This is the documentation page for an unsupported version of Zabbix.
Is this not what you were looking for? Switch to the current version or choose one from the drop-down menu.

1 Actions

Zabbix reacts to events by executing set of operations. An action can be defined for any event or set of events generated by Zabbix.

Action attributes:

Parameter Description
Name Unique action name.
Event source Source of event.
Currently three sources are supported:
Triggers - events generated by trigger status changes
Discovery - events generated by network discovery module
Auto registration - events generated by new active agents
Enable escalations Enable escalations. If enabled, the action will be escalated according to operation steps defined for operations.
Period (seconds) Time period for increase of escalation step.
Default subject Default notification subject. The subject may contain macros.
Default message Default notification message. The message may contain macros.
Recovery message If enabled, Zabbix will send a recovery message after the original problem is resolved. The messages will be sent only to those who received any message regarding this problem before.
Recovery subject Subject of the recovery message. It may contain macros.
Recovery message Recovery message. It may contain macros.
Status Action status:
Enabled - action is active
Disabled - action is disabled

Warning: before enabling recovery messages or escalations, make sure to add "Trigger value = PROBLEM" condition to the action, otherwise remedy events can become escalated as well.

Action conditions

An action is executed only in case if an event matches defined set of conditions.

The following conditions can be defined for trigger based events:

Condition type Supported operators Description
Application =
like
not like
= - event came from a trigger, which refers to an item that is linked to the specified application
like - event came from a trigger, which refers to an item that is linked to an application, containing the string
not like - event came from trigger, which refers to an item that is linked to an application not containing the string
Host group =
<>
Compare against host group having a trigger which generated event.
= - event came from this host group
<> - event did not come from this host group
Host template =
<>
Compare against Host Template the trigger belongs to.
= - event came from a trigger inherited from this Host Template
<> - event did not come from a trigger inherited from this Host Template
Host =
<>
Compare against Host having a trigger which generated event.
= - event came from this Host
<> - event did not come from this Host
Trigger =
<>
Compare against Trigger which generated event.
= - event generated by this Trigger
<> - event generated by other Trigger
Trigger description (name) like
not like
Compare against Trigger Name which generated event.
like - String can be found in Trigger Name. Case sensitive.
not like - String cannot be found in Trigger Name. Case sensitive.
Note: Entered value will be compared to trigger description (name) with all macros expanded.
Trigger severity =
<>
>=
<=
Compare with Trigger Severity. = - equal to trigger severity
<> - not equal to trigger severity
>= - more or equal to trigger severity
<= - less or equal to trigger severity
Trigger value = Compare with Trigger Value.
= - equal to trigger value (OK or PROBLEM)
Time period in in Event is within time period.
in - event time matches the time period.
See Time period specification page for description of the format.
Maintenance status =
<>
Check if host is in maintenance.
= - Host is in maintenance mode.
<> - Host is not in maintenance mode.

Trigger value:

Trigger changes status from OK to PROBLEM (trigger value is PROBLEM) Trigger changes status from PROBLEM to OK (trigger value is OK)

Status change OK→UNKNOWN→PROBLEM is treated as OK→PROBLEM, and PROBLEM→UNKNOWN→OK as PROBLEM→OK.

The following conditions can be defined for Discovery based events:

Condition type Supported operators Description
Host IP =
<>
Check if IP address of a discovered Host is or is not in the range of IP addresses.
= - Host IP is in the range
<> - Host IP is out of the range
Service type =
<>
Check if a discovered service.
= - matches discovered service
<> - event came from a different service
Service port =
<>
Check if TCP port number of a discovered service is or is not in the range of ports.
= - service port is in the range
<> - service port is out of the range
Discovery status = Up - matches Host Up and Service Up events
Down - matches Host Down and Service Down events
Uptime/Downtime >=
<=
Downtime for Host Down and Service Down events. Uptime for Host Up and Service Up events.
>= - uptime/downtime is more or equal
<= - uptime/downtime is less or equal. Parameter is given in seconds.
Received value =
<>
>=
<=
like
not like
Compare with value received from an agent (Zabbix, SNMP). String comparison.
= - equal to the value
<> - not equal to the value
>= - more or equal to the value
<= - less or equal to the value
like - has a substring
not like - does not have a substring. Parameter is given as a string.

For example this set of conditions (calculation type: AND/OR):

  • Host group = Oracle servers
  • Host group = MySQL servers
  • Trigger name like 'Database is down'
  • Trigger name like 'Database is unavailable'

is evaluated as

(Host group = Oracle servers or Host group = MySQL servers) and (Trigger name like 'Database is down' or Trigger name like 'Database is unavailable')

Operations

Operation or a set of operations is executed when event matches conditions.

Zabbix supports the following operations:

To successfully receive and read e-mails from Zabbix, e-mail servers/clients must support standard 'SMTP/MIME e-mail' format since Zabbix sends UTF-8 data. Starting from 1.8.2 the subject and the body of the message are base64-encoded to follow 'SMTP/MIME e-mail' format standard.

Starting with 1.8.3, if the subject contains ASCII characters only, it is not UTF-8 encoded.

Additional operations available for discovery events:

  • Add host
  • Remove host
  • Enable host
  • Disable host
  • Add to group
  • Delete from group
  • Link to template
  • Unlink from template

When adding a host, its name is decided by standard gethostbyname function. If the host can be resolved, resolved name is used. If not, IP address is used. Besides, if IPv6 address must be used for a host name, then all ":" (colons) are replaced by "_" (underscores), since ":" (colons) are not allowed in host names.

If performing discovery by a proxy, currently hostname lookup still takes place on Zabbix server.

If a host exists in Zabbix configuration with the same name as a newly discovered one, versions of Zabbix prior to 1.8 would add another host with the same name. Zabbix 1.8.1 and later adds _N to the hostname, where N is increasing number, starting with 2.

Operation attributes:

Parameter Description
Step If escalation is enabled for this action, escalation settings:
From - execute for each step starting from this one
To - till this (0, for all steps starting from From)
Period - increase step number after this period, 0 - use default period.
Operation type Type of action:
Send message - send message to user
Execute command - execute remote command
Event Source
Send message to Send message to:
Single user - a single user
User group - to all members of a group
Default message If selected, default message will be used.
Subject Subject of the message. The subject may contain macros.
Message The message itself. The message may contain macros.
Remote command List of remote commands.

Starting from 1.6.2, Zabbix sends notifications only to those users, which have read permissions to a host (trigger), which generated the event. At least one host of a trigger expression must be accessible.

As with some triggers event generation can be defined for every PROBLEM evaluation of the trigger, it is worthy of note that if escalations are defined for actions on these events, the execution of each new escalation supersedes the previous escalation, but for at least one escalation step that is always executed on the previous escalation.

Macros for messages and remote commands

The macros can be used for more efficient reporting.

Example 1

Subject:

{TRIGGER.NAME}: {TRIGGER.STATUS}

Message subject will be replaced by something like:

Processor load is too high on server zabbix.zabbix.com: PROBLEM
Example 2

Message:

Processor load is: {zabbix.zabbix.com:system.cpu.load[,avg1].last(0)}

The message will be replaced by something like:

Processor load is: 1.45
Example 3

Message:

Latest value: {{HOSTNAME}:{TRIGGER.KEY}.last(0)}
       MAX for 15 minutes: {{HOSTNAME}:{TRIGGER.KEY}.max(900)}
       MIN for 15 minutes: {{HOSTNAME}:{TRIGGER.KEY}.min(900)}

The message will be replaced by something like:

Latest value: 1.45
       MAX for 15 minutes: 2.33
       MIN for 15 minutes: 1.01