Is it possible to set up a delay for trigger actions before they become a problem?

[bbroecker37]

We would like to set up a delay for trigger actions before they become a problem. Just in case the issue resolved itself quickly. We don’t want to affect SLA.

Example: Right now, I have notification set up to send messages after the problem has been created for 1m and 30s. If the problem resolves before then. We won’t get alerted. But the problem that resolved itself in 1m and 30s will affect our SLA. We would like to avoid this. Any ideas on how we can accomplish this?

[ISiroshtan]

Sounds like what you want is to rewrite triggers to actually give some breathing room before firing. It is possible, but it's not single centralized setting, you would need to evaluate and update each and every trigger in use.

As example, let's say you monitor CPU and current trigger uses something like last(cpu)>90. It will not wait and would fire as soon as CPU goes above 90% threshold. Instead you can go with min(cpu,#2)>90. This way alert will only fire if lowest of last 2 values of CPU is >90%. So if CPU goes above threshold - Zabbix does nothing and waits for next value. If 2nd value would be also above threshold - alert will fire. If not - it can be considered resolved and no alert would be fire.

Similar approach with aggregate functions can be used to make Zabbix evaluate more then 1 value before making a decision to fire alert, but each trigger needs to be evaluated separately.