Zabbix notification action - triggered even though conditions are not met.

[jhboricua]

We are running Zabbix Server 5.0.31.

We have a action trigger for notifying our on-call person. The trigger is setup as follows:



My understanding from the setup above is: A and B HAVE to be true along with any of the conditions listed from C to I).

The problem we are having is that the action trigger IS sending notification of triggers that do not meet the condition requirements. For example, failed windows services. Here's one of the hosts in question:


Based on the action trigger conditions, I would have expected the windows service problem trigger shouldn't have triggered a notification to the on call because :

1. The Windows service trigger default severity is 'Average' -> doesn't satisfy the action trigger A condition.
2. The monitored host IS a member of the archive.businesshours host group, -> doesn't satisfy the action trigger B condition.

Yet the notification to the on-call is sent anyway.

1. We have verified this is the only action trigger that sends notifications to the on-call.
2. We have verified the problem trigger severity is indeed 'average' and not overridden to high.

Thoughts?

[markfree]

You have shown us the Item and Action configurations.

Now, could you show us the Trigger configuration as well as the event when the Trigger started?

Also, check the Action logs for the same event that sent your notification.

[jhboricua]

This is the triggered windows service:


The trigger config:


Where do I find the action logs?

[markfree]

Where do I find the action logs?

You can find them under Reports and Action Log.

To locate the specific event, go to Monitoring and Problems. Search for the event that was triggered and you see should see a note about it in the "Actions" column.

[jhboricua]

You can find them under Reports and Action Log.

To locate the specific event, go to Monitoring and Problems. Search for the event that was triggered and you see should see a note about it in the "Actions" column.

Right, when I stated at the beginning that we are seeing notifications going to the oncall person, we saw this via the action column for the event in the Monitoring and Problems view. As for the action logs, they are not revealing anything we don't know already, the notification is being sent to the oncall event though it shouldn't:

[markfree]

It's odd, indeed.
Based on the action message that was sent, it seems that the problem initiated on 23rd March 2023 at 17:45 hours. However, the email notification was sent only yesterday.
Do you have any escalation steps or recovery/update operations in place?

[jhboricua]

The notification is meant to pester the oncall until it is acknowledged, so don't worry about the dates shown above. I kept this one unacknowledged while I'm troubleshooting it.

[gabos1]

Does anyone know of an updated script or the way for zabbix to send the alerts by telegram but with graphics that the message sends the graphics for zabbix version 5.4 and the latest version?

[markfree]

I've been trying to figure this out, but from over here I can't seem to find a reasonable cause for this odd behavior.
I'm sorry that I can't be of more help.
If you manage to find the root cause of the problem, could you let us know what it was?