Trigger Dependencies don't work as expected

[bturnbough]

bturnbough,
I'm just throwing this out but if they are all dependent on each other and if all conditions have to be met before you want an alert to be sent out then have you tried combining them all into one trigger and expression using the AND operator like:

{SO1AETDS2950-1:uptime.nodata(600)}=1&{SO1AETDS2950-1:icmpping[].max(180)}<1&{SOFW01:icmpping[].max(180)}<1

Hi Dirckcopeland:

Thanks for your response. Unfortuntely, I believe your method won't work for me.

Reason being is that SO1AETDS2950-1 is a member of "Host Group A" and "Host Group B", and SOFW01 is a member of "Host Group B" and "Host Group C" When a trigger is fired, I now get the notification sent to members of A,B AND C. I do NOT want a notification to be sent to C.

Host group A could be "switch admins"
Host group B could be "location"
Host group C could be "firewall admins"

I have certain members of our IT team in switch admins, certain members in our "location" host group, and certain members in our "firewall admins" group. Sending notifications to all three would be counter productive.

Additionally, those items / checks are applied using templates. I cannot modify the checks when a template is applied. I'd have to unlink the template. I have 100's of hosts. That would be crazy.

[tim.mooney]

Additionally, those items / checks are applied using templates. I cannot modify the checks when a template is applied. I'd have to unlink the template. I have 100's of hosts. That would be crazy.

I don't understand this last bit. What modifications is it that you feel you can't apply because the items are part of templates? Can you expand a bit more on what you feel you can't do?

I will say that when I first started with Zabbix, I didn't understand that I should use macros liberally in my templates. All my initial templates had things like:

{ES_R1_Linux_Base_Template:vfs.fs.size[/tmp,pused].min(#2)}>90.0 and {ES_R1_Linux_Base_Template:vfs.fs.size[/tmp,pused].last(0)}<98.1

At a minimum, any place you hardcode thresholds in a template (the >90.0 and the <98.1) should instead be macros, with default values set at the template level. That way, you can use your templates widely but still allow for per-host overrides set on any hosts that need to use slightly different thresholds. The recent addition of support for >= and <= in trigger expressions also makes it much easier to use just a few macros in your templates.

There are probably other things that should be macros in our templates too, but thresholds are an obvious one.

I need to review our network topology dependencies for my site after some network core changes, so if you haven't received an answer to your question when I'm done with that (might be a couple weeks yet), I'll try post again with an overview of what I'm doing for our site.

Tim

[bturnbough]

Hi tim.mooney.

Thanks for your reply. I'll try to explain what I meant.

Create a template and call it say "Template - Ping"

Create an item within that template and call it "ping" with a key of "icmpping[]"

Create a trigger with the expression of: "{Ping:icmpping[].max(180)}<1"

Apply that template to both hosts (firewall AND switch).

This works, but not the way I want.

You see, when the ping for the firewall fails, I also get alerts for the switch. It was suggested above that I modify the triggers on the host "switch" so that it not only checks the ping state on the switch, but it also checks the ping state on the "firewall" host.

Example:

({Switch:icmpping[].max(180)}<1 & {Firewall:icmpping[].min(180)}>0)

When the template is applied to the hosts, I cannot modify the trigger expression to match what that format. I don't have time or the patience to apply the template, and then unlink it and then modify the trigger expression.

In the end.... The host loses the benefits of the template. What happens if I want to modify the values of the template? The hosts that have had the template unlinked will not get those changes. Translation: I will have to manually touch 100's of hosts.