search

omni-lchen / zabbix-ssl

30 stars 8 forks source link

Triggers remain in unknown status #5

Open peterthomassen opened 6 years ago

peterthomassen commented 6 years ago

First of all, thanks for this great template!

I set up a host to test expired.badssl.com which has an expired certificate. Looking at the host triggers, the "retrieve is failing" trigger looks fine.

The other three triggers (expired and upcoming expiry warnings) are in status "unknown". The info box says:

Cannot evaluate expression: "Cannot evaluate function "Zabbix server:ssl.cert.expirydate[expired.badssl.com].max(#3)".".

Is this a bug or a mistake on my side?

peterthomassen commented 6 years ago

Please let me know if there is any debug output that I can provide!

omni-lchen commented 6 years ago

It could be the trigger expression is working on zabbix 3.4 not on older versions, as I use "day" unit in it, please tweak a bit.

peterthomassen commented 6 years ago

I am running Zabbix 3.4.8 from the official Zabbix repositories, so that can't be the issue.

Also, the "day" unit appears on the right-hand side of the trigger expression, while the error message refers to the left-hand side only.

Any other ideas?

omni-lchen commented 6 years ago

It looks like you have might have "{" or "}" missing, here is one expression for your reference in a zabbix host "SSL-Certificates-ExampleCom"

Problem expression {SSL-Certificates-ExampleCom:ssl.cert.expirydate[example.com].max(#3)} - {SSL-Certificates-ExampleCom:ssl.cert.expirydate[example.com].now()} > 7d and {SSL-Certificates-ExampleCom:ssl.cert.expirydate[example.com].max(#3)} - {SSL-Certificates-ExampleCom:ssl.cert.expirydate[example.com].now()} < 31d

peterthomassen commented 6 years ago

Nopes, sorry. The trigger "Domain discovery: SSL certificate of expired.badssl.com has expired on {ITEM.LASTVALUE}" has the following expression:

{Zabbix server:ssl.cert.expirydate[expired.badssl.com].max(#3)} > 0 and {Zabbix server:ssl.cert.expirydate[expired.badssl.com].max(#3)} - {Zabbix server:ssl.cert.expirydate[expired.badssl.com].now()} < 0d

... which leads to status "Unknown", and the message in the info box next to it then reads:

Cannot evaluate expression: "Cannot evaluate function "Zabbix server:ssl.cert.expirydate[expired.badssl.com].max(#3)".".

So, the braces are in the expression, but not in the error message. It seems that the problem is specifically with the function mentioned in the message.

omni-lchen commented 6 years ago

Can you try to change max(#3) to last() ?

peterthomassen commented 6 years ago

The error message changes to

Cannot evaluate expression: "Cannot evaluate function "Zabbix server:ssl.cert.expirydate[expired.badssl.com].last()".".

It looks like ssl.cert.expirydate is undefined, or something like that. So you could think that I didn't install the template correctly.

However, another test ("Retrieve certificate") is enabled, without problems. The trigger expression is: {Zabbix server:ssl.cert.expirydate[expired.badssl.com].count(#3,0)} = 3 This expression also involves ssl.cert.expirydate, but works fine.

I find this quite confusing. Any ideas?

omni-lchen commented 6 years ago

Sorry mate I don't see anything wrong with the expression, if it is wrong you can't create it in the template. This template is working in my environment.