Show alert for 30 minutes, even if the state has already returned to OK

[BotChris]

Good morning dear Zabbix community,
I’m relatively new to Zabbix and looking for a solution to the following problem:

I have a trigger that checks every minute whether an entry in a firewall log exists. It’s about blocked users. Unfortunately, the alert only appears on the dashboard for a few seconds because the alert is then considered "OK". However, the user is blocked for 30 minutes, and I would like the alert in Zabbix to remain visible for a static 30 minutes. I’d also like it to have a manual “acknowledgement” in case the blocked user is manually unblocked.

We are using Zabbix 7.0.8.

Thanks in advance for any input, and have a great day!

Best regards,
Christian

[Saiful MN]

Hi there,

I could post my own question in here so I decided to ask you if you know how to go about it - im sorry

"Say I have a server with degraded raid status and this trigger is already set to High severity - how do i make zabbix to keep sending me alert every two hours everyday until the issue is resolved?"

Hoping you'd know.

[troffasky]

Start your own thread, don't hijack someone else's.

[cyber]

and I think v7 has already "update" link in problem line in problem list? From there you can "ack" it if needed. In older ones you needed to selectthe problem and go to "mass update"...

[Brambo]

Depending how the trigger is problem state and how OK state are gathered.
I usually do this based on a time / avg based expression the the Ok expression field.
Something like
expression OK state
AND
time based expression that it OK for 30m

What you can also do is change count but that depends on a discard unchanged pre-processing step.
I do that for a notification which I want visible for 96h (weekend +1 day) were a HA system could switchover.
As most of my template are self/custom made I'm fully in control how to build data gathering etc etc and that is build with certain trigger desires in mind.

[kyus]

If you want to keep it in the "Problem" state for those 30 minutes you can add a recovery expression to your trigger, and if the user was unblocked manually you could acknowledge or close the problem manually.