SNMP traps and e-mails

[olivierde]

Hello,

I have configured a simple zabbix server which is there only to receive SNMP traps and then send alerts through e-mails. I have an issue with the fact that zabbix does not always send e-mails following the fact that zabbix has received a trap. I have configured a "host" an "item" and a "trigger" and also an "action". I have configured the snmp.fallback key to be sure that I capture the snmp traps.

The issue is that when the host is initially configure I'am receiving an e-mail right after the server receive a test trap. However, I receive nothing afterwards. It is worth noting that if I delete and recreate a trigger for a particular host, I'am receiving an e-mail with the first trap but not the following one.


Beside that I can also say that I'am seeing all the traps in the "Monitoring -> Latest data" windows. On the other side I'am seeing only the first trap/email in the "Monitoring -> Events" windows.

So, I guess that I have missed a parameter somewhere on the Zabbix configuration but I cannot pinpoint where that can be.

Do you have an idea of what could be my issue?

I have zabbix version 3.0.4.

Thank you.

OD

[Linwood]

Since you are using triggers to generate traps, the most likely issue is how you handle the trigger state. If the condition for the trigger remains true, by default, the trigger simply remains in a problem state and no new mail is generated (with the default trigger setup).

There are two ways to handle this, if it is indeed your problem. One is if the trapped condition has some condition which can clear it first, e.g. a "out of memory" trap that also has an "Memory ok". The problem is that most traps (at least most I try to use) have no "OK" message, they only generate problems, so I suspect this will not work for you (see exception below).

The "Problem Generation Mode" set to "Multiple" will solve the problem though it introduces new ones. That says each time there is a new value, a new problem is generated (and new event email) even though the current trigger state is "problem". There is no need to have a condition which will clear the trigger problem state.

The problem with this latter is that the problem shows on the trigger displays forever. At least on version 3.0.2 there was no way to handle this properly. The obvious technique of time functions (e.g. the trigger resets if no data for 5 minutes) caused zabbix to re-evaluate on that schedule and itself generated spurious multiple events. I have not tried it on 3.2.4, but I did not hear any plans to fix it.

There is an exception - if you have problems where it is important only that you know they exist, not necessarily every time a trap message is sent, then use the multiple set to "no" and a no-data check. In this way you could (for example) reset the trigger to OK after no traps for 5 minutes. This will then send mail for anytime you get the event, except that repeated events coming closer together than 5 minutes will not send an additional email. For many events that is perfectly fine. It may not be for ones of an audit nature (e.g. every login to a device that you want to be informed of).

[olivierde]

Hello,


I have checked the "Multiple PROBLEM events generation" in my trigger configuration (zabbix version 3.0.4) and it seems to work well now.

Thank you for your help.

OD