2022 Zabbix中国峰会
2022 Zabbix中国峰会

1 条件

1 Conditions

概述

Overview

只有在事件与定义的条件匹配的情况下才执行操作。 配置动作时设置条件。

An action is executed only in case an event matches a defined set of conditions. Conditions are set when configuring an 动作.

可以为基于触发的动作设置以下条件:

The following conditions can be set for trigger-based actions:

条件类型 支持的 作 说明
Application =
like
not like
指定要排除的应用程序或应用程序.
= -事件属于与指定应用程序链接的项目的触发器.
like - 事件属于与包含字符串的应用程序链接的项目的触发器.
not like -事件属于链接到不包含字符串的应用程序的项目的触发器.
Host group =
<>
指定要排除的主机组或主机组.
= - 事件属于此主机组.
<> - 事件不属于此主机组.
指定父主机组隐含地选择所有嵌套的主机组.要仅指定父组,必须使用** %% <> %% 运算符另外设置所有嵌套组.| |Template|=
<>|指定要排除的模板或模板.
=** - 属于从此模板继承的触发器的事件.
<> - 不属于从此模板继承的触发器的事件.
Host =
<>
指定要排除的主机或主机
= - 属于这个主机的事件.
<> - 不属于这个主机的事件.
Tag =
<>
like
not like
指定事件标记或要排除的事件标记.
= - 含有该标记的事件
<> - 不含该标记的事件
like -标签中包含此字符串的事件
not like - 标签中不包含此字符串的事件
Tag value =
<>
like
not like
指定事件标签和值组合或要排除的标签和值组合
= - 包含该值和标签的事件
<> -不包含该值和标签的事件
like - 值和标签中包含该字符串的事件
not like - 值和标签中不包含该字符串的事件
Trigger =
<>
指定触发器或要排除的触发器.
= - 由该触发器产生的事件
<> - 除了这一个,由任何其他触发器生成的事件.
Trigger name like
not like
在触发器名称中指定一个字符串或要排除的字符串.
like - 事件由触发器生成,在名称中包含此字符串.区分大小写.
not like - 触发器名称中不包含该字符串. 区分大小写.
Note: 输入的值将与所有宏扩展的触发器名称进行比较.
Trigger severity =
<>
>=
<=
指定触发严重性.
= - 等于触发严重性
<> - 不等于触发严重性
>= - 大于或等于触发严重性
<= - 小于或等于触发严重性.
Time period in
not in
指定时间段或要排除的时间段.
in - 事件时间在该时间段内.
not in - 事件时间不在该时间段内.
格式描述参见 Time period specification 页面.
Maintenance status in
not in
指定主机进行维护或不进行维护.
in - 主机处于维护模式.
not in - 主机不在维护模式.
Note: 如果触发表达式中涉及到多个主机,则至少有一个主机不在维护模式下,条件匹配.
Condition type Supported operators Description
Application =
like
not like
Specify an application or an application to exclude.
= - event belongs to a trigger of the item that is linked to the specified application.
like - event belongs to a trigger of the item that is linked to an application containing the string.
not like - event belongs to a trigger of the item that is linked to an application not containing the string.
Host group =
<>
Specify host groups or host groups to exclude.
= - event belongs to this host group.
<> - event does not belong to this host group.
Specifying a parent host group implicitly selects all nested host groups. To specify the parent group only, all nested groups have to be additionally set with the <> operator.
Template =
<>
Specify templates or templates to exclude.
= - event belongs to a trigger inherited from this template.
<> - event does not belong to a trigger inherited from this template.
Host =
<>
Specify hosts or hosts to exclude.
= - event belongs to this host.
<> - event does not belong to this host.
Tag =
<>
like
not like
Specify event tag or event tag to exclude.
= - event has this tag
<> - event does not have this tag
like - event has a tag containing this string
not like - event does not have a tag containing this string
Tag value =
<>
like
not like
Specify event tag and value combination or tag and value combination to exclude.
= - event has this tag and value
<> - event does not have this tag and value
like - event has a tag and value containing these strings
not like - event does not have a tag and value containing these strings
Trigger =
<>
Specify triggers or triggers to exclude.
= - event is generated by this trigger.
<> - event is generated by any other trigger, except this one.
Trigger name like
not like
Specify a string in the trigger name or a string to exclude.
like - event is generated by a trigger, containing this string in the name. Case sensitive.
not like - this string cannot be found in the trigger name. Case sensitive.
Note: Entered value will be compared to trigger name with all macros expanded.
Trigger severity =
<>
>=
<=
Specify trigger severity.
= - equal to trigger severity
<> - not equal to trigger severity
>= - more or equal to trigger severity
<= - less or equal to trigger severity
Time period in
not in
Specify a time period or a time period to exclude.
in - event time is within the time period.
not in - event time is not within the time period.
See the time period specification page for description of the format.
User macros are supported, since Zabbix 3.4.0.
Maintenance status in
not in
Specify a host in maintenance or not in maintenance.
in - host is in maintenance mode.
not in - host is not in maintenance mode.
Note: If several hosts are involved in the trigger expression, the condition matches if at least one of the hosts is/is not in maintenance mode.

