Action on Trigger Threshold condition?

[kmstrube81]

So I'm looking to create an action that will send an email if a trigger has a certain amount of active problems.

In my case I'm monitoring 150 Windows PCs, a dozen or so switches, about 30 printers, and a half dozen routers. I don't particularly care if a single PC restarts or is ICMP unreachable for 5 minutes so I have zabbix configured to only send emails on triggers that are High Severity or greater. However if I had 25 PCs go down because a leg of our network went down or a switch died etc, I would want to know.

So is there anyway to set up a trigger or action condition that will fire when ICMP unreachable/PC restarted/etc triggers fire on an arbitrary number of hosts?

[BP_Vital]

Hello,we solved similar tasks using aggregate checks.
In you example trigger could be fired, if average ICMP ping is below 0,7.

https://www.zabbix.com/documentation/3.4/manual/config/items/itemtypes/aggregate

[kmstrube81]

Thanks for your help. This seems like it will help solve my problems. Are you aware of a good way to check downtime for windows PCs via zabbix agent? agent.ping just returns 1 or nothing, which means I can't use the average. Should I just set up a simple ICMP check and use that? I'd prefer to use the agent because for some reason my server drops pings for no reason.

[BP_Vital]

Yes, AFAIK grpavg wont work that great with decimal values.
You can try grpsum to get sum of all 1's - number of alive agent.ping and estimate from that?

[kmstrube81]

I was able to get it working this way. Thanks!