Adjusting trigger thresholds outside of templates via expressions?

[ESITGuy]

Hello again, this forum is my new favourite place it would seem...

I have a number of Windows servers being discovered and templates applied. One of these servers has a disk attached to it that always remains ~95% full, therefore is always alerting. No matter how I try and change the threshold, I'm hitting a wall.

1. I don't want to change the template applied because that would change it for the entire environment
2. I have tried cloning the triggers but from what I can tell, this still refers to a value set by the template
3. Creating an entirely new trigger seems like a lot of work and I'm guessing is still going to look at the value set by the template

What I'm wondering is, is there a quick way of changing the threshold via the Expression? Can one add something that would equate to "+5%" in the correct place to modify the end result of the Expression?

Example:

({$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}+number)

I'm loving Zabbix but crikey, some of these seemingly small tasks are time vampires. Glad I'm not having to invoice a client for this stuff.

[cyber]

Based on https://www.zabbix.com/integrations/windows
Template only contains [$VFS.FS.PUSED.MAX.CRIT} by default. But if you look on triggers, that this discovery creates...

{#FSLABEL}({#FSNAME}): Disk space is critically low

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}. - The disk will be full in less than 24 hours.

last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},total])-last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],1h,100)<1d)

I painted couple of things red.... As you can see it creates those with "contextual macro". https://www.zabbix.com/documentation...macros_context
If that is not found the default macro is used... BUT... you can add for that particular host a host level macro {$VFS.FS.PUSED.MAX.CRIT:"E:"} with your desired value.
What happens is described in docs in User macro section https://www.zabbix.com/documentation...os/user_macros

Zabbix resolves macros according to the following precedence:

1. host level macros (checked first)
2. macros defined for first level templates of the host (i.e., templates linked directly to the host), sorted by template ID
3. macros defined for second level templates of the host, sorted by template ID
4. macros defined for third level templates of the host, sorted by template ID, etc.
5. global macros (checked last)

By default it starts from point 2, as no host level macro is present, it looks for it in template... as it looks for contextual macro, and none are defined, it will find the one without context... and uses it...
By adding host level contextual macro, you will provide needed things at point 1... it will not look further.

[Atsushi]

There is a way to use macros to set thresholds. In the trigger conditional expression in the template, create a conditional expression that compares with the macro value as a threshold, and set the macro in the template. When you link the template to a host, by default the threshold is the value set in the template's macro. However, you can override the macro values you set in the template by defining a macro with the same name for the host. In other words, by changing the host macro value for each host, you can set the monitoring conditions to have different thresholds for each host.

https://www.zabbix.com/documentation/guidelines/en/thosts/configuration/template_triggers

[ESITGuy]

Thanks Atsushi. Funny, I just spent some time with Chat GPT and it said the same thing. Although, that method would cause all FileSystems on that host to receive the new threshold right? I need 1 of 3 FileSystems on the host to have a different threshold.

Can a template refer to host specific values? {$VFS.FS.PUSED.MAX.CRIT} is the key I want to reference in this case, expressed against the template and particular file system it then reads: {$VFS.FS.PUSED.MAX.CRIT:"E:"}, as E:\ is the drive being monitored. Is {$VFS.FS.PUSED.MAX.CRIT:"E:"} a valid macro key?

It seems like if I need to change the trigger values, I need to not use templates at all and define each file system to be monitored independently. Or, somehow exclude the desired file system from the template (if that is possible?) and point it at host macro.

Yeesh! This thing isn't for the feint hearted.

[cyber]

Based on https://www.zabbix.com/integrations/windows
Template only contains [$VFS.FS.PUSED.MAX.CRIT} by default. But if you look on triggers, that this discovery creates...

{#FSLABEL}({#FSNAME}): Disk space is critically low

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}. - The disk will be full in less than 24 hours.

last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},total])-last(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],1h,100)<1d)

I painted couple of things red.... As you can see it creates those with "contextual macro". https://www.zabbix.com/documentation...macros_context
If that is not found the default macro is used... BUT... you can add for that particular host a host level macro {$VFS.FS.PUSED.MAX.CRIT:"E:"} with your desired value.
What happens is described in docs in User macro section https://www.zabbix.com/documentation...os/user_macros

Zabbix resolves macros according to the following precedence:

1. host level macros (checked first)
2. macros defined for first level templates of the host (i.e., templates linked directly to the host), sorted by template ID
3. macros defined for second level templates of the host, sorted by template ID
4. macros defined for third level templates of the host, sorted by template ID, etc.
5. global macros (checked last)

By default it starts from point 2, as no host level macro is present, it looks for it in template... as it looks for contextual macro, and none are defined, it will find the one without context... and uses it...
By adding host level contextual macro, you will provide needed things at point 1... it will not look further.

[ESITGuy]

Thank you Sir! Nailed it

That macro procedure is a critical nugget of info for Zabbix, I can see that being used all over the place.

[ESITGuy]

As this appears to be a core aspect to Zabbix configuration (at least in my context) I thought it might be helpful to simplify the outcome for anyone finding themselves with this same issue. The concept mentioned by cyber can easily be managed from within the host configuration page.

Go into the Macros tab and then into the Inherited and host macros heading. Any templated Macro and Value will be in here, simply copy the Macro into the Host macros section and add your own value.






Depending on what you're trying to adjust you may need to add some contextual information. In the case above, I needed to add E: to the macro. You can reverse engineer a templated trigger to fins the syntax required by going to the Triggers tab in the Host config page. Click into any trigger or dependency to find the syntax:





The Expression section will have the Macro(s) in the correct syntax:





Depending on the template, you may get lucky and have nice plain-language notes on how it works: