server receving
data 1 : time e := c + 0.02 := a + 0.03
data 2 : time f := d + 0.01 := a + 0.021

The revert occures.

In addition, the trigger with regexp() selects data with the accuracy second not nano second. So, when trigger evaluates against data 2, select data 1 because it selects the latest data.