可以为基于发现的事件设置以下条件:

The following conditions can be set for discovery-based events:

条件类型 支持的 作 说明
Host IP =
<>
指定要发现的主机的IP地址范围或要排除的范围.
= -主机IP在该范围内.
<> - 主机IP不在该范围内.
它可能有以下格式:
单IP: 192.168.1.33
IP地址范围: 192.168.1-10.1-254
IP mask: 192.168.4.0/24
List: 192.168.1.1-254, 192.168.2.1-100, 192.168.2.200, 192.168.4.0/24 自Zabbix 3.0.0起就提供列表格式的空格.
Service type =
<>
指定已发现服务的服务类型或者要排除的服务类型.
= - 匹配发现的服务.
<> -与发现的服务不匹配.
可用服务类型:SSH, LDAP, SMTP, FTP, HTTP, HTTPS (available since Zabbix 2.2 version), POP, NNTP, IMAP, TCP, Zabbix agent, SNMPv1 agent, SNMPv2 agent, SNMPv3 agent, ICMP ping, telnet (available since Zabbix 2.2 version).
Service port =
<>
指定发现的服务或的TCP端口范围或者要排除的TCP端口范围.
= - 服务端口在该范围内.
<> - 服务端口不在该范围内.
Discovery rule =
<>
指定发现规则或要排除的发现规则.
= - 使用这个发现规则.
<> - 使用除此之外的任何其他发现规则.
Discovery check =
<>
指定discovery check或要排除的discovery check
= - 使用这个 discovery check.
<> -使用除此之外的其他任何discovery check.
Discovery object = 指定发现的对象.
= - 等于发现的对象(设备或服务).
Discovery status = Up -匹配'Host Up' 和 'Service Up' 事件
Down - 匹配'Host Down' 和 'Service Down' 事件
Discovered - 匹配 'Host Discovered' 和 'Service Discovered' 事件
Lost - 匹配 'Host Lost' 和 'Service Lost' 事件.
Uptime/Downtime >=
<=
Uptime for 'Host Up' and 'Service Up' events. Downtime for 'Host Down' and 'Service Down' events.
>= -大于或者等于. 参数以秒为单位给出。
<= -小于或等于. 参数以秒为单位给出.
Received value =
<>
>=
<=
like
not like
指定从代理接收的值(Zabbix,SNMP).区分大小写字符串比较. 如果为规则配置了多个Zabbix代理或SNMP检查,则检查所有的Zabbix代理或SNMP检查(每个检查生成与所有条件匹配的新事件).
= - 等于该值.
<> - 不等于该值.
>= - 大于或者等于该值.
<= - 小于或者等于该值.
like -包含子串。参数作为字符串给出.
not like - 不包含子串. 参数作为字符串给出.
Proxy =
<>
指定代理或要排除的代理.
= - 使用这个代理.
<> -使用除此之外的任何其他代理.
Condition type Supported operators Description
Host IP =
<>
Specify an IP address range or a range to exclude for a discovered host.
= - host IP is in the range.
<> - host IP is not in the range.
It may have the following formats:
Single IP: 192.168.1.33
Range of IP addresses: 192.168.1-10.1-254
IP mask: 192.168.4.0/24
List: 192.168.1.1-254, 192.168.2.1-100, 192.168.2.200, 192.168.4.0/24
Support for spaces in the list format is provided since Zabbix 3.0.0.
Service type =
<>
Specify a service type of a discovered service or a service type to exclude.
= - matches the discovered service.
<> - does not match the discovered service.
Available service types: SSH, LDAP, SMTP, FTP, HTTP, HTTPS (available since Zabbix 2.2 version), POP, NNTP, IMAP, TCP, Zabbix agent, SNMPv1 agent, SNMPv2 agent, SNMPv3 agent, ICMP ping, telnet (available since Zabbix 2.2 version).
Service port =
<>
Specify a TCP port range of a discovered service or a range to exclude.
= - service port is in the range.
<> - service port is not in the range.
Discovery rule =
<>
Specify a discovery rule or a discovery rule to exclude.
= - using this discovery rule.
<> - using any other discovery rule, except this one.
Discovery check =
<>
Specify a discovery check or a discovery check to exclude.
= - using this discovery check.
<> - using any other discovery check, except this one.
Discovery object = Specify the discovered object.
= - equal to discovered object (a device or a service).
Discovery status = Up - matches 'Host Up' and 'Service Up' events
Down - matches 'Host Down' and 'Service Down' events
Discovered - matches 'Host Discovered' and 'Service Discovered' events
Lost - matches 'Host Lost' and 'Service Lost' events
Uptime/Downtime >=
<=
Uptime for 'Host Up' and 'Service Up' events. Downtime for 'Host Down' and 'Service Down' events.
>= - is more or equal to. Parameter is given in seconds.
<= - is less or equal to. Parameter is given in seconds.
Received value =
<>
>=
<=
like
not like
Specify the value received from an agent (Zabbix, SNMP) check in a discovery rule. Case sensitive string comparison. If several Zabbix agent or SNMP checks are configured for a rule, received values for each of them are checked (each check generates a new event which is matched against all conditions).
= - equal to the value.
<> - not equal to the value.
>= - more or equal to the value.
<= - less or equal to the value.
like - contains the substring. Parameter is given as a string.
not like - does not contain the substring. Parameter is given as a string.
Proxy =
<>
Specify a proxy or a proxy to exclude.
= - using this proxy.
<> - using any other proxy except this one.

