zabbix warning thresholds

[bloodyskullz]

Hi All,

We are currently using Nagios and I have been experimenting with Zabbix right now to understand how it operates, Zabbix is more complex than I expected.

With Nagios it was scripted that when it detected VM information such as memory, CPU etc...it was done so with dynamic thresholds in mind. Ex. if it detects 4 cores a full workload is 100%, warning would be about 60% and then critical would be 80% or more. if these thresholds are reached, it will send an email and check again after x number of minutes.

I noticed captures a ton of details like swap, memory, file system, cpu etc...can zabbix be customized for this?

[cyber]

Can you elaborate a bit? What do you want to customize?
All you described in your example can be done...

[bloodyskullz]

Sorry been busy to respond to this.

Our current nagios will run a check based on priority levels if a VM is considered high priority, checks every 5 mins (like a domain controller), if there is an issue and email gets sent out and will continuously send an email every 5 mins until the issue is resolved. Problem could be CPU spiking in usage, 90% memory consumed or some other issue.

If it is a low priority, it will check every 1hr but it won't send us an email notification saying there is an issue.

You are saying zabbix can be configured this way but there isn't a lot of settings for notifications when i went to the email portion.

[kyus]

For the low / high priority you could create a template for each and assign or use an action to assign the template for each host. But you don't need to do this, unless you really don't want to collect data that frequently for those low priority hosts.

To send emails, you need to configure a media type (email) and set a media type for the user you want to receive the mail.

https://www.zabbix.com/documentation/7.0/en/manual/config/notifications/media/email

Create a trigger action to send the desired events to your users.
To send alerts every 5 minutes if the problem isn't resolved, simply set the action steps to be like 1-0 and "step duration" to 5min.

https://www.zabbix.com/documentation/7.0/en/manual/config/notifications/action

[cyber]

Check time can be given as user macro and you can define those on host level seprately. That way you can use same tempalte but macros help you define different polling intervals.
How to make it spam you with emails in every 5 minutes, is called "escalations" https://www.zabbix.com/documentation...on/escalations

[bloodyskullz]

So i created this alert and I didn't create anything else additional, the operation just adds the email portion. I configured it for a specific purpose to trigger just for high cpu utilization.

If I add more than 1 trigger, will that affect the process I am trying to setup or do I need multiple actions with different triggers to do what I am looking for?

[kyus]

I usually use tags to filter wich alerts are going to be sent. You can also use trigger severity + host group, for example.

You should create the combination that suits your environment requirements.

If you have a bunch of alerts that you want to be notified of, i would suggest using tags on your triggers.
For example, you could create a trigger called "alert" with value "email" in each trigger (in template level).

For the low/high priority, you could also use tags or host groups to separate it.

If I add more than 1 trigger, will that affect the process I am trying to setup or do I need multiple actions with different triggers to do what I am looking for?

It'll work, just make sure to use the OR operator, but this would be harder to maintain, since you'll have to add each trigger to the condition.

[bloodyskullz]

Sorry, a bit confused by your post. I looked at tags in the template and there isn't much going on there.

[kyus]

You can add your own tags, but for alerts, I would recommend adding them to your triggers / trigger prototypes.

https://www.zabbix.com/documentation/7.0/en/manual/config/tagging