-
Change Request
-
Resolution: Unresolved
-
Major
-
None
-
2.0.12, 2.2.6, 3.0.13, 3.2.10, 3.4.4, 4.0.32, 5.0.14, 5.4.3
-
Trigger with "Multiple PROBLEM events generation" in combination with timer-related functions: nodata(), date(), dayofmonth(), dayofweek(), time(), now()
According to documentation:
If time-based functions (nodata(), date(), dayofmonth(), dayofweek(), time(), now()) are used in the expression, the trigger is recalculated every 30 seconds by a Zabbix timer process. If both time-based and non-time-based functions are used in an expression, it is recalculated when a new value is received and every 30 seconds.
It is good practice; however, there is a problem if trigger has option "Multiple PROBLEM events generation" turned ON. In this case there is a possibility that the timer process could generate "trigger goes to the PROBLEM state" event every 30 second (when all conditions are TRUE, even in the case when no new datas arrived).
My suggestion is the following: all trigger calculations performed by the timer process should be made as the "Multiple PROBLEM events generation" option is OFF, independently of its real setting. In other words: if all conditions are TRUE and the trigger is already in the PROBLEM state, the new event should not be generated. At the same time, if some of conditions becomes FALSE and trigger was in PROBLEM state, it should be closed (i.e. event "trigger goes to the OK state" must be generated).
The combination of timer-related trigger functions and "Multiple PROBLEM events generation" option is not very widespread. However, when this combination is used, it causes to difficult-to-understanding problems. The most typical problem - double or multiple alerts (some exapmles: ZBX-8114, ZBX-4732, ZBX-6170).
- is duplicated by
-
ZBX-23796 Excsessive trigger event creation while using event generation mode = multiple
- Closed