How do you modify a global default alarm severity?

[pmurtey]

Hi All,
We are very new to this and were wondering, where do you go to modify a default rule\trigger severity value? We aren't concerned about the "load" alarm which occurs, as much as just the cpu utilization and memory utilization. Where can we go to modify that load alarm globally, so that when that the same alarm occurs no matter what the system the same value of the alert is the same on all systems? How can we set the default value of minor severity to say informational so that when this alarm occurs no matter which system it is on it will show informational. Of all the documents we have seen so far it seems the only way is to override an individual alarm for just a single system. This seems kind of arduous when you have a large number of systems. -TIA

[NilsA]

If you work with templates, just modify the trigger severities there. To make that process faster you can select all the triggers in the template and click "Mass update", then set your preferred severity in the menu.
That is the closest - to my knowledge - that you could set a default severity.

[pmurtey]

Hi Nils, thank you for the response. Is there any how to's or step by steps on how to do this you can share? I have found a lot out there that have been very helpful in other areas, but none that cover this topic.

[pmurtey]

Thank you all, for responding. Like I mentioned to Nils, a how to or step by step guide would be invaluable if you have a link you could share? Just trying do this through the regular documentation is time consuming and a lot of guess work, and still may not get the desired result.

[NilsA]

I can sure try:

1. Navigate to your user settings (bottom left corner above "Sign out")
2. Set your "Rows per page" to something big like 150 (the more rows (triggers) you see on one page, the less clicking you'll have to do)
3. Navigate to any host
4. Click on "Triggers"
5. In the filter options here, remove the host and click "Apply"
6. Now you can see all triggers on hosts and in templates
7. Select all rows by clicking the checkbox to the left of the "Severity" column
8. Scroll to the bottom and click on "Mass update"
9. Check the box next to "Severity" and choose your default severity and then click update
10. Repeat steps 7-9 for all pages

Make sure you get every single trigger in the list.
After you have done this, you will have to manually sift through all templates with discovery and change trigger severities for the trigger prototypes. There's no better way to do this I'm afraid.

[pmurtey]

Hi Nils, We followed the procedure you outlined above when we go to hosts and remove the hostname like you said and click apply we do see a multitude of triggers, but it seems that the triggers all only deal with disk and inodes. We dont see any memory,cpu or load triggers. How do you see and modify those? Also, how would we globally change threshold settings? We would prefer to have all devices load to alert on the high load after 10min, instead of the default 5min. Where would be set globally for all servers?

[markfree]

Before making changes I suggest you take a look at Templates documentation, and more specifically at Mass Update section.

Personally, I feel that going through the "regular documentation" might be more effective than searching for a ready-to-use guide.

[pmurtey]

Hi Mark, I read through the documentation links you provided, but isnt there a more simpler way to just change a load ' time threshold' in zabbix that would apply to all devices using a global maco? Isnt there just one place to go and make this change without having to go through a bunch of templates?

[cyber]

yes, in templates (or specific template modules). If triggers are created by discovery (like in case of filesystems montioring), then you need to modify trigger prototype in that discovery rule.

[Drual]

Hi, i am trying to do exactly that

yes, in templates (or specific template modules). If triggers are created by discovery (like in case of filesystems montioring), then you need to modify trigger prototype in that discovery rule.

however changing severity will just not update up to the trigger.
I am trying to change for example this rule:

Mounted filesystem discovery: /: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"/"}%)

After clicking to Mounted file system and updating everything to higher severity it just wont update up.

thanks for any help

[pmurtey]

I have to agree with Drual, the process identified by NilsA just doesnt work. I did the select of all and mass update and changed the severity from Average to High. But after the Mass Update completes. There was no change. Markfree says to go to templates and and mass update there. Looking at the documentation in the two links provided still does not explain the process. Can someone please point us to a step by step or youtube video of how to do this. - Thanks

[NilsA]

If I remember correctly, you might have to reapply the templates on the hosts to make it work. You can try it on a single one first to see.
It might be that the problem event that has already been created does not update in severity because it doesn't check the template for reference after the fact.

[pmurtey]

Hi Nils, What is the process for re-applying a template? I tried every way I could think of, unsuccessfully.

[NilsA]

Configuration -> Hosts -> Select hosts -> mass update -> Templates -> Unlink -> choose the Template to reapply -> check the "clear when unlinking" box -> update

Then do the same linking the template.

This will clear all history and trend data produced by the template and LLD will have to rediscover items.