在发现规则里的服务检测,并不是同时发生的。因此,如果动作里multiple 值配置了Service type, Service port or Received value ,他们被视为一次一个发现事件,而不是多个事件。这样,有多个值的同类检测的动作,可能错误地执行。

Service checks in a discovery rule, which result in discovery events, do not take place simultaneously. Therefore, if multiple values are configured for Service type, Service port or Received value conditions in the action, they will be compared to one discovery event at a time, but not to several events simultaneously. As a result, actions with multiple values for the same check types may not be executed correctly.

基于活动代理自动注册的动作可以设置以下条件:

The following conditions can be set for actions based on active agent auto-registration:

条件类型 支持的 作 说明
Host metadata like
not like
指定主机元数据或要排除的主机元数据.
like - 主机元数据包含字符串.
not like - 主机元数据不包含字符串.
可以在代理配置文件中指定主机元数据.
Host name like
not like
指定主机名或要排除的主机名.
like - 包含字符串的主机名.
not like - 不包含字符串的主机名.
Proxy =
<>
指定代理或要排除的代理.
= - 使用这个代理.
<> - 使用除此之外的任何其他代理.
Condition type Supported operators Description
Host metadata like
not like
Specify host metadata or host metadata to exclude.
like - host metadata contains the string.
not like - host metadata does not contain the string.
Host metadata can be specified in an agent configuration file.
Host name like
not like
Specify a host name or a host name to exclude.
like - host name contains the string.
not like - host name does not contain the string.
Proxy =
<>
Specify a proxy or a proxy to exclude.
= - using this proxy.
<> - using any other proxy except this one.

可以根据内部事件为动作设置以下条件:

The following conditions can be set for actions based on internal events:

Application =
like
not like
指定应用程序或要排除的应用程序.
= - 属于与指定应用程序链接的项的事件.
like - 属于与包含字符串的应用程序链接的项的事件.
not like - 属于不包含字符串的应用程序链接的项的事件.
Event type = Item in "not supported" state - 匹配监控项从“正常”到“不支持”状态的事件
Low-level discovery rule in "not supported" state - 匹配低级发现规则从“正常”到“不支持”状态的事件
Trigger in "unknown" state - 匹配触发从“正常”到“未知”状态的事件
Host group =
<>
指定主机组或要排除的主机组.
= - 属于此主机组的事件.
<> - 不属于此主机组的事件.
Template =
<>
指定模板或要排除的模板.
= -属于从此模板继承的监控项/触发器/低级发现规则的事件.
<> - 不属于从此模板继承的监控项/触发器/低级发现规则的事件.
Host =
<>
指定主机或要排除的主机.
= - 属于这个主机的事件.
<> - 不属于这个主机的事件.
Condition type Supported operators Description
Application =
like
not like
Specify an application or an application to exclude.
= - event belongs to an item that is linked to the specified application.
like - event belongs to an item that is linked to an application containing the string.
not like - event belongs to an item that is linked to an application not containing the string.
Event type = Item in "not supported" state - matches events where an item goes from a 'normal' to 'not supported' state
Low-level discovery rule in "not supported" state - matches events where a low-level discovery rule goes from a 'normal' to 'not supported' state
Trigger in "unknown" state - matches events where a trigger goes from a 'normal' to 'unknown' state
Host group =
<>
Specify host groups or host groups to exclude.
= - event belongs to this host group.
<> - event does not belong to this host group.
Template =
<>
Specify templates or templates to exclude.
= - event belongs to an item/trigger/low-level discovery rule inherited from this template.
<> - event does not belong to an item/trigger/low-level discovery rule inherited from this template.
Host =
<>
Specify hosts or hosts to exclude.
= - event belongs to this host.
<> - event does not belong to this host.

