link problem/recovery in trigger

[str4ngr]

Hi,

have been trying out zabbix today, considering using it instead of nagois.

In a trigger, there is a Problem expression and a Recovery expression. Let's say a problem is identified like "Problem xxxa occurred in element yyy". When the problem is corrected it is identified by "Recovery of xxxa in yyy". There could be different problems from the same host and in the same element, like "Problem xxxb occured in element yyy". The same problem could occur in a different element and vice versa.


What do I do to link problem and recovery?

[brunohl]

I didn't understand what you are asking, could you give a concrete example on how this idea is applied,

[1berto]

I think i didn't get what you want...
But if what you want is to 'log' the openings, updates and recoveries of problems, it's possible...
In the server: Configuration, Action, Event Source: Trigger, create action
Give name, add a condition, update, Create a operation... Lets Say, Current Host, remote command... Server This Machine (The server itself, you can also run on proxies and passive agents). you can create an action like:
echo "Host {HOST.NAME}, Problem detected: {EVENT.ID} {EVENT.NAME} em {EVENT.DATE} {EVENT.TIME}" >> /var/log/zabbix/triggers_history.log
Also create another recovery action with the same idea.
Be carefull to add and update everything to don't lose your work.

[str4ngr]

Thanks for your input, I will try to elaborate.

I have many hosts sending snmp traps to zabbix server. The hosts are configured with a snmp interface, a snmp trap item (type log), and a trigger which successfully reports problem and recovery. The trigger name is something like this

{{ITEM.VALUE}.regsub("(Problem) ([0-9]{5}) ([^\s]+) (1|0) (.*)", \1 \3 \5)}

This will display eg. "Problem xxxa yyy" in the dashboard when snmp trap is recieved. Expressions looks like this

Problem expr:
(({<hostname>:snmptrap.fallback.regexp(Problem)})< >0)
Recovery expr:
(({<hostname>:snmptrap.fallback.regexp(Recovery)}) <>0)

But on each host I need to distinguish between the different type of problems, and the element where the problem occurred. Right now, recovery of problem xxxb in element yyy will recover any problem while it should only recover xxxb in yyy. The type of problem and element cannot be hardcoded, but it can be identified with regexp; problem id will be in group 3 and element in group 5 in the trigger name regexp above.

Maybe (probably) I am approaching this the wrong way, let me know.

Regards

[brunohl]

I think that you cannot do this with just one trigger.

I don't know if this will help you, but maybe try discovery, create a key that generates itens and triggers automatically based on each thing that you want to monitor on your log.

[str4ngr]

Thanks brunohl,

It is not a requirement that everything should be in one trigger. What is a requirement though is the ability to dynamically identify "problem id" and "element id".

can you give an example of how to configure the discovery approach?

Any one else have an idea on how to solve this?

br

[brunohl]

Here there's some material on LLD

Basically what you need is to set up an item that generates you a JSON response, so you can parse it and create items from it, like filesystem discovery:

{
  "data": [
    {
      "{#FSNAME}": "/",
      "{#FSTYPE}": "rootfs"
    },
    {
      "{#FSNAME}": "/sys",
      "{#FSTYPE}": "sysfs"
    },
    {
      "{#FSNAME}": "/proc",
      "{#FSTYPE}": "proc"
    },
    {
      "{#FSNAME}": "/dev",
      "{#FSTYPE}": "devtmpfs"
    },
    {
      "{#FSNAME}": "/sys/kernel/security",
      "{#FSTYPE}": "securityfs"
    },
    {
      "{#FSNAME}": "/dev/shm",
      "{#FSTYPE}": "tmpfs"
    }
  ]
}

Then, you create an item and a trigger based on each condition.