EventID differs from problem alert to recovery alert?

[maik1742]

Hello,

I want to use the eventID for a ticketsystem integration. If I get a recovery alert, I want to lookup the corresponding ticket, which was created upon a problem alert.

I've tried to realize this using the eventID. Now I've found out that the
{EVENTID} has different values in the problem alert and the recovery alert.
Is this intended or a bug?

Is there any other macro which has a unique and constant value to identify the problem alert to a recovery alert reliably?

Regards and thanks in advance
Maik

[Entr04y]

I've run into the same thing... so add me to the list of people that would like to see a unique id carried through from item to trigger to event to action to recovery...

[DSon]

Any luck?

Guys,

I'm afraid from my experience with the event log monitoring side of Zabbix it is still a work in progress. Although it has improved slightly since I started testing it out (v.1.4.6), even now it isn't quite functional enough to be suitable for use by a professional support team.

I tried to get assistance with this same problem ("Eventlog monitoring and ITEM.LASTVALUE" - under the "ZABBIX Troubleshooting and Problems" section) but without success. This problem affects any kind of trigger actually, since a trigger containing multiple item conditions confuses Zabbix into reporting the wrong item value for notifications.

I also recently posted a comment ("Event / log monitoring - multiple instances of a search string?" - under this "ZABBIX Help" section) which hilights difficulties when trying to pick up more than one instance of a given event log error, however the lack of a response leads me to believe it isn't possible (even though it is a basic function).

If anyone out there has successfully implemented either:

1) Triggers that pick up more than one instance of search string (ie. not just the first occurrence)
2) Recalling the original value of an item that caused the trigger to be set to true (the documentation refers to certain "historical" values however it seems all Zabbix can do is display the 'n'th item value - there is no "memory" of the original value to cause the trigger I'm afraid)

.. then PLEASE let us all know how you did it!

Alexei,

If you can provide us with a workaround to the already mentioned Zabbix Event log / ITEM.LASTVALUE limitations we would really appreciate it, it's a shame that these issues are spoiling the potential of an otherwise fantastic (especially considering it is free!) product. I'm trying to convince my IT manager to purchase some Zabbix training courses. If I can prove to him that Zabbix can do what we need, it would help!


Danny.

[alixen]

Hi,

We have the same problem as Maik.
We have to correlate recovery messages with corresponding alerts to automatically open and close tickets.

Since EVENTID is not the same, we have tried to find some other macro that would help with no luck.

Has anybody found a solution or a workaround to this problem ?

Thanks
Alixen

[richlv]

it would probably be best done by introducing a new macro, {EVENTID.SRC}/ORIG or whatever. is there a feature request on the tracker about this ?

[alixen]

Hi,

it would probably be best done by introducing a new macro, {EVENTID.SRC}/ORIG or whatever. is there a feature request on the tracker about this ?

I haven't found a corresponding issue on the tracker so I have created a new one:

https://support.zabbix.com/browse/ZBXNEXT-384

Since other people on this thread have the same problem, please vote for it

Regards,
Alixen

[DSon]

Thanks!

Much appreciated, Alixen!

I shall follow the progress of this report, see if a solution makes its way into a future release.

I've also mentioned the usefulness of having another macro to track the event entry that fixed the problem e.g. {EVENT.RECOVER}. This way, our support team are aware of which event caused the "OK" trigger.

Danny.

[ironstorm]

Patch submitted

Since my company (2Keys.ca) needs the capability to track incidents and their resolutions in a bug tracker, I've gone ahead and created a patch that exposes the Escalation's Event ID and attached that to the Zabbix bug ticket.

https://support.zabbix.com/browse/ZBXNEXT-384

The patch adds {ESC.ORIGIN.EVENT.ID} to the list of Action message macros that can be used... This id value is the same for both problem and recovery messages.

[eskytthe]

Thanks ironstorm! this is a nice patch I will make use of.
BR
/Erik

[ironstorm]

Just a quick follow-up note to this, I've created another patch to help with automatic ticket generation for bug trackers such as JIRA (possibly bugzilla and others).

https://support.zabbix.com/browse/ZBXNEXT-1001

The patch translates Zabbix Trigger Severity into Tracker Bug Priority, please vote it up if you think this will be helpful to you.