What to do about flapping alerts

[gaidukas]

Hello and sorry if this is a dumb question...

I have about 100 hosts being monitored and 95% are all linux. Most of them are very similar so I'm mainly using the default template which is working well for almost all hosts. There is however a couple of hosts that are currently falling out of some trigger limits. I consider the triggers correct (CPU load too high, disk io to high, ...) but can not fix the issue on the host at this time. This is leading to many dozens of email alerts and causing us to start ignoring all emailed alerts.

My main question is, how do I ether:

(a) Acknowledge the alert and temporary disable the individual trigger for just the host causing the issue?

or

(b) Change the trigger level for the individual trigger and host with out changing the template that is being use by many hosts?

Thanks!

-Glen

[tchjts1]

I think either approach would be fine.

My preference would be to disable the existing trigger on the problem host, then still at the host level, clone the original trigger and adjust the new trigger threshold as necessary.

(When you are looking at the original trigger, you will see a "clone" option at the bottom.)

This way you are still going to get alerts if there is a serious threshold breach, while keeping the original trigger assigned to the host - but in a disabled state.

[gaidukas]

This seems to be what I was looking for.

Thanks!

-Glen

[harmonica]

Another approach is to use trigger Hysteresis

https://www.zabbix.com/documentation/1.8/manual/config/triggers

Regards

[heaje]

Yet another approach that I use it to use macros in the trigger thresholds. Define the macro on the template and then override it on hosts as necessary.

[Alexei]

Use of macros is the only practical way to define "exceptions" for individual hosts.

[seanwasere]

In this video I demonstrate Hysterisis, Manual Close, and Alert severity to manage the amount of alerts I get.