How do you deal with trend alerts and reports?

[G0nz0uk]

Hello,

We have about 6k host devices we monitor in Zabbix (7.4.7). There are all sorts of devices we have to monitor. We don't manage these devices, however I have noticed there are some devices that repeatedly lose ICMP or SNMP access and get missed.

I can see on the graphs that this is happening. I have a simple trigger like this to capture when it happens.

max(/Diagnostics-boards/zabbix[host,snmp,available],#20)=0

so after 20mins (1 x 1m polls) we get an alert.

What metric would you use to trigger if for example a devices has repeatedly had issues over a 30 day period? I'd call this 'Trend' alerts or something.

What they do is fix the device in question and don't realise its a repeating problem so I'd like to capture this.

Any ideas would be great.

[troffasky]

I don't have a trigger to handle this kind of scenario ["meta-trigger"] but I do keep an eye on the top 100 triggers report.

[G0nz0uk]

That's a useful report actually. Can these be emailed out?

I just filtered out using tags to get a view I like. Doesn't look like you can save these custom views?