In the example below "minty error 6" has a timestamp before timestamp of "minty error 5" (most likely due to time adjustment in server that is due to network latency) although the actual sequence is 5 --> 6. However the alert for the "minty error 6" contains value of "minty error 4". Environment: Zabbix Server 2.2.10 on Linux Mint 17.2, Zabbix Agent 2.2.10 on Linux Mint 17.3. Clocks are synchronised to second. Item: log[/var/log/syslog,@LOG_ERROR,UTF-8] Trigger: {minty:log[/var/log/syslog,@LOG_ERROR,UTF-8].iregexp(@LOG_ERROR)}#0 * generates multiple problem reports LOG_ERROR: .*error.* Action's default message: " {ITEM.NAME1} ({HOST.NAME1}:{ITEM.KEY1}): {ITEM.VALUE1} Original event ID: {EVENT.ID} " /var/log/syslog | grep -e '.*error.*' Feb 22 14:19:32 zabbix-VirtualBox kernel: [ 4.956587] EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro Feb 22 14:19:34 zabbix-VirtualBox NetworkManager[730]: [1456143574.396851] [nm-dns-dnsmasq.c:396] update(): dnsmasq owner not found on bus: Could not get owner of name 'org.freedesktop.NetworkManager.dnsmasq': no such name Feb 22 14:50:44 zabbix-VirtualBox zabbix: new error 1 Feb 22 14:45:25 zabbix-VirtualBox zabbix: new error 2 Feb 22 14:51:42 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Feb 22 15:12:56 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Feb 22 15:25:55 zabbix-VirtualBox zabbix: new error 3 Feb 22 15:25:26 zabbix-VirtualBox zabbix: new error 4 Feb 22 15:28:02 zabbix-VirtualBox zabbix: new error 5 Feb 22 15:34:27 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Feb 22 15:45:10 zabbix-VirtualBox zabbix: new error 6 Feb 22 15:54:36 zabbix-VirtualBox zabbix: minty error 1 Feb 22 15:54:52 zabbix-VirtualBox zabbix: minty error 2 Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 3 Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 4 Feb 22 16:05:56 zabbix-VirtualBox zabbix: minty error 5 Feb 22 16:05:56 zabbix-VirtualBox zabbix: minty error 6 Feb 22 16:30:40 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Feb 22 16:43:59 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error history_log mysql> select id, itemid, clock, ns timestamp, value from history_log order by clock desc, ns desc; +----+--------+------------+-----------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | id | itemid | clock | timestamp | value | +----+--------+------------+-----------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 19 | 23675 | 1456152252 | 174044747 | Feb 22 16:43:59 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error | | 18 | 23675 | 1456151441 | 889548847 | Feb 22 16:30:40 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error | | 16 | 23675 | 1456149972 | 506343514 | Feb 22 16:05:56 zabbix-VirtualBox zabbix: minty error 5 | | 17 | 23675 | 1456149972 | 506045262 | Feb 22 16:05:56 zabbix-VirtualBox zabbix: minty error 6 | | 15 | 23675 | 1456149702 | 476119704 | Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 4 | | 14 | 23675 | 1456149702 | 476118106 | Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 3 | | 13 | 23675 | 1456149702 | 476116440 | Feb 22 15:54:52 zabbix-VirtualBox zabbix: minty error 2 | | 12 | 23675 | 1456149702 | 476114722 | Feb 22 15:54:36 zabbix-VirtualBox zabbix: minty error 1 | | 11 | 23675 | 1456149702 | 476112863 | Feb 22 15:45:10 zabbix-VirtualBox zabbix: new error 6 | | 10 | 23675 | 1456149702 | 476101637 | Feb 22 15:34:27 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error | | 9 | 23675 | 1456149702 | 476099419 | Feb 22 15:28:02 zabbix-VirtualBox zabbix: new error 5 | | 8 | 23675 | 1456149702 | 476097652 | Feb 22 15:25:26 zabbix-VirtualBox zabbix: new error 4 | | 7 | 23675 | 1456149702 | 476086349 | Feb 22 15:25:55 zabbix-VirtualBox zabbix: new error 3 | | 6 | 23675 | 1456149702 | 476061577 | Feb 22 15:12:56 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error | | 5 | 23675 | 1456149702 | 476059260 | Feb 22 14:51:42 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error | | 4 | 23675 | 1456149702 | 476056767 | Feb 22 14:45:25 zabbix-VirtualBox zabbix: new error 2 | | 3 | 23675 | 1456149702 | 476043537 | Feb 22 14:50:44 zabbix-VirtualBox zabbix: new error 1 | | 2 | 23675 | 1456149702 | 474271513 | Feb 22 14:19:34 zabbix-VirtualBox NetworkManager[730]: [1456143574.396851] [nm-dns-dnsmasq.c:396] update(): dnsmasq owner not found on bus: Could not get owner of name 'org.freedesktop.NetworkManager.dnsmasq': no such name | | 1 | 23675 | 1456149702 | 473564190 | Feb 22 14:19:32 zabbix-VirtualBox kernel: [ 4.956587] EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro | +----+--------+------------+-----------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 19 rows in set (0.00 sec) events mysql> select * from events where eventid >= 269 order by clock desc, ns desc; +---------+--------+--------+----------+------------+-------+--------------+-----------+ | eventid | source | object | objectid | clock | value | acknowledged | ns | +---------+--------+--------+----------+------------+-------+--------------+-----------+ | 287 | 0 | 0 | 13576 | 1456152252 | 1 | 0 | 174044747 | | 286 | 0 | 0 | 13576 | 1456151441 | 1 | 0 | 889548847 | | 284 | 0 | 0 | 13576 | 1456149972 | 1 | 0 | 506343514 | | 285 | 0 | 0 | 13576 | 1456149972 | 1 | 0 | 506045262 | | 283 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476119704 | | 282 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476118106 | | 281 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476116440 | | 280 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476114722 | | 279 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476112863 | | 278 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476101637 | | 277 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476099419 | | 276 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476097652 | | 275 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476086349 | | 274 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476061577 | | 273 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476059260 | | 272 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476056767 | | 271 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 476043537 | | 270 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 474271513 | | 269 | 0 | 0 | 13576 | 1456149702 | 1 | 0 | 473564190 | +---------+--------+--------+----------+------------+-------+--------------+-----------+ 19 rows in set (0.00 sec) alerts mysql> select message from alerts where eventid >= 269 order by eventid desc; +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | message | +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 16:30:40 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Original event ID: 286 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 4 Original event ID: 285 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 16:05:56 zabbix-VirtualBox zabbix: minty error 5 Original event ID: 284 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 4 Original event ID: 283 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:55:02 zabbix-VirtualBox zabbix: minty error 3 Original event ID: 282 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:54:52 zabbix-VirtualBox zabbix: minty error 2 Original event ID: 281 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:54:36 zabbix-VirtualBox zabbix: minty error 1 Original event ID: 280 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:45:10 zabbix-VirtualBox zabbix: new error 6 Original event ID: 279 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:34:27 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Original event ID: 278 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:28:02 zabbix-VirtualBox zabbix: new error 5 Original event ID: 277 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:25:26 zabbix-VirtualBox zabbix: new error 4 Original event ID: 276 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:25:55 zabbix-VirtualBox zabbix: new error 3 Original event ID: 275 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 15:12:56 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Original event ID: 274 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 14:51:42 zabbix-VirtualBox mate-screensaver-dialog: pam_ecryptfs: seteuid error Original event ID: 273 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 14:45:25 zabbix-VirtualBox zabbix: new error 2 Original event ID: 272 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 14:50:44 zabbix-VirtualBox zabbix: new error 1 Original event ID: 271 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 14:19:34 zabbix-VirtualBox NetworkManager[730]: [1456143574.396851] [nm-dns-dnsmasq.c:396] update(): dnsmasq owner not found on bus: Could not get owner of name 'org.freedesktop.NetworkManager.dnsmasq': no such name Original event ID: 270 | | syslog errors (minty:log[/var/log/syslog,@LOG_ERROR,UTF-8]): Feb 22 14:19:32 zabbix-VirtualBox kernel: [ 4.956587] EXT4-fs (sda1): re-mounted. Opts: errors=remount-ro Original event ID: 269 | +-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 18 rows in set (0.00 sec)