Export Disaster alerts data from Zabbix

[usmanzahid]

Hello,

We are using Zabbix 5.0 installed on Ubuntu Debian 20.0 machine to monitor multiple applications. I am looking for a way to export data whenever a disaster severity alert occurs so that I could maintain history of triggers that cause disasters. The data is being read from postgresdb based on which the alerts are triggered. I found real time export protocol but that exports all the information irrespective of alert severity but that would be too much data to process. Has anyone worked on a similar issue before?

Thanks

[tim.mooney]

I would get this via the API. Based on what you've said, I think you actually want to query based on event and then filter by severity. After the authentication steps, this would mainly be done via 'event.get': https://www.zabbix.com/documentation...ence/event/get

I don't think you want to query based on alerts, because there can be many alerts per event, and it sounds like you're more interested in the event than every single alert that was generated for the event, but if I've misunderstood, then you instead want to look at 'alert.get'.

If you've never programmed using the Zabbix API or you're not comfortable using a scripting language (or compiled language) to do JSON-RPC calls to the API, then your best bet is to spend some time looking at the database schema and figure out the SQL query that gives you the information you want. In general I don't recommend the SQL query option; the API provides a supported, stable way to get information out of Zabbix (and also to change things in Zabbix, if needed). Going directly at the database is more "fragile" in a lot of cases, so I consider it a "last resort".

[usmanzahid]

Thanks Tim, i think your answer has alot of information that I will go through. I will definitely take the API route rather than the sql query as you rightly pointed out API is more stable way to get the info.

Yes, my use-case is at event level but only for certain severity (in my case disasters only). I am planning to schedule this extract call at the end of each day and write to a file, which will get loaded to a visualization tool for different analysis/graphs. Looking at event.get, i think it will serve my purpose but just for my knowledge, I also saw history.get method which returns kind of similar information https://www.zabbix.com/documentation...ce/history/get. Which one would you recommend as I am not able to differentiate between the usage of event.get and history.get

Thanks

[cyber]

history.get gives you item history, values. As you want events. then use event.get

[tim.mooney]

+1 to everything cyber said. Based on what you've described for this particular work need, you want 'event.get' for this.

[LenR]

This might help, it's python using one of the API helpers: https://github.com/rugenl/zabbix-api-examples

I copied this to github using only my chromebook, so I'm not sure it all formatted properly.