How to prevent e-mail flooding for multiple triggers all going off at once?

[disposabletaco]

Hi All,

I'm having a rather difficult time finding an answer to this, but is there a way to have Zabbix send one e-mail with a summary of triggers instead of individual e-mails for each trigger?

Here is an example scenario (that just happened):

We have zabbix setup to monitor switches, servers, wifi controllers, etc and it's been working quite well, except for one thing. There are times we will get a metric TON of e-mails from it

For example, we had a power outage at one of our locations which outlasted the UPS for one of the POE switches, which then resulted in the following individual e-mails:

AP #1 is down on wifi controller
AP #2 is down on wifi controller
AP #3 is down on wifi controller
AP #4 is down on wifi controller
AP #5 is down on wifi controller
AP #6 is down on wifi controller
AP #7 is down on wifi controller
POE Switch <name> is unavailable
plus about another 20 similar e-mails

Less than 10 minutes later, once power was restored, we got all of those e-mails again, just marked resolved.

Is there a way to prevent the excessive (and honestly unhelpful) e-mail flooding and simply get a single e-mail that just has something like:

Subject: Multiple Triggers active as of HH:MM on mm-dd-yyyy

Body:
Multiple Triggers active as of HH:MM on mm-dd-yyyy:
POE Switch is unavailable
AP 1 is down
AP 2 is down
etc.

For reference:
We are running Zabbix 4.4 on Ubuntu 18.04 LTS
Everything else with it is working fine
Only other thing on this machine is Grafana (also working fine, gets data from Zabbix no problem)

[Ed.M]

Hi!
You can use trigger dependencies. Read about them here -> https://www.zabbix.com/documentation...s/dependencies
In short if you have a switch and 20 hosts connected to it and switch does down then it is obviously that all hosts will not be accessible. So if you set dependencies correctly Zabbix won't check hosts if switch is inaccessible. And you will get only 1 message about the switch. Hope it helps!

[gofree]

even better solution would be setup tags correlation just another opinion - i every case the trigger for single point of failure needs to be more sensitive than the the triggers for the devices dependent on it - i human words you need to know asap about its outage so the device triggers will be supressed

[disposabletaco]

Thank you, it looks like dependencies are what I need.

However, I can't seem to add them for the AP's - The add option is not there.

The AP triggers appear to have been created by the Aruba OS template (that I got from the Zabbix template site, and it works great) - How do I get around this?

[Ed.M]

Hi! You should add dependencies via Template. Open template, find trigger you need, open it and add dependencies. It will be applied to all hosts using this template over some time.

[disposabletaco]

Thanks, though I am rather confused. Why can't I just add the dependency for each detected AP and their appropriate switch?

In my case, as our AP triggers are defined under our Wifi controller, by template already, all great, except those AP's are physically installed in multiple buildings, across multiple switches, so how would I do that?

Example:

We have Building A, with 10 AP's, SSID, and switches
We have Building B, with 20 AP's, SSID, and switches
We have Building C, with 13 AP's, SSID, and switches
We have Building D, with 8 AP's, SSID, and switches

However, ALL of the AP's in each building report back to our wifi controller, where the triggers for each AP (Building<>_AP##) are defined.

Now if I know that Building A's AP's numbered 1 through 6 are on switch #2, how do I add the dependency for Building A, switch number 2 to the template, but only for those AP's? Because I'll also have AP's 7 & 8, which may be on Switch #1, but 9 & 10 are on switch #3?

Or do I go into the template and add the dependencies for every single switch I have? Won't Zabbix have to check every trigger for every switch for every single AP, even though it'll be checking things it'll never need to for a given AP? In the example above, AP's down in Building C have nothing to do with switch #2 in building A? And if I were to do that, wouldn't I then never get notified if any switch is then down?

Example to further the previous question: If Building C has no power (because say....someone took out a telephone pole), and building A legitimately has an issue, if both building's switches are in the template, wouldn't that prevent me from being notified at all?

I apologize if this sounds rather silly, but the documentation is rather unclear as to how this feature is intended to be used