zabbix report on how many times trigger was fired and when

[singhn]

Hi,

We are trying to reduce the alert noise. Most of the time these alerts get closed by itself after some time. In order to start working on these alerts. I checked Triggers Top 100. It shows the host, trigger, severity and number of status changes.

Is it possible to pull out a report on when these status change occured? I have looked around but couldn't find a way or report that will show me how many times & and when the trigger was fired & closed.

Appreciate your assistance on this.

Thanks,
Navdeep

[tim.mooney]

There's a lot that's possible through the API, even if there isn't (currently) a built-in report that gives you the data you want.

If you know how to program in any modern language (scripting languages like PowerShell, Python, PHP, Ruby, or other, as well as compiled languages, though a compiled language like C++ or go would be overkill for this), the API exposes the endpoints you would need to design your own query and generate a report in whatever format you want. There are also lots of examples of code out there for accessing the Zabbix API.

[singhn]

Thanks tim.mooney . I am familiar with PowerShell scripting. Can you help me with some direction on where to start, and what I should be doing to achieve the desired result?

[tim.mooney]

The API is all JSON RPC, so it's basically creating a JSON data structure with your query parameters, submitting it via a HTTP/HTTPS POST, and then interpreting the JSON data structure that you get back.

You may want to take a look at some of the Zabbix PowerShell API code that's out there, as some of it might simplify the to/from JSON portions or make other parts of the API easier. If nothing else, the code can serve as examples of how to do certain things.

You start by calling the 'user.login' method, to authenticate as a Zabbix user. On successful authentication, you get back an authentication token in the JSON response, and you pass that token back as your "I am authenticated" token in each subsequent JSON data structure you use when making API calls.

Since you're mainly interested in problems, I think the main call you'll use is problem.get(). The trick will be figuring out what parameters you need to pass to problem.get. For example, if you're only interested in problems for a particular host group, you first would need to figure out the internal numeric ID for that host group, as that will be the parameter you would need to pass to problem.get.

The other thing you will need to do, after calling problem.get() and getting back a giant JSON data structure, is take any of the itemid or hostid values (again, the internal numeric ID for an item or a host) and resolve them into the human-readable host or item. That will probably involve a loop, and calling either host.get() or item.get().