-
Incident report
-
Resolution: Won't fix
-
Major
-
None
-
2.2.1
-
None
-
Centos 6.4 x64
I use the nodata function to monitor eventlog on Windows and snmp traps:
example:
{srv2003:eventlog[File Replication,,Error,,,,skip].nodata({$LOG_KEEPON})}=0
where {$LOG_KEEPON} = 1d
which basically means:
the agent sends to the server only events with Error status
The trigger fires whenever it receives an event and keeps the trigger on for 1 day
This worked fine in Zabbix 2.0 but after upgrading to 2.2 many of these triggers went unsupported
The item itself is fine, only the trigger is unsupported:
Evaluation failed for function: {srv2003:eventlog[File Replication Service,,Error,,,,skip].nodata({$LOG_KEEPON})}
some db queries:
zabbix=> select state,status,description,expression,triggerid from triggers where description like '%File Replication Service err%';
state | status | description | expression | triggerid
-------+--------+--------------------------------------------------+------------+-----------
1 | 0 | File Replication Service error(s) on {HOST.HOST} | {174429}=0 | 134361
...
zabbix=> select * from functions where functionid=174429;
functionid | itemid | triggerid | function | parameter
------------+--------+-----------+----------+---------------
174429 | 191456 | 134361 | nodata | {$LOG_KEEPON}
zabbix=> select value_type,formula,history,itemid,type,name,key_ from items where itemid=191456;
value_type | formula | history | itemid | type | name | key_
------------+---------+---------+--------+------+------------------------------------------+---------------------------------------------------
2 | 1 | 7 | 191456 | 7 | File Replication Service event log error | eventlog[File Replication Service,,Error,,,,skip]
(1 row)
zabbix=> select id,itemid,clock,timestamp,source from history_log where itemid=191456;
id | itemid | clock | timestamp | source
---------+--------+------------+------------+--------
1294329 | 191456 | 1388768127 | 1388767699 | NtFrs
1318830 | 191456 | 1389109961 | 1389109576 | NtFrs
(2 rows)
zabbix=> select * from globalmacro where macro='{$LOG_KEEPON}';
globalmacroid | macro | value
---------------+---------------+-------
21 | {$LOG_KEEPON} | 1d
(1 row)
So i really don't get why it goes unsupported...
- duplicates
-
-
- Closed
-