Ad Widget

Collapse

Zabbix DB query: alerts table

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • zabbix_zen
    Senior Member
    • Jul 2009
    • 426

    #1

    Zabbix DB query: alerts table

    Hi guys.

    Since I've to integrate Zabbix data with another tools like SugarCRM I had the need to start fiddling with querying it's datamodel.
    I'm using MySQL on Zabbix Server 1.6.5

    I started from simple queries like returning all alerts with Status = Problem detected in the last hour
    select subject, message from alerts WHERE clock >= (SELECT UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 1 HOUR))) AND subject like '%CLIENT_NAME%' AND message like '%PROBLEM%' GROUP BY (select DISTINCT clock);

    (works because I configured the actions with Default Message with
    {EVENT.TIME}
    {STATUS} severity {TRIGGER.SEVERITY}
    {TRIGGER.NAME}

    and a recovery one similar but with: ..... Now {STATUS}
    )

    thing is,
    I now need to export both the select, subject but also the time it took for a Problem event to become OK( returning NULL if the Problem isn't solved yet)
    I only figured out that every alert and event have a different id, and they come grouped by the actionid.

    Is there any connection between the Problem alert and the corresponding OK alert that I can use to subtract it's clock value?
    I'm having trouble building the query for this one..

    Thanks in advance!
  • zabbix_zen
    Senior Member
    • Jul 2009
    • 426

    #2
    Can somebody point me in the right direction?
    What I understood from the Manual is that triggers.value:
    1 - means the trigger last value complies with its expression(TRUE)
    0 - don't(FALSE)
    2 - unknown

    but,
    trigger.status:
    0 - FALSE
    1 - TRUE

    what's their difference?
    shouldn't the following query return me all activated triggers from the the last 24h?

    select triggerid, expression, description, status, value, priority, lastchange, error, type from triggers where status=1 AND lastchange >= (SELECT UNIX_TIMESTAMP(DATE_SUB(NOW(), INTERVAL 24 HOUR)));

    Comment

    Working...