Event Correlation working partially
Hi all!
I'm quite new to Zabbix and monitoring. I’m trying to configure event correlation to automatically close “minor” events when a related “major” event is triggered.
--Interfaces in a LACP aggregate on Juniper: if an alarm is raised on the aggregate itself, all alarms on the member interfaces should be closed.
--Configuration details:
I’m using event correlation based on tags.
There are 3 tags involved in my example:
host_name: e.g. Host_A
lacp_name: e.g. ae6 (the aggregate name)
lacp_sub: e.g. ae6 (aggregate to which the interface belongs)
--The logic is: compare matching hostnames (since multiple hosts are monitored), and compare lacp_name against lacp_sub.
--Problem: The correlation only works partially - some minor events are closed correctly, but others remain open. Also, some of events re-trigger after closing by event correlation rule.
I've attached screenshots with 2 versions of event correlation rules and example of link failure where I can see that it partially works.
--Question:
Where should I look to troubleshoot this? Should I enable additional monitoring or debug? Check the DB? Event queue? Where to look?
Any advice on how to debug this behavior would be greatly appreciated. Or any other suggestions on how I can do this based on hostnames and lacp names(preferably no external scripts if possible)?
I'm quite new to Zabbix and monitoring. I’m trying to configure event correlation to automatically close “minor” events when a related “major” event is triggered.
--Interfaces in a LACP aggregate on Juniper: if an alarm is raised on the aggregate itself, all alarms on the member interfaces should be closed.
--Configuration details:
I’m using event correlation based on tags.
There are 3 tags involved in my example:
host_name: e.g. Host_A
lacp_name: e.g. ae6 (the aggregate name)
lacp_sub: e.g. ae6 (aggregate to which the interface belongs)
--The logic is: compare matching hostnames (since multiple hosts are monitored), and compare lacp_name against lacp_sub.
--Problem: The correlation only works partially - some minor events are closed correctly, but others remain open. Also, some of events re-trigger after closing by event correlation rule.
I've attached screenshots with 2 versions of event correlation rules and example of link failure where I can see that it partially works.
--Question:
Where should I look to troubleshoot this? Should I enable additional monitoring or debug? Check the DB? Event queue? Where to look?
Any advice on how to debug this behavior would be greatly appreciated. Or any other suggestions on how I can do this based on hostnames and lacp names(preferably no external scripts if possible)?
Attached Files
Comment