[ZBXNEXT-2250] Evaluating NULL values in trigger (Combine SNMP-trap item and and SNMP-get item in one trigger expression) Created: 2014 Apr 10  Updated: 2016 Oct 07  Resolved: 2016 Oct 07

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: Server (S)
Affects Version/s: 2.2.2, 2.2.3
Fix Version/s: None

Type: New Feature Request Priority: Major
Reporter: Vitaly Zhuravlev Assignee: Unassigned
Resolution: Duplicate Votes: 0
Labels: null, snmp, snmptraps, trigger
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: PNG File item_proto.PNG     PNG File trigger_proto.PNG    
Issue Links:
Duplicate
duplicates ZBXNEXT-1791 Trigger functions evaluation for unsu... Closed

 Description   

I'm trying to create one neat trigger for IF-MIB port operational status monitoring,

This Trigger is ON when either:
A: (the classic polling way) When last snmp-get polling returns 2 like: 

ifOperStatus.["1"].last(0)}=2)

OR
B: (snmptrap way) When snmptrap is received by snmptrapd, parsed by snmptt and delivered by zabbix using snmprtap. like:

host:snmptrap[interface\s1].str(down)}=1

Trigger is OFF when
A: (trap way) new trap is received stating that interface is up ( not down)
OR
B: (polling) snmp-get polling returns that interface is not down (!=2)

Complete trigger expression is for if1:

({host:snmptrap[interface\s1].str(down)}=1 & {host:snmptrap[interface\s1].nodata(600)}=0)
|
({host:ifOperStatus.["1"].last(0)}=2 & {host:snmptrap[interface\s1].nodata(600)}=1)

This trigger is attached to the switch template that is universal. Some switches send traps and some of them don't.

Trigger like this gives me all the benefits from SNMP polling and SNMP traps:

  • instant notification (SNMP trap)
  • Port statuses syncronization via SNMP-get (which is important in case of network transport problems when SNMP-trap UDP packet might get lost in transition)
  • Universal approach and backward compatibility: I can monitor all kind of network devices, no matter if they support snmp-traps and were they configured properly or not.
  • Warranty that trigger stating "Port x is down" will never become enternal ON, in case when (linkdown is received by the system and clearing trap linkup isn't)

But there is one little problem that blocks this trigger from proper working:

Problem is that when zabbix never receives a trap from the switch for that interface (since there is individual snmp-trap item for every interface index)

Trigger is never evaluated since part of expression: snmptrap[interface\s1] item's last value is NULL (trap is never received)

Once you receive a single trap - it's all fine from that moment

___________________________

I suggest:

Make evaluation of trigger's expression like:

host:snmptrap[interface\s1].str(down)} to return 1 (TRUE) if there are no values collected for that item (

so the triggers are in OK status not UNKNOWN in such a case

 Comments   
Comment by Oleksii Zagorskyi [ 2014 Apr 11 ]

I don't think that your suggestion could be accepted.
It's illogical to evaluate expression as TRUE if we don't have any value for this evaluation.

Take into account please ZBXNEXT-2118

Comment by Vitaly Zhuravlev [ 2014 Apr 11 ]

Ok, but Completetrigger expression has logical OR. And other part is gathered and evaluated. So in the beggining when no trap was received it's like: 

({host:snmptrap[interface\s1].str(down)}=1 & {host:snmptrap[interface\s1].nodata(600)}=0) 
| 
({host:ifOperStatus.["1"].last(0)}=2 & {host:snmptrap[interface\s1].nodata(600)}=1)

_____________________________________________________________________

evaluate to:

(UNKNOWN & UNKNOWN)
OR
(TRUE & UNKNOWN)

Is this illogical to evaluate nodata() as TRUE here as well? Because NULL looks like nodata to me)
Accept my statement just for one second then, evaluation then could be:

(UNKNOWN & TRUE)
OR
(TRUE & TRUE)

Because two parts are diveded by OR ,
I say trigger may go up.

I agree that things like trigger evaluation affect core logic of the Zabbix and changes must be thought through.
So maybe If I can use UNKNOWN status in trigger expression somehow? Or just don't let trigger fail if part of its OR expression is evaluated without problems?

Comment by Oleksii Zagorskyi [ 2014 Apr 11 ]

Well, in issue description you wrote:

host:snmptrap[interface\s1].str(down)} to return 1 (TRUE) if there are no values collected for that item (

in a comment above you wrote:

Is this illogical to evaluate nodata() as TRUE here as well? Because NULL looks like nodata to me)

So you mentioned two very different functions.
Hhm, do you want to say that among other things the nodata() function evaluated incorrectly ?

Comment by Vitaly Zhuravlev [ 2014 Apr 11 ]

Neither function str() or nodata() are evaluated if they never receive any value in the past.

So you were saying that make str() to be TRUE is illogical in this case.
Then I asked if you can make nodata() function to be TRUE here at least. And don't make TRIGGER UNKNOWN if any part of 'OR' is OK

Comment by Vitaly Zhuravlev [ 2016 Oct 07 ]

This is actually was solved in 3.2

Comment by Oleksii Zagorskyi [ 2016 Oct 07 ]

Issue which did not change anything in zabbix code, should not be closed as Fixed
If you can - find the issue report which has changed the picture, link as duplicating it and close this one as duplicate.
Or close as incomplete etc

Comment by Oleksii Zagorskyi [ 2016 Oct 07 ]

Figured out, Vitaly considers it resolved by ZBXNEXT-1791.
Closing now as duplicate.

Generated at Sat Apr 05 14:58:23 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.