Many times when monitoring a link, we create triggers that emit alarms only when a link has a total drop or when it is at its maximum capacity. But what if it happens to present only a partial drop, or a degradation? For this purpose, it is possible to create a trigger that issues an alarm of a graph drop of more than 30% compared to the total of the last 15min. Or one that shows a drop of more than 60% comparing the last collection with the same time 7 days ago. <\/p>\n\n
– Partial drop of 30% <\/strong><\/p>\n\n To create this trigger we will use the following structure for the \u201cdownload\u201d traffic: {host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}<0.7*{host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.avg(<\/strong>15m)<\/strong>} and {host<\/strong>:net.if.in[ifHCInOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}>=100M<\/p>\n\n And the following structure for the \u201cupload\u201d traffic:<\/p>\n\n {host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}<0.7*{host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.avg(<\/strong>15m)<\/strong>} and {host<\/strong>:net.if.out[ifHCOutOctets.OctetoDoItem<\/strong>]<\/a>.last()<\/strong>}>=100M<\/p>\n\n Where \u201chost<\/strong>\u201d is written, we must pass the name of the host that we will create the trigger and where \u201cOctetDoItem<\/strong>\u201d is written, we must pass the octet number of the item that we want to create the trigger, the octet is a unique identification of each item. The last parameter that we pass is the same parameter used to identify the total drop in a link, and we put that it needs to be greater than the parameter, so the trigger that partial drop is not active together with the total drop. <\/p>\n\n – Partial drop of 60%<\/strong><\/p>\n\n To create this trigger we will use the following structure for the \u201cdownload\u201d traffic: <\/p>\n\n {host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#1)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5040)} <=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#2)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5041)} <=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#3)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5042)} <=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#4)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5043)} <=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5)}\/{ host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last(#5044)} <=0.4 and { host<\/strong>:net.if.in[ifHCInOctets. OctetoDoItem<\/strong>].last()} >50M<\/p>\n\n To create this trigger we will use the following structure for the \u201cupload\u201d traffic: <\/p>\n\n {host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#1)}\/{ host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5040)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#2)}\/{ host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5041)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#3)}\/{ host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5042)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#4)}\/{ host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5043)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5)}\/{ host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last(#5044)}<=0.4 and { host<\/strong>:net.if.out[ifHCOutOctets. OctetoDoItem<\/strong>].last()}>50M<\/p>\n\n Where \u201chost<\/strong>\u201d is written, we must pass the name of the host that we will create the trigger and where \u201cOctetDoItem<\/strong>\u201d is written, we must pass the octet number of the item that we want to create the trigger, the octet is a unique identification of each item. The last parameter that we pass is the same parameter used to identify the total drop in a link, and we put that it needs to be greater than the parameter, so the trigger that partial drop is not active together with the total drop. <\/p>\n\n Operation of each trigger<\/strong><\/p>\n\n The 30% partial drop<\/strong> trigger works as follows: it compares the latest Zabbix data collection with the average of the data collected over the last 15 minutes. If there is a 30% drop in the latest data collection compared to the average\u2014and a total drop has not occurred\u2014an alert is sent to us.<\/p>\n\n The 60% partial drop<\/strong> trigger works by comparing the last 5 zabbix collections with the collections of 7 days ago at the same time.<\/p>\n\n Difference between triggers<\/strong><\/p>\n\n The 30% partial drop trigger we use with the idea of discovering when we have a sudden drop, while the 60% trigger we use to compare the traffic with the previous week, to know when there is a drop in traffic from one week to the next. other.<\/p>\n\n Did you like our tutorial today? <\/p>\n Tell us what you think?<\/p>\n Remembering that we have our monitoring 24×7 and this article was written by our monitoring manager, if you don’t want to have to worry about your network we invite you to know a little more about our work with Made4Noc.<\/p>\n","protected":false},"excerpt":{"rendered":" Understand how partial drop triggers can help you and how you can create 30% and 60% partial drop triggers<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-18673","post","type-post","status-publish","format-standard","hentry","category-nao-categorizado"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t