Many times when monitoring a link, we create triggers that emit alarms only when a link has a total drop or when it is at its maximum capacity. But what if it happens to present only a partial drop, or a degradation? For this purpose, it is possible to create a trigger that issues an alarm of a graph drop of more than 30% compared to the total of the last 15min. Or one that shows a drop of more than 60% comparing the last collection with the same time 7 days ago.<\/p>\n\n
– Partial drop of 30% <\/strong><\/p>\n\n To create this trigger we will use the following structure for the \u201cdownload\u201d traffic: {host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}<0.7*{host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.avg(<\/strong>15m)<\/strong>} and {host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}>=100M<\/p>\n\n And the following structure for the \u201cupload\u201d traffic:<\/p>\n\n {host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}<0.7*{host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.avg(<\/strong>15m)<\/strong>} and {host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}>=100M<\/p>\n\n Where \u201chost<\/strong>\u201d is written, we must pass the name of the host that we will create the trigger and where \u201cOctetDoItem<\/strong>\u201d is written, we must pass the octet number of the item that we want to create the trigger, the octet is a unique identification of each item. The last parameter that we pass is the same parameter used to identify the total drop in a link, and we put that it needs to be greater than the parameter, so the trigger that partial drop is not active together with the total drop.<\/p>\n\n – Partial drop of 60%<\/strong><\/p>\n\n To create this trigger we will use the following structure for the \u201cdownload\u201d traffic: <\/p>\n\n {host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>].last(#1)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5040)}<=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#2)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5041)}<=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#3)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5042)}<=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#4)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5043)}<=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5044)}<=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last()}>50M<\/p>\n\n To create this trigger we will use the following structure for the \u201cupload\u201d traffic: <\/p>\n\n {host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#1)}\/{ host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5040)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#2)}\/{ host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5041)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#3)}\/{ host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5042)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#4)}\/{ host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5043)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5)}\/{ host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last(#5044)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>].last()}>50M<\/p>\n\n Where \u201chost<\/strong>\u201d is written, we must pass the name of the host that we will create the trigger and where \u201cOctetDoItem<\/strong>\u201d is written, we must pass the octet number of the item that we want to create the trigger, the octet is a unique identification of each item. The last parameter that we pass is the same parameter used to identify the total drop in a link, and we put that it needs to be greater than the parameter, so the trigger that partial drop is not active together with the total drop.<\/p>\n\n Operation of each trigger<\/strong><\/p>\n\n the trigger of partial drop of 30%<\/strong> it works as follows, it compares the last collection from zabbix with the average of the collections of the last 15 minutes, if there is a drop of 30% in relation to the last collection with the average and there has not been a total drop, an alert is issued to us.<\/p>\n\n The 60% partial drop<\/strong> trigger works by comparing the last 5 zabbix collections with the collections of 7 days ago at the same time.<\/p>\n\n Difference between triggers<\/strong><\/p>\n\n The 30% partial drop trigger we use with the idea of discovering when we have a sudden drop, while the 60% trigger we use to compare the traffic with the previous week, to know when there is a drop in traffic from one week to the next. other.<\/p>\n\n Did you like our tutorial today? <\/p>\n Tell us what you think?<\/p>\n Remembering that we have our monitoring 24×7 and this article was written by our monitoring manager, if you don’t want to have to worry about your network we invite you to know a little more about our work with Made4Noc.<\/p>\n","protected":false},"excerpt":{"rendered":" Understand how partial drop triggers can help you and how you can create 30% and 60% partial drop triggers<\/p>\n","protected":false},"author":13,"featured_media":8686,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"postBodyCss":"","postBodyMargin":[],"postBodyPadding":[],"postBodyBackground":{"backgroundType":"classic","gradient":""},"footnotes":""},"categories":[352],"tags":[],"class_list":["post-11747","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized-en"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts\/11747","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/comments?post=11747"}],"version-history":[{"count":0,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/posts\/11747\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/media\/8686"}],"wp:attachment":[{"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/media?parent=11747"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/categories?post=11747"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/made4it.com.br\/en\/wp-json\/wp\/v2\/tags?post=11747"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}