Table of Contents
1 Supported trigger functions
All functions supported in trigger expressions are listed here:
| FUNCTION | |||
|---|---|---|---|
| Description | Parameters | Comments | |
| abschange | |||
| The amount of absolute difference between last and previous values. | Supported value types: float, int, str, text, log For example: (previous value;last value=abschange) 1;5=4 3;1=2 0;-2.5=2.5 For strings returns: 0 - values are equal 1 - values differ | ||
| avg (sec|#num,<time_shift>) | |||
| Average value of an item within the defined evaluation period. | sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - evaluation point is moved the number of seconds back in time | Supported value types: float, int Examples: => avg(#5) → average value for the five latest values => avg(3600) → average value for an hour => avg(3600,86400) → average value for an hour one day ago. The time_shift parameter is supported since Zabbix 1.8.2. It is useful when there is a need to compare the current average value with the average value time_shift seconds back. | |
| change | |||
| The amount of difference between last and previous values. | Supported value types: float, int, str, text, log For example: (previous value;last value=change) 1;5=+4 3;1=-2 0;-2.5=-2.5 For strings returns: 0 - values are equal 1 - values differ | ||
| count (sec|#num,<pattern>,<operator>,<time_shift>) | |||
| Number of values within the defined evaluation period. | sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark) pattern (optional) - required pattern operator (optional) Supported operators:eq - equal ne - not equal gt - greater ge - greater or equal lt - less le - less or equal like - matches if contains pattern (case-sensitive) Note that: eq (default), ne, gt, ge, lt, le are supported for integer items eq (default), ne, gt, ge, lt, le are supported for float items like (default), eq, ne are supported for string, text and log items time_shift (optional) - see avg() | Supported value types: float, integer, string, text, log Float items match with the precision of 0.000001. Examples: => count(600) → number of values for last 10 minutes => count(10m,"error",eq) → number of values for last 10 minutes that equal 'error' => count(600,12) → number of values for last 10 minutes that equal '12' => count(600,12,gt) → number of values for last 10 minutes that are over '12' => count(#10,12,gt) → number of values within last 10 values that are over '12' => count(600,12,gt,86400) → number of values for preceding 10 minutes up to 24 hours ago that were over '12' => count(600,,,86400) → number of values for preceding 10 minutes up to 24 hours ago The #num parameter is supported since Zabbix 1.6.1.The time_shift parameter and string operators are supported since Zabbix 1.8.2. | |
| date | |||
| Current date in YYYYMMDD format. | Supported value types: any Example of returned value: 20150731 | ||
| dayofmonth | |||
| Day of month in range of 1 to 31. | Supported value types: any This function is supported since Zabbix 1.8.5. | ||
| dayofweek | |||
| Day of week in range of 1 to 7 (Mon - 1, Sun - 7). | Supported value types: any | ||
| delta (sec|#num,<time_shift>) | |||
| Difference between the maximum and minimum values within the defined evaluation period ('max()' minus 'min()'). | sec or #num - evaluation period in seconds or in latest collected values specified (preceded by a hash mark) time_shift (optional) - see avg() | Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2. | |
| diff | |||
| Checking if last and previous values differ. | Supported value types: float, int, str, text, log Returns: 1 - last and previous values differ 0 - otherwise | ||
| fuzzytime (sec) | |||
| Checking how much an item timestamp value differs from the Zabbix server time. | sec - seconds | Supported value types: float, int Returns: 0 - if difference between item timestamp value and Zabbix server timestamp is over T seconds 1 - otherwise. Usually used with system.localtime to check that local time is in sync with local time of Zabbix server. Can be used also with vfs.file.time[/path/file,modify] key to check that file didn't get updates for long time. Example: => fuzzytime(60)=0 → detect a problem if time difference is over 60 seconds | |
| iregexp (pattern,<sec|#num>) | |||
| This function is a non case-sensitive analogue of regexp(). | see regexp() | Supported value types: str, log, text | |
| last (sec|#num,<time_shift>) | |||
