Completely frustrated with triggers

[jmayniac]

I'm trying to create a simple trigger that will wait 5 or 10 minutes when a problem occurs and if it is still an issue after that time, send me an email, if it gets resolved, disregard and don't send an email. I also want the reverse; wait 5 minutes before sending me an email that it is resolved, in case it goes down again. I want to reduce the noise I'm getting from Zabbix because out of the box, it is annoying and I can't tell what's actually a problem. I'm getting frustrated to no end. I've read through the documentation many times, but it's just not clicking with me. I've read other people ask about this very same thing, but either the answers are all different or really outdated and the options don't exist. Can anybody help?

NOTE: All I've done is to enable the email trigger and set it to my address, I've tried messing with Steps, but again, I have no idea what that means or what to set.

[cyber]

Escalation steps are correct direction.

https://www.zabbix.com/documentation/current/en/manual/config/notifications/action/escalations

Example 2 is pretty much, what you need... delaying the notification of longlasting problem... instead of 10h there, use 5m or 10m... If problem resolves during that 5 or 10 minutes, you will not get an email. Set recovery action to "notify all involved" then it will not send you the recovery message also, as you were not informed in first place..

[jmayniac]

Escalation steps are correct direction.
Example 2 is pretty much, what you need... delaying the notification of longlasting problem... instead of 10h there, use 5m or 10m... If problem resolves during that 5 or 10 minutes, you will not get an email. Set recovery action to "notify all involved" then it will not send you the recovery message also, as you were not informed in first place..

Thank you. I appreciate the information. Does the following look corrrect? Also, do I need to change the expression on a trigger that has a 5m delay (which didn't seem to work) as seen in the screenshot attached?

[swildy]

For the trigger, take a look at the item key. It should look something like this:
max(/host/icmpping[{HOST.HOST}],5m)=0

[cyber]

Thank you. I appreciate the information. Does the following look corrrect? Also, do I need to change the expression on a trigger that has a 5m delay (which didn't seem to work) as seen in the screenshot attached?

This should work. If trigger does, what you want it to do, then no need to change. As I read it, max value for 5m period is 0, meaning it has been down for 5 mintues, then triggers... After that you will have additional 5m grace period before email is sent due to your action config... if things get ok during that time, email is not sent..

For the trigger, take a look at the item key. It should look something like this:
max(/host/icmpping[{HOST.HOST}],5m)=0

{HOST.HOST} is not a mandatory parameter there. None of icmpping paraemters are mandatory, if not present it will default to host itself anyway, so no need to redefine it...