zabbix version
Tested in Zabbix server v2.2.2 (revision 42525) and Zabbix agent v2.2.2 (revision 42525)
function last
{10.2.201.47:vfs.file.size[/path/to/somelog].last(0)}={10.2.201.47:vfs.file.size[/path/to/somelog].last(#150)}
Update interval(in sec) of this item is 60,so this means the file size has not been changed 150 minutes.
Maybe a better way, the demo in www.zabbix.com is not detail enough.
Pay attention,the function of last(),last(150) means the value of the last 150 seconds.last(#150) means the value of the last 150 time, the time is decided by the update interval.
The function last uses a different meaning for values when prefixed with the hash mark - it makes it choose the n-th previous value, so given the values 3, 7, 2, 6, 5 (from most recent to least recent), last(#2) would return 7 and last(#5) would return 5.
function min
{10.2.201.47:net.if.in[eth0,bytes].min(5)}>15M
Update interval(in sec) of this item is 5,so this means Network incoming on 10.2.201.47 is too high. min(5) means last 5 seconds,the total incoming of eth0.If Use custom mulitplier in this item is default(not used),this means 15MBps.If Use custom mulitplier is 8,this means 15Mbps.
Someone is downloading a large file from the Internet
Use of function min:{www.zabbix.com:net.if.in[eth0,bytes].min(5m)}>100K
The expression is true when number of received bytes on eth0 is more than 100 KB within last 5 minutes.