[ZBX-4500] "fuzzytime" should compare with the time the item was collected Created: 2012 Jan 02  Updated: 2020 Feb 06

Status: Open
Project: ZABBIX BUGS AND ISSUES
Component/s: Server (S)
Affects Version/s: 1.8.9
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: Kevin Doren Assignee: Unassigned
Resolution: Unresolved Votes: 10
Labels: triggerfunctions, triggers
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

CentOS 5.4, MySQL


Issue Links:
Duplicate
is duplicated by ZBX-8427 Fuzzytime suddenly very wrong, we thi... Closed
Sub-task
depends on ZBX-15624 Allow "system.localtime" metric be co... Closed

 Description   

We use the "fuzzytime" function generate an alert if the time of a monitored server has drifted. It compares the time reported by the host to the time on the Zabbix server AT THE TIME TRIGGERS ARE PROCESSED.

Is SHOULD use, or at least allow as a parameter, the TIME THE ITEM WAS COLLECTED, which is known and stored, but not used by fuzzytime.

The current method introduces a delay, which mean that we have to use a large fuzzytime delta to allow for the maximum delay between collection and processing. We should be able to test for small amounts of time drift, but the current behavior of fuzzytime doesn't allow that.

The current method also causes false alerts if the Zabbix server crashes after collecting the time but before processing the trigger. We're monitoring time on several hundred servers, and I've had several crashes recently while trying to find a workaround for the bug in ODBC database monitoring. Those crashes generated some false alerts.

Thanks,
Kevin



 Comments   
Comment by Alexei Vladishev [ 2012 Jan 31 ]

You are right on this. Unfortunately it is not easy to fix because we do not keep track of delays while processing an item.

Comment by richlv [ 2013 Mar 04 ]

hmm, this seems to be the biggest problem when using proxies. in that case we do know when item value was collected, so we should compare against that (and assume that proxy has synchronised clock, of course).

with active items that would be useless, as then we would compare value to time, taken on the same host

Comment by Aleksandrs Saveljevs [ 2013 Nov 27 ]

A somewhat related issue: ZBXNEXT-2045.

Comment by Steve mushero [ 2014 Sep 14 ]

Note we've found this also breaks even without proxies when the DB is slow - if the DB sync processes get behind due to backups or housekeepers, etc. then the times mismatch, too (since the trigger is evaluated when written to the DB). I'd think Active Checks that were delayed at all due to network, etc. would also be affected.

In practice this makes time checks for hosts nearly useless in lots of environments, even though this is critically important for many people (especially those on Kerberos).

How do other systems deal with this ? No proxies I guess, and no active checks. It's a hard problem with Proxies & Actives & Delayed Evaluation - all help Zabbix scale, but leave us no way to check time. We'll do a separate SQL process for this, I think with sender to check last 24 hours time drift so smooth out these effects (average diff between clock and value over 24 hours).

Generated at Sat Apr 27 02:03:05 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.