I have mess in my configuration, can't be for 100?% sure in what order i create things.
I setup repeating in threshold and it works great.

I fix my configuration using your advice and it works!
Problem SOLVED.

Thx Victor!

Can it be that you define threshold for DCI and only after define rule in event processing policy? In that case threshold violation event might be created before you define handling rule. You can check this by setting repeat interval in threshold - then it will repeat threshold violation event.

As for error I mention - you probably want to resolve existing alarm by "normal" event? If yes, then it will not work that way Problem is with alarm keys - resolve find alarm to resolve by key, but you specify different key in resolve rule than in alarm creation rule. This could be reduced to two rules:

1. Generate alarm from events CPU_LOAD_WARNING or CPU_LOAD_CRITICAL, with severity "from event" and key "CPU_LOAD_%i_%5".

2. Resolve alarm from event CPU_LOAD_NORMAL by key "CPU_LOAD_%i_%3".

Notice difference in key - %5 vs %3 - for historical reasons DCI ID is parameter number 3 for threshold rearm events and number 5 for threshold violation event.

Best regards,
Victor

I hope that helps.

I try do it in order.

Likely some sobtle error in configuration. By description everything looks correct. Can you share screenshot of exact configuration - maybe I'll spot the problem.

Best regards,
Victor

There is my working process:

1. Create 3 events - normal/warning/critical
2. Creating 3 event processing policys - normal/warning/critical and linked they with event. Policys have structure: IF my_event THEN Action generate/resolve alarm.
3. On nodes Data Collector Configuration in Threshold section i create two Thresholds - iIF my_value THEN my_event.

When i check node Last Value i see that my_value is greater that threshold, so alarm should generate.
Yesterday those alarm didn't work, but today suddenly alarmed me. I don't do anything (i think so).

Today i create new DCC parameter, same way as described above and setup values to generate alarms.
I see event exceeds my_value but don't generate alarms.

What i do wrong?

Thx!

Did you add a rule to generate alarm? Having threshold will only generate you an event - you have to add a rule to event processing policy to make alarm from it. See Event Processing section in user manual for more information.

Best regards,
Victor

I setup DCI origin and script with you instruction.
I run test script and get value about 0.25.

Then i setup  threshold:
Last pooled value: 1
> greater then: 0.2

Activation event:
SYS_THRESHOLD_REACHED

And apply changes.
But this settings don't generate alarm to me.
What i do wrong?

Thx!

EDIT:
I looked in into DCI history and all values are 0, how to "insert" value from script?
SOLVED: I changed Data type on Floating Point Number

EDIT TWO:
In Object Details of chosen node i see that threshold is exceed my value, but alarm is not generated.

there are different ways to implement this. One could be to create DCI with origin "Internal" and parameter name "Dummy" (it will just generate 0 at given intervals), give it meaningful description like "Memory usage", and in transformation script read necessary SNMP values and do the computation. Transformation script cold look like following:

snmp = CreateSNMPTransport($node);
total = SNMPGetValue(snmp, ".1.3.6.1.4.1.2021.4.3");
avail = SNMPGetValue(snmp, ".1.3.6.1.4.1.2021.4.6");
cached = SNMPGetValue(snmp, ".1.3.6.1.4.1.2021.4.15");
return (avail + cached) / total;

Then you can add threshold "more then 0.9" or any other as usual.

Best regards,
Victor