Combine problems in Zabbix

[sbeheer]

Hi Everyone.

We have a zabbix server which monitors about 800 servers. We trigger the following events:

http service, https service, ssh service, zabbix service.

The issue we have now is that if a server is offline for whatever reason, we get all events, servers going offline is a scenario that occurs often which that much servers.

So a offline server in zabbix says: ssh down, httpd down, zabbix down which gets messy.

We've tried event correlation to combine problems into 1 problem "host down" but did not succeed. Dus anyone know how to handle this?

[kloczek]

Looks like you have no dependencies defined between the triggers.
In my templates you can find example how to define what you want https://github.com/kloczek/zabbix-te...ter/OS%20Linux
In this template you can find "SYS::Host is down" trigger wit definition like:

{OS Linux:icmpping.count(#10,0,"eq")}>9 and
{OS Linux:agent.ping.nodata(15m)}=1 and
{OS Linux:system.uptime.count(15m)}=0

And this trigger is listed in many other triggers dependencies so when "SYS::Host is down" trigger is active all other triggers which depensd on this one are hidden and only this one is shown in list of active triggers.
The same stratey is uses in Solaris and Windows templates:

https://github.com/kloczek/zabbix-templates/tree/master/OS%20Solaris

https://github.com/kloczek/zabbix-templates/tree/master/OS%20Windows

[bbrendon]

You want dependencies, not event correlation. You can do some of that in templates but not much. You'll probably have to script a solution using the API.

So first set it up like you have it with templates etc. Then use a script to connect the triggers to their hosts using dependencies. You can do this using the GUI, but it would take you forever to do it for a lot of machines so you're probably best off checking out the API.

[guruprasad.ds17]

Hi Brendon, Can you throw some more light son how to do it via API or script?