Problem description

We are observing unexpected trigger evaluation in our Zabbix 7.4.11 environment.

Windows process-monitoring items correctly collect and store a process count of 0. However, triggers containing {TRIGGER.VALUE} remain in the OK state even when the process-count condition is satisfied.

The issue is not limited to email delivery: no Problem event is generated for the affected macro-based condition. In a comparison test using an expression without {TRIGGER.VALUE}, Problem event generation and email notification worked.

The issue was noticed after an upgrade. The exact root cause has not been confirmed.

Host names below have been anonymized as TEST_HOST.

Original expression pattern

(\{TRIGGER.VALUE}=0 and sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0)
or
(\{TRIGGER.VALUE}=1 and last(/TEST_HOST/proc.num[TERA_P.EXE])=0)

The intended behavior is:

• While the trigger is OK, enter Problem when the last two process counts are both 0.
• While the trigger is in Problem, remain in Problem while the latest process count is 0.

In our test, this expression remained OK despite consecutive zero values.

Minimal reproduction and comparison tests

Preconditions:

• The item proc.num[TERA_P.EXE] continues to collect and store 0.
• At least the last two recorded values are 0.
• Tests D, D-1 and D-2 are performed by editing the SAME test trigger.
• Only the problem expression is changed between these tests.

Test D: Expression containing {TRIGGER.VALUE}

(\{TRIGGER.VALUE}=0 or \{TRIGGER.VALUE}=1) and sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0

Actual result:

• The trigger remains OK.
• No Problem event is generated.
• No expression evaluation error is displayed in the Info field.

Test D-1: Replace both occurrences of the macro with the numeric constant 0

(0=0 or 0=1) and sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0

Actual result:

• The trigger changes to Problem.
• A Problem event is generated.
• The item continues to return 0.

Test D-2: Restore the original expression from Test D

(\{TRIGGER.VALUE}=0 or \{TRIGGER.VALUE}=1) and sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0

Actual result:

• The trigger changes from Problem back to OK.
• The item continues to return 0.

Observed sequence:
Macro expression: OK
-> Numeric-constant expression: Problem
-> Restored macro expression: OK

Additional control tests

The following expressions without {TRIGGER.VALUE} showed Problem:

sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0

count(/TEST_HOST/proc.num[TERA_P.EXE],#2,"eq",0)=2

The original macro-based expression showed OK while these control expressions showed Problem for the same monitored item.

Email notification was also successfully verified with a non-macro trigger expression.

Additional diagnostic observation: arithmetic operation on the macro

In a separate diagnostic test, we added +0 to the macro:

((\{TRIGGER.VALUE}+0)=0 or (\{TRIGGER.VALUE}+0)=1) and sum(/TEST_HOST/proc.num[TERA_P.EXE],#2)=0

This produced an expression evaluation error. The relevant error excerpt is:

Cannot evaluate expression: left operand "\{TRIGGER.VALUE}" is not a numeric value for operator

This error was observed in the +0 diagnostic test. The comparison-only expression in Test D did not display this error.

The error message contains the literal macro name. This may indicate a macro resolution or evaluation issue, but we have not confirmed the underlying cause.

Expected result

The Zabbix 7.4 documentation lists {TRIGGER.VALUE} as supported in trigger expressions and defines its numeric values as:

• 0: OK
• 1: Problem

Therefore, if the macro is evaluated as documented, the following condition should be true for either trigger value:

(\{TRIGGER.VALUE}=0 or \{TRIGGER.VALUE}=1)

With the last two process counts equal to 0, Test D should evaluate to true and generate a Problem event.

Restoring that expression in Test D-2 should not return the trigger to OK while the process-count condition remains true.

Impact

Affected process-monitoring triggers can remain OK while the monitored process count is 0. As a result, the corresponding Problem events and email notifications are not generated.

Related documentation and issues

Documentation:
https://www.zabbix.com/documentation/7.4/en/manual/appendix/macros/supported_by_location

ZBX-23814:
https://support.zabbix.com/browse/ZBX-23814

This historical issue describes similar symptoms involving {TRIGGER.VALUE} and was marked as fixed in 7.0.0beta1. Our observations are from 7.4.11; we have not confirmed whether the cause is related.

ZBXNEXT-3754:
https://support.zabbix.com/browse/ZBXNEXT-3754

This is a related design/change proposal concerning legacy trigger hysteresis. It is included as background only, not as evidence that {TRIGGER.VALUE} support has been removed.

Could you investigate the discrepancy between the documented macro behavior and the results above? If this is a known issue, please identify the corresponding issue and fix version.