using acknowledgements well

[tgsbn]

Coming from Icinga, I notice that some of my work habits are obviously not well adapted to Zabbix. One of them is the way I use acknowledgements.

Typically, when a trigger fires and the problem cannot be solved immediately, I create a trouble ticket and acknowledge the trigger, putting the ticket number in the comment field.
Of course, a single problem often causes many triggers to fire, in which case I want to acknowledge all of them at once with the same comment.
In Zabbix I cannot find a way to do that.
It seems I have to click on each of the umpteen triggers individually, select "Acknowledge", paste the comment, check the "Acknowledge" check box, and click "Update".
Obviously that's not the way the creators of Zabbix intended it to be used.
What is the Zabbix way of handling that?

Also, in my previous work I had a rule that every acknowledgement would have an expiry date so that the alarm would reappear if it hadn't been attended to by that time.
Zabbix acknowledgements don't have an expiry option.
So what is the Zabbix way to achieve that kind of reminder?

[isaqueprofeta]

First thing, go to Monitoring->Problems and select two or more, and at the bottom of the page use "Mass Update" to acknowledge a bunch of triggers in batch. https://www.zabbix.com/documentation...diting_options

Last thing, to workaround "acknowledgements expiration" look at "Actions"->"Escalation" https://www.zabbix.com/documentation...on/escalations

[tim.mooney]

Of course, a single problem often causes many triggers to fire, in which case I want to acknowledge all of them at once with the same comment.
In Zabbix I cannot find a way to do that.

You don't say what version you're using (that's helpful to know, you should always include details about your environment), but at least with Zabbix 4.x:

1. Monitoring->Problems
2. if necessary, use the filtering capabilities at the top of the page to make all the problems you want to acknowledge visible.
3. click the checkbox next to each problem you want to bulk (mass) ackknowlege
4. click the "Mass Update" at the bottom of the page
5. fill in your comment in the box.
6. check the "Acknowledge" box
7. click "Update"

Once you're familiar with the Monitoring->Problems screen, it's handy for a number of things.

I believe earlier versions of Zabbix called that area of the frontend "Events" rather than "Problems", but the idea was the same.

As far as your second question, you might be able to accomplish that with escalations, but if not, I would look into creating an action that has "Problem is suppresed" -> "Yes" as a condition and then experiment with "Default operation step duration" and/or "Operation details" steps and durations. I think the escalation is the thing to try first.

Alternately, if neither of those work for you, another avenue is to use the API to gather the list of problems and generate an external report using a cron job or scheduled task. For example, running it once a week on Monday morning, to remind everyone about acknowledged but unresolved problem events.

However you solve the "acknowledged reminder", please follow-up and post what method you chose. I think it will be very helpful to others.

[tgsbn]

You don't say what version you're using

Ah, yes, sorry, I forgot:
I'm on Zabbix 4.0.23

but at least with Zabbix 4.x:

1. Monitoring->Problems
2. if necessary, use the filtering capabilities at the top of the page to make all the problems you want to acknowledge visible.
3. click the checkbox next to each problem you want to bulk (mass) ackknowlege
4. click the "Mass Update" at the bottom of the page
5. fill in your comment in the box.
6. check the "Acknowledge" box
7. click "Update"

Once you're familiar with the Monitoring->Problems screen, it's handy for a number of things.

Great. Exactly what I was looking for. Thanks a lot!

As far as your second question, you might be able to accomplish that with escalations, but if not, I would look into creating an action that has "Problem is suppresed" -> "Yes" as a condition and then experiment with "Default operation step duration" and/or "Operation details" steps and durations.

Ok, thanks for the hints, will look into that.

Alternately, if neither of those work for you, another avenue is to use the API to gather the list of problems and generate an external report using a cron job or scheduled task.

That's the second time already I am pointed to the API for something I was hoping to achieve through the GUI.
I guess sooner or later I'll have to engage with that, but right now I admit I wouldn't even know where to start.

[tim.mooney]

That's the second time already I am pointed to the API for something I was hoping to achieve through the GUI.
I guess sooner or later I'll have to engage with that, but right now I admit I wouldn't even know where to start.

Not necessarily. What you're asking about probably is achievable through the GUI, and I would definitely recommend you start there.

I only pointed out the API to make sure you're aware that it exists and that it allows you to do a lot of powerful, custom things with Zabbix. With any software that's robust but doesn't have an API (or it's not documented), you are limited to exactly the functionality that the developers chose to provide. When the software has an API that's both documented and has good feature coverage for the product, any limitation of the GUI can potentially be worked around. Good product + good API is always better than good product alone.

As an example, my coworkers have a habit of screwing up one-time maintenance windows, because the GUI effectively makes you specify both an "outer" and an "inner" time period, even if you just want something simple for a machine that needs to be put into maintenance for the next hour or so. To avoid that issue, I wrote a perl script that uses the API to create the maintenance period and allows you to do things like '--start-time now --duration 1h' to create a quick one-time maintenance period. This wouldn't be needed if there was a simple check-box in the GUI to bypass the recurring part of the maintenance window, but the developers have never added that. Because of the API, with a little work I was able to create something that works really well for our environment and saves my coworkers and myself time and potential mistakes.

The API is http/https based and relies on sending JavaScript Object Notation (JSON) formatted text back and forth. There's probably a "wrapper" layer for some language that is used in your environment, and even if not, constructing the JSON directly isn't difficult (it is tedious). There are some basic examples in the documentation appendix and you can find additional examples online. People here will also often help, as time and experience permits of course!

[tgsbn]

As far as your second question, you might be able to accomplish that with escalations, but if not, I would look into creating an action that has "Problem is suppresed" -> "Yes" as a condition and then experiment with "Default operation step duration" and/or "Operation details" steps and durations. I think the escalation is the thing to try first.

Alternately, if neither of those work for you, another avenue is to use the API to gather the list of problems and generate an external report using a cron job or scheduled task. For example, running it once a week on Monday morning, to remind everyone about acknowledged but unresolved problem events.

However you solve the "acknowledged reminder", please follow-up and post what method you chose. I think it will be very helpful to others.

Just a quick life sign to say the topic is not forgotten, but I have currently too many other more urgent topics on my agenda. Will definitely report back as soon as I find the time to look into what escalations are and how they work.