I will give some examples of triggers for Zabbix.
Let’s assume there are data elements, starting from them we will create triggers.
An example of a trigger informing that traffic on the switch port is more than permissible:
Name: Incoming port traffic > 70 Mbit/s at the office {HOSTNAME}
Expression: ({TemplateName:ifInOctets.1.last()}>70M)
For all UPLINK ports of switches and other devices, it is desirable to create a trigger when the port utilization is > 90%, for example, for a 1 Gbit/s port:
Name: Traffic on UPLINK port > 900 Mbit/s
Expression: {ixnfo.com:ifHCInOctets.25.last(0)}>900000000
Incoming traffic jumps of more than 90 Mbps in the last 2 minutes on the specified port:
({Template_ixnfo_com:ifHCInOctets["index","ifDescr","gigabitethernet1/0/1"].abschange(2m)}>90M)
Another example on Zabbix version 6.2 (power supply below 190 V for the last 3 minutes, while the item is executed 1 time per minute):
avg(/Template_ixnfo_com/upsInputVoltage,3m)<190
Trigger reporting the loss of the link on the switch port when the value is not equal to 1 (I note that when the link disappeared the status can be different from 2, for example when the port is blocked etc., for example 1-up, 2-down, 3-testing, 4-unknown, 5-dormant, 6-notPresent, 7-lowerLayerDown):
The link to the Office3 (21 ports) was lost on {HOSTNAME}
({192.168.2.22:ifOperStatus.21.last(0)}<>1)
To Zabbix reported the appearance of the link:
A link to the Office3 (21 ports) appeared on {HOSTNAME}
({192.168.2.22:ifOperStatus.21.last(0)}=1)
Trigger with a high processor load:
CPU load on {HOSTNAME} higher 70
{192.168.2.22:cpu.last(0)}>70
Change in value > 50 in the last 10 minutes:
{192.168.2.22:test.change(10m)}>50
The signal level is greater than -7 (and also, to exclude false positives, not = 21474836.47, this figure is given by Huawei MA5600 when the ONU is offline):
last(/10.250.0.250-info/signal.0.2.12.0)>-7.0000
and
last(/10.250.0.250-info/signal.0.2.12.0)<>21474836.47
Another example (to exclude erroneous values that are below -40, that is, the trigger will work when the value is between -19 and -40):
last(/10.0.0.37/SFP_DDM_RX_5)<-19.0000
and
last(/10.0.0.37/SFP_DDM_RX_5)>-40.0000
See also my articles:
Trigger during business hours
Examples of Items for Zabbix
Tracking file changes via Zabbix