| The most recent value. | sec (ignored) or #num - the Nth most recent value time_shift (optional) - see avg() | Supported value types: float, int, str, text, log Take note that #num works differently here than with many other functions.For example: last() is always equal to last(#1) last(#3) - third most recent value (not three latest values) Zabbix does not guarantee exact order of values if more than two values exist within one second in history. The #num parameter is supported since Zabbix 1.6.2.The time_shift parameter is supported since Zabbix 1.8.2. | |
| logeventid (pattern) | |||
| Check if event ID of the last log entry matches a regular expression. | pattern - regular expression describing the required pattern, POSIX extended style. | Supported value types: log Returns: 0 - does not match 1 - matches This function is supported since Zabbix 1.8.5. | |
| logseverity | |||
| Log severity of the last log entry. | Supported value types: log Returns: 0 - default severity N - severity (integer, useful for Windows event logs: 1 - Information, 2 - Warning, 4 - Error, 7 - Failure Audit, 8 - Success Audit, 9 - Critical, 10 - Verbose). Zabbix takes log severity from Information field of Windows event log. | ||
| logsource (pattern) | |||
| Checking if log source of the last log entry matches parameter. | pattern - required string | Supported value types: log Returns: 0 - does not match 1 - matches Normally used for Windows event logs. For example, logsource("VMware Server"). | |
| max (sec|#num,<time_shift>) | |||
| Highest value of an item within the defined evaluation period. | sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - see avg() | Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2. | |
| min (sec|#num,<time_shift>) | |||
| Lowest value of an item within the defined evaluation period. | sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - see avg() | Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2. | |
| nodata (sec) | |||
| Checking for no data received. | sec - evaluation period in seconds. The period should not be less than 30 seconds. | Supported value types: any Returns: 1 - if no data received during the defined period of time 0 - otherwise Note that this function will display an error if, within the period of the 1st parameter: - there's no data and Zabbix server was restarted - there's no data and maintenance was completed - there's no data and the item was added or re-enabled Errors are displayed in the Info column in trigger configuration. | |
| now | |||
| Number of seconds since the Epoch (00:00:00 UTC, January 1, 1970). | Supported value types: any | ||
| prev | |||
| Previous value. | Supported value types: float, int, str, text, log Returns the same as last(#2). | ||
| regexp (pattern,<sec|#num>) | |||
| Checking if the latest (most recent) value matches regular expression. | pattern - regular expression, POSIX extended style. sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed. | Supported value types: str, text, log Returns: 1 - found 0 - otherwise This function is case-sensitive. | |
| str (pattern,<sec|#num>) | |||
| Finding a string in the latest (most recent) value. | pattern - required string sec or #num (optional) - evaluation period in seconds or in latest collected values (preceded by a hash mark). In this case, more than one value may be processed. | Supported value types: str, text, log Returns: 1 - found 0 - otherwise This function is case-sensitive. | |
| strlen (sec|#num,<time_shift>) | |||
| Length of the latest (most recent) value in characters (not bytes). | sec (ignored) or #num - the Nth most recent value time_shift (optional) - see avg() | Supported value types: str, text, log Take note that #num works differently here than with many other functions.Examples: => strlen()(is equal to strlen(#1)) → length of the latest value => strlen(#3) → length of the third most recent value => strlen(,86400) → length of the most recent value one day ago. This function is supported since Zabbix 1.8.4. | |
| sum (sec|#num,<time_shift>) | |||
| Sum of collected values within the defined evaluation period. | sec or #num - evaluation period in seconds or in latest collected values (preceded by a hash mark) time_shift (optional) - see avg() | Supported value types: float, int The time_shift parameter is supported since Zabbix 1.8.2. | |
| time | |||
| Current time in HHMMSS format. | Supported value types: any Example of returned value: 123055 | ||
- All functions return numeric values only. Comparison to strings is not supported, for example.
- Some of the functions cannot be used for non-numeric parameters!
- String arguments should be double quoted. Otherwise, they might get misinterpreted.