Alert rule seemingly not firing at random

[D4ed4lus]

Hi there!

I am having this bizarre issue with Zabbix now. More precisely, it seems like my alert rule 'Integrate with ITSM' is not working as expected. For example, when a Linux guest runs out of memory, it triggers an alert which per the rule above will invoke a ticket in OTRS. However, if an interface goes down on an OPNsense instance, an alert triggers but no further action is done by Zabbix. My alert rule is very simple; all alerts that are of "Information" and higher, will trigger a message to my ITSM OTRS. That's it, no further filtration is done. Everything that happens should be piped into my ITSM tool.

I even attempted to add a tags to the triggers that are known not to fire correctly and add that same tag as a condition for the alert rule. This made no difference. Even more unusual is the fact that some templates seem to only half work in this regard, for example my Xen Orchestra template fires some alerts correctly and some not. I have checked all the triggers manually but I do not see anything obvious. Also, I do not see anything related to these alerts in the action log. Is there anything further to check or have I stumbled into a bug?

System information:
Zabbix version: 7.0.22
Host OS: Oracle Linux 8.10 aarch64
Affected (Zabbix provided) templates: "ICMP Ping", "OPNsense by SNMP"

[Viktors Fomics]

Hello

Your description of "my Xen Orchestra template fires some alerts correctly and some not" makes it sound like some SNMP packets might be lost, as for the trigger to work it needs to receive the corresponding status via SNMP. For example, if your interface is down, yet the SNMP packet with the status update doesn't reach Zabbix at all, the trigger won't fire.

Would be a good idea to start with testing the connectivity to check if there is no packet loss between Zabbix server and the problematic host, running multiple ping commands in a row should be sufficient. Additionally, double-check the connectivity via UDP port 161 (nc -vzu HOST_IP 161).

If connectivity is looking good, next step would be to run the corresponding snmpget from the Zabbix server to the host (the .1.3.6.1.2.1.2.2.1.8 OID should be what you are looking for to get), if the expected value is returned.

[troffasky]

an alert triggers but no further action is done by Zabbix.

Does the user who is supposed to be alerted by 'Integrate with ITSM' have permission to the hosts that it's not getting alerts for? Needs at least read permissions in order to receive alerts.

Is there anything further to check or have I stumbled into a bug?

Let's go with "config issue" for now, it can be pretty tricky working out all the necessary elements to get things to alert properly!