We need to define a trigger expression that would count the number of occurrences of the last obtained value in the history for recent time.

count(/host/item,time,minutes,"eq",{ITEM.LASTVALUE})>occurrencesOK

The problem is with the trigger function count( ), which for comparison seems to use only a constant value and not the last obtained value.

::A typical example is monitoring logs with unsuccessful logins. If the last unsuccessful login was repeated x times in y minutes from the same IP. ::

• We cannot have a predefined trigger for every possible IP on the internet.

• I am also not sure if a dynamically created trigger with a filter for the last value in the count() function would be fast enough for an environment where sometimes several records are added to log with different IP per second.