PDA

View Full Version : suggestions for email alert configuration


mconigliaro
12-08-2005, 16:29
first of all, i want to say thanks to alexei for a great monitoring tool. ive been evaluating zabbix for about 2 months now, and i think it shows a lot of promise.

i havent looked at the latest alpha, but at least in 1.1alpha10, i've found that management of email alerts can be quite tedious when working with large number of hosts. this is because actions have a one-to-one relationship with triggers. the problem is that if you want to change your alert messages while keeping a consistant message format, you need to make that change for every trigger in your database. this can easily add up to thousands of changes. of course, i use a script to do this, but i think i have a better solution.

i suggest a new 'alerts' section where you create your standard alert "templates." then rather than editing a new email message for each trigger, you would just link to one of your existing alert templates.

in order to do this, several new variables would be required, similar to the current {HOSTNAME} variable. we would need things like:

{TRIGGER} - to hold the description of the trigger
{KEY} - to hold the key from the trigger
{VALUE} - to hold the value associated with the above key
{SEVERITY} - to hold the severity of the trigger

this would go a long way to making zabbix more suitable for managing a large number of hosts.

i also have a suggestion for sending alerts to external scripts. currently, you define the path to your script, and the zabbix alert is sent as parameters to the script (ie: the alert subject is ARGV[0] and the body is ARGV[1]). the problem with this is that it makes it impossible (as far as i can tell) to set your own command line options and pass your own parameters to the external script. i suggest that instead of simply defining the 'path' to the script, you should be defining exactly what you want zabbix to run on the command line. this would allow for things like this:

/path/to/script --opt1=foo --opt2=bar

note that if you tried something like this right now, you'd get an error, because zabbix doesnt expect to encounter any command line switches; just a path to a script.

now in order to get the subject and body into the script, zabbix should just pipe them to stdin. so internally, zabbix would have to do something like this.

echo "subject and body of zabbix alert" | /path/to/script --flag1=foo --flag2=bar

the reason i bring this up, is because i'd ultimately like to use simple event correlator (http://kodu.neti.ee/~risto/sec/) to parse my alerts and do things for me automatically (eg: restart stopped services). the problem is that sec requires the use of some command line switches, so this doesn't seem possible right now.

nikoula
06-09-2005, 18:40
i'm running zabbix 1.1alpha10
i want to know which variables that we have in the message action's section.

i ask it 'cause i want to add in the message field the item current status and i don't know how to do so.

thx

James Wells
06-09-2005, 18:57
Greetings,
i'm running zabbix 1.1alpha10
i want to know which variables that we have in the message action's section.

i ask it 'cause i want to add in the message field the item current status and i don't know how to do so.


As far as I can tell so far, we have only {HOSTNAME}, which is replaced with the current server's name.

mconigliaro
07-09-2005, 18:01
i just re-read this today, and it seems like my suggestion may have been a little confusing...

just to clarify, my point was that if we had additional variables (eg: {TRIGGER}, {KEY}, {VALUE}, {SEVERITY}), it would be possible to re-use the same alert for multiple triggers. needless to say, this could save a lot of time. =)

James Wells
07-09-2005, 18:58
just to clarify, my point was that if we had additional variables (eg: {TRIGGER}, {KEY}, {VALUE}, {SEVERITY}), it would be possible to re-use the same alert for multiple triggers. needless to say, this could save a lot of time. =)
Agree, been reading through the source code lately trying to figure out how best to implement this piece.

mconigliaro
07-09-2005, 19:58
i still think something needs to be done about the current implementation of sending alerts to a script. i cant emphasize enough how powerful the combination of zabbix and sec (simple event correlator) would be!

James Wells
07-09-2005, 20:09
Just did a cursory scan of the SEC link you listed and it doesn't seem that difficult to implement within the current framework. Unfortunately, I don't have time right now to go through the full thing, but I will try to read through their docs a bit more and see if it really is as easy to do as it appears.

