Action rule for email if two hosts are down

[Taner]

Hello all,

I need your help.

How is possible to receive email from zabbix, only if two hosts are down?
For example, host A and host B are down send email.
I tried Configuration-> Action> Create new action
And I defined for condition:

A and( B and C) and (D or E or F)

A	Problem is not suppressed	Remove
B	Trigger equals SH-RT-UBIQUITI: Unavailable by ICMP ping	Remove
C	Trigger equals SH-TV-SAT2IP: Unavailable by ICMP ping	Remove
D	Trigger severity equals Average	Remove
E	Trigger severity equals High	Remove
F	Trigger severity equals Disaster	Remove

Bud doesn't work...


My goal is if Host A and host B are down, only in this condition send one email with one message.
And when they are up send again one message via email.

Thank you in advance.

[Semiadmin]

Documentation says:
"Note that using “And” calculation is disallowed between several triggers when they are selected as a Trigger= condition. Actions can only be executed based on the event of one trigger."

https://www.zabbix.com/documentation/current/manual/config/notifications/action/conditions#type_of_calculation

[Taner]

Hello Semiadmin.

I implemented it in this way:
My hosts are Delta and Bravo.
I created a new trigger in Delta host with the expression:
{Delta:icmpping.max(#1)}=0 and {Bravo:icmpping.max(#1)}=0
and severity High.
The trigger has been replicated automatically and in host Bravo.
Then I created a new Action rule with the expression:
A and B and (C or D or E)

A	Problem is not suppressed
B	Trigger equals Bravo: Custom Unavailable by ICMP ping
C	Trigger severity equals Warning
D	Trigger severity equals Disaster
E	Trigger severity equals High

And achieve my goal.

But I am not sure if this expression checks ping in every one second?
{Delta:icmpping.max(#1)}=0 and {Bravo:icmpping.max(#1)}=0

Thank you.
Best Regards.

[Semiadmin]

An expression max(#1) is slightly strange, it's equal to the last(). The trigger expression recalculated when one of two hosts gets a ping test result.

[Taner]

An expression max(#1) is slightly strange, it's equal to the last(). The trigger expression recalculated when one of two hosts gets a ping test result.

Why the expression {Delta:icmpping.max(#1)}=0 and {Bravo:icmpping.max(#1)}=0 is slightly strange?
By default the expression for trigger Unavailable by ICMP ping from Template ICMP Ping is:
{Template ICMP Ping:icmpping.max(#5)}=0
I think that the 5 is 5 minutes, I am not sure.

But in this way near to one minute if two hosts are down only then I receive an email notification.
If only one host is down but another host is up I don't receive an email notification and the goal is achieved.

Is it possible to force it to 1 second?
If two hosts are down at the same time for 1 second send an email notification?

In my Raspberry Pi3 the default expression is:
{SH-RT-UBIQUITI:icmpping.max(#3)}=0 and {SH-TV-SAT2IP:icmpping.max(#3)}=0

[Semiadmin]

Why the expression {Delta:icmpping.max(#1)}=0 and {Bravo:icmpping.max(#1)}=0 is slightly strange?

because this is the maximum of one value

[Taner]

because this is the maximum of one value

Should be 3 or 5?

[Taner]

I tried to modify the trigger:

{Host:icmpping.nodata(2m)}=1

to

{Host1:icmpping.nodata(1s)}=1 and {Host2:icmpping.nodata(1s)}=1

But then the email notification doesn't work

[Semiadmin]

Didn't you try to read the documentation?

[Taner]

Didn't you try to read the documentation?

I tried to read it but didn't understand it.

Please could you tell me is it possible for 1 second or not?
Because my example works only for 31 seconds.

I will appreciate it too much

[Taner]

It's worked for one second
Just it needs to change the ICMP template trigger and item parameters for interval 1 second and icmpping.max(#3)}=0 to icmpping.max(#1)}=0
Only email notification is late with 31 seconds, but the event is registered in 1 second