运算类型

Type of calculation

计算条件的以下选项可用:

The following options of calculating conditions are available:

  • And - 必须满足所有条件
  • And - all conditions must be met

请注意,当它们被选为“Trigger =”“条件时,在几个触发器之间不允许使用”And“计算。操作只能根据一个触发事件执行。

Note that using "And" calculation is disallowed between several triggers when they are selected as a Trigger= condition. Actions can only be executed based on the event of one trigger.

  • Or - 如果满足一个条件就足够了
  • And/Or - 两者的组合:AND与不同的条件类型和OR具有相同的条件类型,例如:
  • Or - enough if one condition is met
  • And/Or - combination of the two: AND with different condition types and OR with the same condition type, for example:

Host group = Oracle servers
Host group = MySQL servers
Trigger name like 'Database is down'
Trigger name like 'Database is unavailable'

Host group = Oracle servers
Host group = MySQL servers
Trigger name like 'Database is down'
Trigger name like 'Database is unavailable'

计算为

is evaluated as

(Host group = Oracle servers or Host group = MySQL servers) and (Trigger name like 'Database is down' or Trigger name like 'Database is unavailable')

  • 自定义表达式 - 用户自己定义的动作条件表达式. 必须包含所有的条件 (以大写字母 A, B, C, ...) 以及可能包含空格,制表符,括号,和大小写敏感字符。
  • Custom expression - a user-defined calculation formula for evaluating action conditions. It must include all conditions (represented as uppercase letters A, B, C, ...) and may include spaces, tabs, brackets ( ), and (case sensitive), or (case sensitive).

当前例包含 And/Or ,例如 (A or B) and (C or D), 还可以有等价的其它表达写法:

While the previous example with And/Or would be represented as (A or B) and (C or D), in a custom expression you may as well have multiple other ways of calculation:

(A and B) and (C or D)
(A and B) or (C and D)
((A or B) and C) or D
etc.

由于删除对象,被禁用的actions

Actions disabled due to deleted objects

如果某个操作条件/操作中使用的某个对象(主机,模板,触发器等)被删除,则会删除条件/操作,禁用该操作以避免操作的错误执行。 该操作可以由用户重新启用。

If a certain object (host, template, trigger, etc) used in an action condition/operation is deleted, the condition/operation is removed and the action is disabled to avoid incorrect execution of the action. The action can be re-enabled by the user.

当删除以下项目是会发生这种情况:

This behavior takes place when deleting:

  • 主机组(“主机组”条件,特定主机组上的“远程命令”操作));
  • 主机(“主机”条件,特定主机上的“远程命令”操作);
  • 模板(“模板”条件,“链接到模板”和“与模板的链接”操作);
  • 触发器(“触发”条件);
  • 发现规则(使用“发现规则”和“发现检查”条件时);
  • 代理(“代理”条件)。
  • host groups ("host group" condition, "remote command" operation on a specific host group);
  • hosts ("host" condition, "remote command" operation on a specific host);
  • templates ("template" condition, "link to template" and "unlink from template" operations);
  • triggers ("trigger" condition);
  • discovery rules (when using "discovery rule" and "discovery check" conditions);
  • proxies ("proxy" condition).

Note:如果远程命令有许多目标主机,并且我们删除其中的一个,则只有该主机将从目标列表中删除,操作本身将保留。 但是,如果它是唯一的主机,操作也将被删除。 “链接到模板”和“取消与模板的链接”操作也是一样。

Note: If a remote command has many target hosts, and we delete one of them, only this host will be removed from the target list, the operation itself will remain. But, if it's the only host, the operation will be removed, too. The same goes for "link to template" and "unlink from template" operations.

删除“发送消息”操作中使用的用户或用户组时,操作不会被禁用。

Actions are not disabled when deleting a user or user group used in a "send message" operation.