Log Zabbix Triggers in a flat file

[sevpay]

OS - RHEL 6.4
Zabbix Server and Agent version - 2.2.3

Is it possible to have Zabbix log a trigger status change to a flat file?

I know that I can capture these from the web interface, but it would be nice to be able to see the events from the command line if I am dialing into the system remotely and have limited bandwidth.

Example:

In Zabbix, the trigger "Memory Utilization Exceeding 80% on xxx.yyy.com" is triggered by a VM with excessive memory utilization

A log file in /var/log/zabbix/ on the Zabbix server displays something along the lines of:
time date "Memory Utilization Exceeding 80% on xxx.yyy.com"

[simoon]

Maybe its a way for you:

https://www.zabbix.com/documentation/2.2/manual/api/reference/event/get

[sevpay]

I was looking into the same thing yesterday afternoon. Currently, I am trying to use a Python script that will go out and make the call to the API to return what I am looking for. I will update this post if I manage to get it working.

[sevpay]

I figured it out how to do it. I wrote a python script that interfaces with the API and returns the events related to triggers in the past hour. I then setup a cronjob to run the script every and append the results to /var/log/zabbix/zabbix_events.log

#!/usr/bin/env python

import os
import sys
import urllib2
import hashlib
import time
import datetime
try:
    import json
except ImportError:
    import simplejson as json

from pprint import pprint

url     = "http://test.zabbix.com/zabbix/api_jsonrpc.php"
usr     = "Admin"
passwrd = "zabbix"
date    = int(round(time.time()))
olddate = int(round(time.time() - 3600))

hash_pass = ""

def zbxAuth():
   global hash_pass
   login = {
      "jsonrpc" : "2.0",
      "method"  : "user.login",
      "params"  : {
         "user"     : usr,
         "password" : passwrd
      },
      "id"     : 1
   }
   res = printResult(login)
   hash_pass=res["result"]

def zbxImport():
   global hash_pass

   imprt = {
      "jsonrpc": "2.0",
      "method" : "event.get",
      "params" : {
        "output": "extend",
        "time_till": date,
        "time_from": olddate,
        "object": "0",
        "sortfield": ["clock", "eventid"],
        "sortorder": "desc",
        "selectRelatedObject": ["description", "value"],
        "selectHosts": ["name"]
       },
      "auth" : hash_pass,
       "id"   : 2
   }


   res = printResult(imprt)
   for key in res["result"]:
       if int(key["value"]) == 0:
           status = "RESOLVED"
       else:
           status = "ERROR"

       genTime = datetime.datetime.fromtimestamp( int(key["clock"]) ).strftime('%Y-%m-%d %H:%M:%S')
       print genTime,"|",status,"|",key["relatedObject"]["description"],"on host",key["hosts"][0]["name"]


def printResult(var):
   data = json.dumps(var)
   request = urllib2.Request(url, data, {"Content-Type" : "application/json"})
   response = urllib2.urlopen(request)
   return json.load(response)


if __name__ == "__main__":
   zbxAuth()
   zbxImport()

It may not be the prettiest, but it works.

The results look similar to below:

2014-09-10 16:47:25 | ERROR | CPU Utilization is over 75% on host host.zabbix.com
2014-09-10 16:57:25 | RESOLVED | CPU Utilization is over 75% on host host.zabbix.com