Downagrade severities with repition counters and tags

[Gkar_of_Narn]

We are considering a move to another monitoring tool and are looking at Zabbix. We need the ability to downgrade events until they reach a certain number of repetitions. For example, a CPU Usage checks normally reports "high" is over 90%. However, this is downgraded to warning until the threshold is exceeded for four check intervals.

We would also like to be able to downgrade severities based on tags. For example, test systems are downgraded from High to Warning. From what I see this would be done not by downgrading but in the templates, where the templates are assigned by such tags. Is this correct?

Thanks in advance.

[isaqueprofeta]

What you wanting to do is Event Correlation, and there are two ways to do it in Zabbix with your events:

1. Trigger Dependencies: https://www.zabbix.com/documentation...s/dependencies
2. Global event correlation: https://www.zabbix.com/documentation...elation/global

We need the ability to downgrade events until they reach a certain number of repetitions. For example, a CPU Usage checks normally reports "high" is over 90%. However, this is downgraded to warning until the threshold is exceeded for four check intervals.

I'd use Trigger Dependencies here and "create" two triggers: One already comes with Zabbix out-of-the-box severity "high" called "CPU Usage is over 90%" and then I'd create a new one called "CPU Usage is over 90% for more than N minutes", in the last I'd put my trigger expression for 4 times the high one, and put it, dependant, one to another. Done and it can be inside a template do ease reuse.

We would also like to be able to downgrade severities based on tags. For example, test systems are downgraded from High to Warning. From what I see this would be done not by downgrading but in the templates, where the templates are assigned by such tags. Is this correct?

You're right, you don't think in "downgrade", you just think about multiple Templates. You're gonna have one template for production, and one for test env, you can even rely on hierarchy to reuse common data like:

• Template MyApp (Base)
  • Template MyApp in the test (Inherits Template MyApp)
  • Template MyApp in the production (Inherits Template MyApp)

And just to clear the idea:

• Tags are specifically for triggers/events
• Templates are for hosts

Why don't you play a bit with Zabbix? If you know/like docker you can try this: https://github.com/isaqueprofeta/zabbix-lab

[Gkar_of_Narn]

Thanks for the quick response. I have installed and have been playing with it a bit. I have a list of characteristics such tools could have ranging from nice-to-have to must. Based on that, I am trying to see to what extent each of the characteristics are available in each tool I look at. The biggest problem is the terminology is often different from one product to the next, so when i search in the Zabbix manuals, I don't find the term I am looking for. For example, our current system allows you to define categories and attributes. Categories can be hierarchical and different object types can have one or the other or both. (I'm not sure the vendors even knows why) I looked at the two links and they seem to be the kinds of thing we are looking for.

I seem to be missing something. We run data center services for a few dozen companies and I am looking for a way to identify machines automatically. The Zabbix API looks very interesting and the ability to create objects using the API would be extremely useful. I am interested in something like a tag where I can define which customer it belongs to, then define a host as production, test, or dev based on the environment. Then have a tag to say what type of system it is, like app-server, web-server or database. Then a tag to say what SLA applies. Which monitors (and the respective configuration) is assigned to a given hosts depends on the environment, type of server and SLA.

What I see is that I can assign a tag hosts and templates. I'm not sure how they fit in.

[eithor]

One tip: if you create e.g. "Role" templates (e.g. "Template Role Linux Web Server" that depends/links in other templates), you can put a tag "role:web" in that top-level template and the hosts that use it will inherit that tag. Note that this is template-level tags, not trigger-level tags.

[isaqueprofeta]

Thanks for the quick response. I have installed and have been playing with it a bit. I have a list of characteristics such tools could have ranging from nice-to-have to must. Based on that, I am trying to see to what extent each of the characteristics are available in each tool I look at. The biggest problem is the terminology is often different from one product to the next, so when i search in the Zabbix manuals, I don't find the term I am looking for. For example, our current system allows you to define categories and attributes. Categories can be hierarchical and different object types can have one or the other or both. (I'm not sure the vendors even knows why) I looked at the two links and they seem to be the kinds of thing we are looking for.

Zabbix has subgroups like folders, just add a slash "/" and the hostgroup will be nested, they are your best friends for organizing the hosts, I have over 2000 myself, and you can use it like REGION/SITE/SERVICE/ENVIRONMENT

I seem to be missing something. We run data center services for a few dozen companies and I am looking for a way to identify machines automatically. The Zabbix API looks very interesting and the ability to create objects using the API would be extremely useful. I am interested in something like a tag where I can define which customer it belongs to, then define a host as production, test, or dev based on the environment. Then have a tag to say what type of system it is, like app-server, web-server or database.

Tags are specifically for triggers/events, preferer to use hostgroups.

To automate, you can really do some API, you can customize it much more, but to point some Zabbix features another two option is to play with Network discover + Actions and/or Agent auto-registration + Actions, it's pretty good

Then a tag to say what SLA applies. Which monitors (and the respective configuration) is assigned to a given hosts depends on the environment, type of server and SLA.

What I see is that I can assign a tag hosts and templates. I'm not sure how they fit in.

SLA is a bit sensitive topic IMHO, if you really need this kind of level from start, go for Zabbix Training Specialist and have a good time learning the Feature, and them some time learning about the API to automate it. The whole SLA Feature (Called Services in Zabbix) is a huge topic and isn't really flexible without API.