Delay problem generation if some tag is configured

[riBoon]

Hi,
we are using zabbix version 7.

We have a template which checks for the availability of zabbix agent and other stuff.
This template is configured to important hosts and not so important hosts.

Is it possible to have the problem generation delayed by some time for the not so important hosts? We would like to configure a tag to the not so important hosts at host level.

Our goal is to get the alarms for the important hosts directly and the not so important hosts delayed (or no alarm, if they are ok after a while).

I thought about configuring this in actions but actions won't reduce the problem generation itself.

[riBoon]

I've extended some triggers with macros so they can be configured less nervous on host level.
But the changes are hard to test and it would be cool if there is some other solution for that.

If newer zabbix versions offer solutions, I'm open to hear about that too.

[Rudlafik]

Testing is simple on the test machine, turn off the zbx agent service and watch how long it takes for the alert to arrive. Put the configured template on the test host as you need. Otherwise, I also solve what you describe, I have a specific template for guests of the L00 - L05 group. 6 templates with different macro values both in the metric and alerts. Production servers receive an alert immediately after 3 failures, on test servers after 6, and on development servers I do not monitor the given item at all.

For example, it is set up so that you check the item after 1m but the alert changes the repetition value or time interval with a macro.

[Brambo]

Why not solve this in you alert actions steps? (you keep your templates all the same)
In alert actions have action for important host group and with delay for less importat.
AND/OR use tags to make this split between important and less important (if tag exists or contains value) do this action. >>

Only when you also want to delay the problem creation on zabbix dashboard for example you need to solve it at trigger level. Than a template macro is useful and you set this on host level to your amount of delay. When you do it on trigger level than alert actions is not really needed but in my opinion using host groups is the easiest way and also best visually for troubleshooting.

[irontmp]

Testing is simple on the test machine. Turn off the Zabbix agent service and watch how long it takes for the alert to arrive. Put the configured template on the test host as you need. If you're organizing owner resources for your infrastructure, it's also helpful to document which templates apply to which systems. Otherwise, I solve this by using a specific template for guests in the L00 to L05 group. I have six templates with different macro values for both metrics and alerts. Production servers receive an alert immediately after three failures, test servers after six failures, and development servers do not monitor the given item at all.

For example, it is set up so that you check the item after 1m but the alert changes the repetition value or time interval with a macro.

Actions won't help because they only delay or suppress notifications, not the creation of the problem event itself. If you want the problem itself to be generated later for less important hosts, you'll need different trigger logic. The most common approach is to use separate templates (or separate triggers) for critical and non critical hosts, with the non critical version requiring the condition to persist for a few minutes before firing. Unfortunately, you can't use a host tag to dynamically change a trigger's problem generation delay in Zabbix 7. Separate templates or different triggers are the practical solution.