Problem with the alert notifications in the Dashboard

[javier.andres]

Hello,

I've a little problem with the alert notifications in my dashboard...

I've created an item (log type) for monitoring a log file:

log[C:\app\app.log,error]

I've created a trigger for this item:

(({Template_app:log[C:\app\app.log,error].regexp(error)})#0)

The trigger works OK: when an error appears in app.log, I can see an alert message in the dashboard.

Then, I switch the status of the Ack to "yes", but after several minutes, the Disaster column and "With problems" column are still in red colour.

https://docs.google.com/leaf?id=0B9ehzLIBCThIYTI5OTA4NTItNGNlNC00MGVhLWJjMmYtNzJiODEyYjkyNTBh&sort=name&layout=list&num=50

How can I clear the alarm after I have already treated it (Ack --> Yes)?

Thanks!

[Mick7]

Well, thats how zabbix work. He found something you defined as error and now the Trigger has the status "Problem".
The trick is to change the Trigger Status back to "OK".
There are two ways to do it.

The first regular would be, to wait until the logentry is regular and dont report an error anymore.
Second way is to use the nodata parameter (for example for the windows System eventlog)

{your_trigger_entry}|({TRIGGER.VALUE}=1)&({mytempl ate:eventlog[System].nodata(30)}#1)

This will set the Trigger status to back to "OK" if he didnt get another error within the next 30 seconds. Depending on your configuration the errors shown at the dashboard should vanish after a short time too.

Hope this helps, but if not (im pretty new to zabbix too), just search the Forum for Triggers. Tons of informations are here.

[javier.andres]

Thanks Mick7!

On the first way you say, the problem is that my agent zabbix only sends an information line when he finds the "error" word, only in that case. It is not advisable to send the entire log because it may take much.

Then if I wait, the only thing that can get is another alarm, and as you say, the trigger status will be always "PROBLEM", never "OK".

The second method could be used, but the problem is that the user may not ever see on his Dashboard who has had a problem...

I think that a good improvement for Zabbix would be that when the user clicks on the "ack" link, in several minutes the alert disappeared on the Dashboard. With this action, you would be telling Zabbix that the problem is controlled.