Zabbix Server and Proxy Trapper processes receive data from Agents and Proxies. Then they adjust monitoring time with included timestamp.
The data from Agent, especially log or eventlog, is sent by big block. But from Proxy, is sliced in spite of reading log almost same time. By this, in a
spcific situation, data timestamp is reverted.
data 1 : time a
data 2 : time b := a + 0.001
send data 1 and 2 together
data 1 : time c := a + 0.01
data 2 : time d := b + 0.01 := a + 0.011
Send data 1 and 2 separately
data 1 : time e := c + 0.02 := a + 0.03
data 2 : time f := d + 0.01 := a + 0.021
The revert occures.
In addition, the trigger with regexp() selects data with the accuracy second not nano second. So, when trigger evaluates against data 2, select data 1 because it selects the latest data.