1 Trigger for multiple Items

[shlomia]

Hi, I have 2 Items that checks a server partitions size:



I want to use 1 Trigger that will notify me for both Items and what I did in my expression:

{Deployments:vfs.fs.size[C:\,pused].last()}>80
or
{Deployments:vfs.fs.size[D:\,pused].last()}>80

Now, It works but not as I want it to.
if partition D:\ > 80 so I will get a notification but in the notification I will see a problem for C:\ partition and not for D:\.
I checked my actions and I receive notification with {ITEM.NAME}:

Subject:
Problem - {HOST.HOST}: {ITEM.NAME} - {TRIGGER.SEVERITY}
Message:
Problem started at {EVENT.TIME} on {EVENT.DATE}
Problem name: {ITEM.NAME}
Host: {HOST.HOST}
Severity: {TRIGGER.SEVERITY}
Value: {ITEM.VALUE}
Event ID: {EVENT.ID}

But in this case I don't get the right {ITEM.NAME} in my notification.. Why is that? Am I doing something wrong?

Thank you!

[Hamardaban]

Since you have multiple data elements involved in the trigger, you should also use a call to multiple data elements in the message.

https://www.zabbix.com/documentation/current/manual/appendix/macros/supported_by_location

ITEM.NAME<1-9>}

→ Trigger-based notifications and commands → Problem update notifications and commands → Internal notifications

Name of the Nth item (with macros resolved) in the trigger expression that caused a notification.

[shlomia]

Since you have multiple data elements involved in the trigger, you should also use a call to multiple data elements in the message.

https://www.zabbix.com/documentation/current/manual/appendix/macros/supported_by_location

Thank you for the reply! Is there any chance you can show me an example on how to call multiple data elements in the message?
I have 1 action with no condition for all my triggers with the following message:

[shlomia]

Some examples: https://www.zabbix.com/documentation...eration/macros
Look example 5

Hi, So if I will use this example, I will receive 1 notification with all the items values associated with this trigger ?
Can I somehow receive a notification with only the problematic item ?

[shlomia]

Hi, So if I will use this example, I will receive 1 notification with all the items values associated with this trigger ?
Can I somehow receive a notification with only the problematic item ?

Bump......

[shlomia]

yes
and yes

If you have trigger like "itemA > 1 and itemB > 10" you can make template to show values for both items or only for one of them.
If you want separate messages for itemA and itemB you need different message templates.
Easiest is to make two separate triggers and connect them to two different template messages.

If you must have one trigger and want to use it with more than one template then you need to use tags. But I will not explain this because it is too complicated.

Thank you, I appreciate it!

[RaulChiarella]

Thank you, I appreciate it!

Hello...
Did you get this working? I took a look into the documentation and did some testing but i still couldnt figure it out how to print the specific item that triggered the event...

[shlomia]

Hello...
Did you get this working? I took a look into the documentation and did some testing but i still couldnt figure it out how to print the specific item that triggered the event...

Sorry but no
I didn't have the time to dig into it too much
good luck though..

[markfree]

If your triggers starts a notification and your "problem name" points to C: partition, its because your action message uses macro {ITEM.NAME} with no index. This will resolve to the first item name in the order in which it appears in the expression.

Using Shlomia example, it would be something like this:

{ITEM.NAME1} = Deployments:vfs.fs.size[C:\,pused]
{ITEM.NAME2} = Deployments:vfs.fs.size[D:\,pused]

So, if you use this macro with an index, it should notify you for the specified item.

The issue with that is the macro will always point to the "name of the Nth item in the trigger expression".
If you use {ITEM.NAME2} in your macro message, it will always notify for the second item in the expression, even if the trigger was started for the first item.

So, the way I see it, the best scenario would be to use two triggers, one for each item.

[RaulChiarella]

Unfortunately like Shlomia here even with all the responses on this post i could'nt get it working... I need some more testing and information so i can get it working. I did try using those macros - Item.name2, 1, etc... But everytime i used this the return instead of giving me the actual item only gave me "UNKNOWN" when sending me the message... :|

[RaulChiarella]

Sorry but no
I didn't have the time to dig into it too much
good luck though..

Oh... Thats sad to hear.
I have a trigger with the name "XAMPP Conn problem" that has the following items:

{Monitor XAMPP.test.rspcode[Status Web,Apache URL web].nodata(5m)}=1 or
{Monitor XAMPP:net.tcp.service[tcp,{HOST.IP},80].count(#10,0,eq)}=10 or
{Monitor XAMPP:net.tcp.service[tcp,{HOST.IP},443].count(#10,0,eq)}=10 or
{Monitor XAMPP:net.tcp.service[tcp,{HOST.IP},3306].count(#10,0,eq)}=10 or
{Monitor XAMPP:service.info[Apache2.4].count(#10,0,ne)}=10 or
{Monitor XAMPP:net.tcp.service[tcp,{HOST.IP},1433].count(#10,0,eq)}=10

But when i use this Trigger with API i was only able to get Trigger name.
I do not know how to get the exact item that activated the alert...

I will keep looking into it tho. I want this working because i am currently doing a action that sends mail and message so just sending 'Trigger name' and 'Host name' is not detailed enough.
My objective is to send the item that got the problem too...

[sharwood]

FWIW, I added each of the items to the "Operational data" field. I couldn't get ITEM.NAME<1-9> or any other MACRO to resolve other than ITEM.VALUE<1-9> so hardcoded a short description of the item name.
It was a simple trigger to notify me of general login failures with 2 different reason codes

Example:

Failure: {ITEM.VALUE1}; Unauthorized: {ITEM.VALUE2}

---

Note: We're on version 5.4 - earlier posts don't seem to reference "Operational Data" though and I haven't customized any messages so my mail body looks like:

Problem started at xxxx
Problem name: Login Failures threshold exceeded
Host: xxxx
Severity: Information
Operational data: Failure: 0; Unauthorized: 11
Original problem ID: 6800