changing a few service triggers to be time based

[rn21528nr]

i currently use the built in windows template and Windows service discovery (and the accompanying triggers). These are great and work fine for 90% of our services. There are a few specific services where i would like to change the trigger. Instead of "notify after service returns as STOPPED on last 3 checks", i"d like them to be "notify after service is stopped for 30 minutes". How can i modify the trigger for only a handful of services, without turning off the built in triggers and service discovery?

[Markku]

By looking at https://git.zabbix.com/projects/ZBX/...s_agent_active I see this is the trigger configured in the template:

min(/Windows by Zabbix agent active/service.info["{#SERVICE.NAME}",state],#3)<>0

The "#3" is the spec you are talking about. Here are the steps to modify it to your needs:

1. In the template, create a new macro {$SERVICE.TIMEOUT} with a value of #3 (this is now the default value)
2. In the template, in the service discovery rule, in the trigger prototype, change the #3 to {$SERVICE.TIMEOUT:"{#SERVICE.NAME}"}
3. Now, if you want to "globally" change the timeout value for some specific service, you can add a new macro to the template: {$SERVICE.TIMEOUT:"service_name_here"}, set the value to 30m or whatever you like (you maybe need to check the actual service name syntax from an existing item on some host)
4. If you only want to customize the service on one server, define the macro similarly in that host only.

You may need to wait for the discovery to happen automatically again, or you can go to the discovery rule in the host and click Execute now. If you still don't get the new triggers created, just delete the trigger from the host and wait/Execute now.

Markku

[rn21528nr]

thank you for this, I have a question:

On step 2. what does {$SERVICE.TIMEOUT:"{#SERVICE.NAME} do exactly? So previously it just had #3 , for 3 failed attempts. Now its saying the condition is "30m : exampleServiceName" . . What is that doing or how would the expression read in words?

edit: i think i understand this partly now. So if its one of the services that i specify by creating a macro (step 3), it will replace the text with a time , like 30m (whatever i set as the value of that macro). Im still confused about what happens for all of the other cases, when it is NOT a service that i specify in a macro? For example, i didn't create a macro for WinBioSVC , so i want that to remain on the normal "report after #3 failures" rule. {$SERVICE.TIMEOUT:"{#SERVICE.NAME}" would translate to "#3:"WinBioSvc"" . How does this part translate into words/ what does that do?

[Markku]

Im still confused about what happens for all of the other cases, when it is NOT a service that i specify in a macro?

In those cases the "plain" {$SERVICE.TIMEOUT} value is used. That's the default value if the context macro ({$SERVICE.TIMEOUT:"service_name"}) is not specified for a service (either in the template level or host level).

See the documentation: https://www.zabbix.com/documentation...macros_context

Markku