How to Fetch and Save Resolved Zabbix Problems to CSV Using PowerShell?

[eleaga30]

Hello everyone,

I'm trying to automate the process of fetching all resolved high and disaster problem events from Zabbix for the past month and saving them into a CSV file using PowerShell. I need the CSV to include the following columns: Time, Severity, Hostname, and Problem.

I've written a PowerShell script to do this, but I'm encountering issues with it repeating events and not paginating correctly. Here is my current script:

$token = 'tu_auth_token'
$zabbix_url = 'http://tuservidorzabbix/zabbix/api_jsonrpc.php'
$one_month_ago = [Math]::Round((Get-Date).AddMonths(-1).ToUniversalTime().Subtract((Get-Date '1970-01-01').ToUniversalTime()).TotalSeconds)

function Get-Events($token, $one_month_ago, $lastEventId) {
    $jsonRequest = @{
        jsonrpc = '2.0'
        method = 'event.get'
        params = @{
            output = @('eventid', 'name', 'severity', 'clock', 'hosts')
            selectHosts = @('host')
            source = 0
            value = 0  # Solo eventos resueltos
            time_from = $one_month_ago
            sortfield = 'eventid'
            sortorder = 'ASC'
            limit = 1000
        }
        auth = $token
        id = 1
    }

    if ($lastEventId) {
        $jsonRequest.params.filter = @{ 'eventid' = $lastEventId }
    }

    $jsonRequest = $jsonRequest | ConvertTo-Json -Depth 100
    $response = Invoke-RestMethod -Uri $zabbix_url -Method Post -ContentType 'application/json' -Body $jsonRequest
    return $response.result
}

$allEvents = @()
$lastEventId = $null
$limit = 1000

do {
    Write-Output "Fetching events starting from event ID $lastEventId"
    $events = Get-Events -token $token -one_month_ago $one_month_ago -lastEventId $lastEventId
    $eventCount = $events.Count
    Write-Output "Fetched $eventCount events"
    if ($eventCount -gt 0) {
        $allEvents += $events
        $lastEventId = $events[-1].eventid
    }
} while ($eventCount -eq $limit)

$csvFilePath = 'problemas.csv'
$headers = "Time,Severity,Hostname,Problem"
$headers | Out-File -FilePath $csvFilePath -Encoding UTF8

function Convert-FromTimestamp {
    param ([int]$timestamp)
    return [timezone]::CurrentTimeZone.ToLocalTime(([datetime]'1970-01-01').AddSeconds($timestamp))
}

function Get-HostName {
    param ([array]$hosts)
    if ($hosts -ne $null -and $hosts.Count -gt 0) {
        return $hosts[0].host
    } else {
        return ''
    }
}

foreach ($event in $allEvents) {
    $severity = switch ($event.severity) {
        3 { 'High' }
        4 { 'Disaster' }
        default { '' }
    }
    if ($severity -ne '') {
        $time = Convert-FromTimestamp -timestamp $event.clock
        $hostname = Get-HostName -hosts $event.hosts
        $eventName = $event.name

        $line = "$($time),$($severity),$($hostname),$($eventName)"
        Add-Content -Path $csvFilePath -Value $line
        Write-Output "Processed event ID $($event.eventid)"
    }
}

Write-Output "All events have been processed and saved to $csvFilePath"

Any help or suggestions on how to improve this script to avoid repeating events and ensure proper pagination would be greatly appreciated. Thank you!