Zabbix Documentation 3.2

2.23.04.0 (current)In development:4.2 (devel)Unsupported:1.82.02.43.23.4

User Tools

Site Tools


manual:config:event_correlation:global

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
manual:config:event_correlation:global [2017/10/23 08:00]
martins-v 'event tag pair' is useful for comparing runtime values
manual:config:event_correlation:global [2018/12/19 09:10] (current)
martins-v simplifying description of correlation conditions
Line 41: Line 41:
 |//Type of calculation//​ |The following options of calculating conditions are available:​\\ **And** - all conditions must be met\\ **Or** - enough if one condition is met\\ **And/Or** - AND with different condition types and OR with the same condition type\\ **Custom expression** - a user-defined calculation formula for evaluating action conditions. It must include all conditions (represented as uppercase letters A, B, C, ...) and may include spaces, tabs, brackets ( ), **and** (case sensitive), **or** (case sensitive). ​ | |//Type of calculation//​ |The following options of calculating conditions are available:​\\ **And** - all conditions must be met\\ **Or** - enough if one condition is met\\ **And/Or** - AND with different condition types and OR with the same condition type\\ **Custom expression** - a user-defined calculation formula for evaluating action conditions. It must include all conditions (represented as uppercase letters A, B, C, ...) and may include spaces, tabs, brackets ( ), **and** (case sensitive), **or** (case sensitive). ​ |
 |//​Conditions// ​         |List of conditions, as selected from the //New condition// field. ​ | |//​Conditions// ​         |List of conditions, as selected from the //New condition// field. ​ |
-|//New condition// ​      ​|Select conditions ​upon which events ​are correlated ​and click on //Add//. The following conditions are available:​\\ **Old event tag** - match new event to the old event(s) that has the corresponding ​old event tag\\ **New event tag** - match new event that has the corresponding ​event tag to old event(s)\\ **New event host group** - match new event that belongs to the corresponding ​host group to old event(s)\\ **Event tag pair** - match new event to the old event(s) if the **values** of the specified ​tags in both events match. Tag //names// need not match.\\ This option is useful for matching runtime values, which may not be known at the time of configuration (see also [[:​manual/​config/​event_correlation/​global#​examples|Example 1]]).\\ **Old event tag value** - match new event to the old event(s) that:\\ //=// -  has the corresponding ​old event tag value\\ //​%%<>​%%//​ - does not have the corresponding ​old event tag value\\ //like// - has the corresponding ​string in the old event tag value\\ //not like// - does not have this string in the corresponding ​old event tag value\\ **New event tag value** - match new event to old event(s) if the new event:\\ //=// - has the corresponding ​new event tag value\\ //​%%<>​%%//​ - does not have the corresponding ​new event tag value\\ //like// - has the corresponding ​string in the new event tag value\\ //not like// - does not have this string in the corresponding ​new event tag value  |+|//New condition// ​      ​|Select conditions ​for correlating ​events and click on //Add//.\\ //Note// that if no old event condition is specified, all old events may be matched and closed. Similarly if no new event condition is specified, all new events may be matched and closed. \\ The following conditions are available:​\\ **Old event tag** - specify ​the old event tag for matching.\\ **New event tag** - specify the new event tag for matching.\\ **New event host group** - specify the new event host group for matching.\\ **Event tag pair** - specify ​new event tag and old event tag for matching. In this case there will be a match if the **values** of the tags in both events match. Tag //names// need not match.\\ This option is useful for matching runtime values, which may not be known at the time of configuration (see also [[:​manual/​config/​event_correlation/​global#​examples|Example 1]]).\\ **Old event tag value** - specify ​the old event tag name and value for matching, using the following operators:\\ //=// - has the old event tag value\\ //​%%<>​%%//​ - does not have the old event tag value\\ //like// - has the string in the old event tag value\\ //not like// - does not have the string in the old event tag value\\ **New event tag value** - specify ​the new event tag name and value for matching, using the following operators:\\ //=// - has the new event tag value\\ //​%%<>​%%//​ - does not have the new event tag value\\ //like// - has the string in the new event tag value\\ //not like// - does not have the string in the new event tag value  |
 |//​Description// ​        ​|Correlation rule description. ​ | |//​Description// ​        ​|Correlation rule description. ​ |
 |//​Enabled// ​            |If you mark this checkbox, the correlation rule will be enabled. ​ | |//​Enabled// ​            |If you mark this checkbox, the correlation rule will be enabled. ​ |