SEC looks like a very powerful / useful tool.

Alexei
08-09-2005, 08:51
I'm going to introduce LOTS of new macros in 1.1beta1. Stay tuned.

James Wells
08-09-2005, 21:59
Okay, I sat down last night and did a bit more research into SEC and how to make it work with Zabbix.

Until Alexei has a chance to put the new macro's into place, it appears that you can have SEC monitor the Zabbix log file and pull even information that way. Please note that to use this, you will need to raise the log level on the server a bit, but the output from the Zabbix logger seems to contain enough info to make it work.

Alexei
19-09-2005, 19:02
For your information, I just comitted support of $1, ..., $9 in item descriptions. For example:

vfs.file.size[/var/log/messages]

$1 == /var/log/messages

$1 - first parameter
$2 - second (comma delimited)
and so on...

James Wells
21-09-2005, 18:46
For your information, I just comitted support of $1, ..., $9 in item descriptions. For example:

vfs.file.size[/var/log/messages]

$1 == /var/log/messages

$1 - first parameter
$2 - second (comma delimited)
and so on...
Okay, so $1 is the value inside the brackets, where does $2 - $9 come from? I just scanned through the source, and didn't see where this is implemented.

elkor
21-09-2005, 19:03
from his description I would think it was

myexpression[$1, $2, ...., $9]

this does hold true with the traditional zabbix expressions as well I think

admittedly, I haven't tried it.

I was all set and ready to make my mods to the beta1 interface and put that up today but with adding items from templates broken I guess I'll have to wait for beta2 (unless somebody has a diff to fix it already ;) ) I could probably find it, but I've been deliberately staying away from the templates area of the code because of all the forthcoming changes.

James Wells
21-09-2005, 19:23
from his description I would think it was

myexpression[$1, $2, ...., $9]

this does hold true with the traditional zabbix expressions as well I think

admittedly, I haven't tried it.

I was all set and ready to make my mods to the beta1 interface and put that up today but with adding items from templates broken I guess I'll have to wait for beta2 (unless somebody has a diff to fix it already ;) ) I could probably find it, but I've been deliberately staying away from the templates area of the code because of all the forthcoming changes.
I can see that for the UserParameter section of that zabbix_agentd.conf file, but for alerts?

Again, I would have to ask, where does the value for $2 - $9 come from. Looking at the new script media types, I suspect you are passing them as command line arguments to the scripts, but where do the actual values come from?

elkor
21-09-2005, 19:49
hmmm I see your point, and wasn't thinking of it in that context.

one could always assume that they came from the item that the trigger was based off of as described above, and that would be simple; but then what happens with complex triggers?

ok, beats me. I'm stumped :)

Hey, on an unrelated note, is there anyway you know of to set fullscreen mode to be persistant? I see reference in the code to it, and it works when I manipulate the URL but I haven't found a quick way to generate all the pages with it, you seem to have dug through more of the frontend then I so I thought I'd bounce it off you.

James Wells
21-09-2005, 19:58
Hey, on an unrelated note, is there anyway you know of to set fullscreen mode to be persistant?
At present, no. One of the patches I plan to submit soon, will m make fullscreen a user configurable option, similar to the way my User Configurable Refresh (http://www.zabbix.com/forum/showthread.php?t=1292) patch works.

Currently, the fullscreen is controlled exclusively by the fullscreen=1 URL variable, which can get a bit annoying. ;)

Alexei
22-09-2005, 10:06
The $1, ..., $9 come from item keys. For example:

vfs.fs.file.size[/var/log/messages]

$1 = /var/log/messages

other_key[aaa,bbb,ccc]

$1 = aaa
$2 = bbb
$3 = ccc

This functionality does not affect execution of external scripts and user parameters (yet).

gatisa
14-10-2005, 14:09
I'm going to introduce LOTS of new macros in 1.1beta1. Stay tuned.

btw what about variables?
is there any new like {HOSTNAME} available?