I have a couple of HTTP Item monitors with a single pre-processing rule.  The pre-processing rule is a regex match that boils the HTTP response down to a 0/1 for error/success.  The first iteration of these was returning character data from the same regex pre-processing rule of OK/ERROR.

The URL that is being monitored has an issue several times a day that is a transitory issue (and unfortunately we cannot fix the underlying error).  What I have been trying to do is to have my triggers not fire an alert condition unless the item returns the error condition for at least two of the collection intervals in a row.

The initial attempt (when the item was returning character data) was to use the count() function in the trigger as such:

 {zabbix.sys.courtnet.org:vm-esig-appp2_HSM_Pool_Health.count(#3,"ERROR",eq)}>1

Which if I understand the documentation on this function correctly, should fire when 2 of the last three collections of this item returns ERROR.

On the support forums it was suggested that I try switching to return a integer value and try to use the min/max function.  So now, I'm returning 0/1 and this is what the current function looks like:

{zabbix-proxy-20.sys.courtnet.org:vm-esig-appp2_HSM_Pool_Health.max(#3)}=0

Which I think should only trigger if the maximum value of the last three collections is 0.

Neither of these solutions seem to be working.  The trigger will fire if there is any error condition at all.

This morning I received the following alert emails for this item:

Problem started at 08:34:11 
Problem has been resolved at 08:34:13 

So the problem triggered two seconds before it cleared.

Looking at the latest data returned from this item, this is what I see:

2020-04-28 08:35:14 1588077314 1
2020-04-28 08:34:14 1588077254 1
2020-04-28 08:33:14 1588077194 0
2020-04-28 08:32:14 1588077134 1
2020-04-28 08:31:14 1588077074 1

As you can see, this item went into error (0) state at 08:33:14 and then went into the ok (1) state at 08:34:13.  However, the trigger fired the action email at 08:34:11 and then cleared it 2 seconds later.

I've tried turning up the debugging level logging, but I could not find anything that looked like it indicated why this alert was firing. 

The forum post that I originally posted might have some more details and is here:

https://www.zabbix.com/forum/zabbix-help/399755-trigger-firing-when-i-don-t-think-it-should