-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Major
-
None
-
Affects Version/s: 7.0.23rc1, 7.4.7rc1, 8.0.0alpha2 (master)
-
Component/s: Server (S)
-
None
-
Environment:Zabbix's docker-compose, centos image, mysql
-
Support backlog
Hello,
There is an trigger prototype which expression looks like:
{$IFCONTROL:"{#IFNAME}"}=1 and (left("{#IFALIAS}", 1) = "+") and last(/Template_NAME/net.if.operstatus[ifOperStatus.{#SNMPINDEX}])=2 and (last(/Template_NAME/net.if.operstatus[ifOperStatus.{#SNMPINDEX}],#1)<>last(/Template_NAME/net.if.operstatus[ifOperStatus.{#SNMPINDEX}],#2))
when everything is resolved it does look like:
1=1 and (left("-", 1) = "+") and last(/test-2/net.if.operstatus[ifOperStatus.5])=2 and (last(/test-2/net.if.operstatus[ifOperStatus.5],#1)<>last(/test-2/net.if.operstatus[ifOperStatus.5],#2))
to add, item prototype have key:
net.if.operstatus[ifOperStatus.{#SNMPINDEX}]
and preprocessing set to "SNMP walk value", so standard SNMP item prototype
logic behind trigger prototype is to only create event if interface alias has a "+" in it, interface is down.
problem happens if user will at once add "-" instead of "+" to "IfAlias" and disable interface,
in a result, event would be generated, even though it should not be generated, because "ifalias" does not contain "+" in it,
example of generated event:
eventid: 68
source: 0
object: 0
objectid: 25218
clock: 1766147372
value: 1
acknowledged: 0
ns: 418865505
name: Network Device: Interface test-ether4(+): Link down
severity: 4
25 rows in set (0.00 sec)
trigger details after event was generated and discovery rule already ran; to add ifcontrol user macro in my case is just "1":
select * from triggers where triggerid=25218\G;
*************************** 1. row ***************************
triggerid: 25218
expression: {$IFCONTROL:"test-ether4"}=1 and
(left("-", 1) = "+") and
{36140}=2 and ({36141}<>{36142})
description: Network Device: Interface test-ether4(-): Link down
url:
status: 0
value: 1
priority: 4
lastchange: 1766147372
comments: This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. `{$IFCONTROL:"test-ether4"}=1` - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. `{TEMPLATE_NAME:METRIC.diff()}=1` - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)
WARNING: if closed manually - it will not fire again on the next poll, because of .diff.
error:
templateid: NULL
type: 0
state: 0
flags: 4
recovery_mode: 1
recovery_expression: {36140}<>2 or {$IFCONTROL:"test-ether4"}=0
correlation_mode: 0
correlation_tag:
manual_close: 1
opdata:
discover: 0
event_name:
uuid:
url_name:
1 row in set (0.02 sec)
details from device about this interface:
interface/ethernet print
Flags: X - DISABLED, R - RUNNING; S - SLAVE
Columns: NAME, MTU, MAC-ADDRESS, ARP, SWITCH
# NAME MTU MAC-ADDRESS ARP SWITCH
;;; -
3 XS test-ether4 1500 48:00:00:00:00:00 enabled switch1
Why event name contains "+" if "ifalias" is set to "-"?
Is it expected to calculate trigger before discovery rule macro would be resolved?