How to set up a trigger to duplicate alert suppression
Hi, all
I'm trying to set up a trigger, but it does't work.....
I would like set up a trigger as follows:
・When zabbix finds log message which has words (A or B), it creates an event.
・If there are more than 3 log messages including the word(A or B) in 5m, zabbix doesn't create new event.(I can suppress many alerts.)
When I use expression detects only word "A", the trigger works. But when I use Regular Expression (A|B) for the expression, it doesn't work at all.
So, I'm wondering if I can use count function with Regular Expression.
↓The configuration I use is below. ↓
▽Expression
"{Test_template:logrt[“/infra/script/xxxlog”].regexp(A|B)}=1
and
{Test_template:logrt[“/infra/script/xxxlog”].count(5m,A|B)}<3"
▽Problem event generation mode: Multiple
▽Recovery Expression(I don't want Zabbix to close the event automatically, so I set the recovery expression that never happens.)
{Test_template:logrt[“/infra/script/logs/xxxlog”].last()}=9999
▽Environment
OS： RHEL/7.5
Zabbix Server ：5.0.4
Zabbix Agent ：1.8(Update is not allowed, probably)
▽What I've confirmed
・Item type is "Zabbix Agent(active)"
・I checked zabbix_agentd.log and zabbix_server.log, but I couldn't find any errors about this.
・I can see the log message including the words("A" or "B") on Zabbix web interface.
(which means zabbix agent can recognizes and reads the log file)
I'm trying to set up a trigger, but it does't work.....
I would like set up a trigger as follows:
・When zabbix finds log message which has words (A or B), it creates an event.
・If there are more than 3 log messages including the word(A or B) in 5m, zabbix doesn't create new event.(I can suppress many alerts.)
When I use expression detects only word "A", the trigger works. But when I use Regular Expression (A|B) for the expression, it doesn't work at all.
So, I'm wondering if I can use count function with Regular Expression.
↓The configuration I use is below. ↓
▽Expression
"{Test_template:logrt[“/infra/script/xxxlog”].regexp(A|B)}=1
and
{Test_template:logrt[“/infra/script/xxxlog”].count(5m,A|B)}<3"
▽Problem event generation mode: Multiple
▽Recovery Expression(I don't want Zabbix to close the event automatically, so I set the recovery expression that never happens.)
{Test_template:logrt[“/infra/script/logs/xxxlog”].last()}=9999
▽Environment
OS： RHEL/7.5
Zabbix Server ：5.0.4
Zabbix Agent ：1.8(Update is not allowed, probably)
▽What I've confirmed
・Item type is "Zabbix Agent(active)"
・I checked zabbix_agentd.log and zabbix_server.log, but I couldn't find any errors about this.
・I can see the log message including the words("A" or "B") on Zabbix web interface.
(which means zabbix agent can recognizes and reads the log file)