I'm using a copy of the 'PBSD Cisco IOS by SNMP' template to monitor Cisco access switches in Zabbix 7.0.11 (running in Docker). The environment is very dynamic, so switchports are going up and down and all the time and I don't want these alerts to clutter up the dashboard. However, I can't disable the "link down" alerts because the on-site staff uses Zabbix to identify which switchport a given endpoint is connected to—for example, if troubleshooting a phone, they'll simply unplug the phone and check Zabbix to see which switchport just alerted.
I think a fair compromise would be to keep the "link down" alerts but reset/clear them automatically after five minutes, regardless of whether the link status recovers. I have struggled to revise the trigger to create this behavior. Here's the original:
I first revised the problem expression as follows, leaving the original recovery expression in place:
I didn't notice any change in behavior with this, so I reverted to the original problem expression and revised the recovery expression as follows:
Again, this behaves exactly like the original. I'm obviously struggling to understand the expression language. Is it clear what I'm trying to do? Can anyone give me a hand?
I think a fair compromise would be to keep the "link down" alerts but reset/clear them automatically after five minutes, regardless of whether the link status recovers. I have struggled to revise the trigger to create this behavior. Here's the original:
Code:
PROBLEM EXPRESSION
==================
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#2))
RECOVERY EXPRESSION
===================
last(/Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])<>2 or {$IFCONTROL:"{#IFNAME}"}=0
I first revised the problem expression as follows, leaving the original recovery expression in place:
Code:
{$IFCONTROL:"{#IFNAME}"}=1 and last(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}])=2 and (last(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#1)<>last(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],#2)) and nodata(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],5m)=0
I didn't notice any change in behavior with this, so I reverted to the original problem expression and revised the recovery expression as follows:
Code:
last(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}]) <> 2 or {$IFCONTROL:"{#IFNAME}"} = 0 or nodata(/PBSD Cisco IOS by SNMP/net.if.status[ifOperStatus.{#SNMPINDEX}],5m)=1
Again, this behaves exactly like the original. I'm obviously struggling to understand the expression language. Is it clear what I'm trying to do? Can anyone give me a hand?