Two triggers, ping not responding and agent not running into disaster alert

[greavette]

Hello,

Is there a way or post that can help me build a disaster alert on my dashboard where if a host has both the agent not running and pinging the host fails a disaster alert is raised?

Thank you.

[cyber]

You have selected "!Multiple" for event generation mode... that's why you get it so many times...

[greavette]

Can anyone point me to how I can setup this type of alert scenario in Zabbix.

Thank you.

[greavette]

Hello Forum,

I've made some progress with my setup. I have created a trigger on an existing zabbix agent template (can be either windows or linux)

The expression I'm using is:

last(/Linux by Zabbix agent/zabbix[host,agent,available])=0

I then did a test on my linux server and stopped the agent. I did receive a Disaster alert for this ping and agent not responding trigger I created. But the problem is that the alert in my dashboard spawned a new alert every minute. For the duration of my test, I had many of the same alert in my Zabbix dashboard for this one Trigger. How do I adjust this trigger to only show up once in my dashboard? I want the trigger to keep checking until the agent is running and pinging again. Here is a screenshot of the trigger I created:




Any advice you can provide would be greatly appreciated.

Thank you.

[cyber]

You have selected "!Multiple" for event generation mode... that's why you get it so many times...

[greavette]

Thanks very much cyber for pointing this out to me! I had thought multiple was needed since I was referencing two items.

Follow-up question fo you. I'm attempting to make a new trigger of a disaster alert that will be a confirmation for me that a server is hard down. My thought was to use the agent not responding and to ping the host. What does my Expression check?

last(/Linux by Zabbix agent/zabbix[host,agent,available])=0

I would like to check the agent and perhaps a second check of ICMP Pinging the host as well. If both fail then that tells me more confidently that the host may be down and a critical alert is sent to my Dashboard. What does agent/zabbix[host,agent,available] actually mean?

Thank you.

[cyber]

What does agent/zabbix[host,agent,available] actually mean?

Thank you.

"Linux by Zabbix agent" is template name.
zabbix[host,agent,available] is an item key for internal item which basically checks if agent interface is available.

zabbix[host,<type>,available]
	Availability of the main interface of a particular type of checks on the host.			0 - not available, 1 - available, 2 - unknown.	Valid types are: agent, snmp, ipmi, jmx The item value is calculated according to configuration parameters regarding host unreachability/unavailability. This item is supported since Zabbix 2.0.0.

Expression can alway use multiple items, like "last of agent availability is failed AND last of ping is failed" you just need to construct the one you like a suits your needs.

[greavette]

Hello cyber, thank you for this explanation...could you help me with what expression I would need to use to have a trigger that will:

Check Ping
and
Check Zabbix agent availability
and
if both of the above items fail a critical alert will be created.

I'm not sure what the expression would look like. I know I'll receive a high alert for ping and a high alert for the Zabbix agent not running. But I'd like to combine these item checks in a trigger to give me a disaster alert. In this way I can be more sure that the host is really down and not just that the agent isn't running.

I tried the following expression:

last(/Linux by Zabbix agent/zabbix[host,agent,available])=0 and last(/ICMP Ping/icmpping)=0

But I received an error that said "Trigger "Ping and Agent Not Responding" belong to templates with different linkages."

Also, since I'm combining two items from two different templates, what happens if I didn't add the ICMP Ping template for example and I added this new item to my Linux Agent template. Would my new trigger fail because it couldn't get data from both items?

Thank you.