Improving your items, triggers, and actions.

[cstackpole]

I have been toying with this idea for a few weeks. Initially it was something I was just going to do on my own but I have decided that if I do this, I would really prefer to have others in the Zabbix community help out.

Time and time again we see, on this forum, tons of posts (from newcomers to experienced users) about how they are having problems with an item not reporting the value that they expected. Many times it is simply because they don't know about a certain Macro, or a certain function. I know I have run into this many times.

Another topic that I have seen and run into myself many times is that an item/trigger/action is configured based on the templates so it isn't the best method of achieving the goal. There are better ways of doing the same task that yield better results with less false positives.

I spent some time thinking about it and I came up with the idea that we could setup a section on the wiki dedicated to creating items/triggers/actions. However, to work we would need to have plenty of details like:
Purpose: What is the goal? What is being monitored? How?
Configuration:How is the server configured to accomplish the purpose? How is the agent configured?
Item: How is the item configured.
Trigger: What are the limits of the trigger? When should it go on and when should it go off?
Action:Who should be notified when and how?

Even if all we do is create a template outline so that people can fill out and use it for their post it should help make things easier for them, those helping, and those who may need it in the future. It could also be used in the documentation as there would be plenty or examples already made to use.

So, what does the community think? Is it worth the time and effort to create, update, and maintain? Or is the current method sufficient for people?

Do you have a better solution?

[cstackpole]

To better explain what I am after I have posted an example.

Purpose: To monitor a log file located /var/log/mylog.file for the key word ERROR. Every keyword found should send an alert. This will be an item used by many systems.

Configuration: Standard Zabbix server and agent install.

Item:
Type: zabbix_agent (active)
Key: log[/var/log/mylog.file,ERROR]
Type of information: Log
Log time format: yyyy-MM-ddThh:mm:ss
Applications: Log Files

Trigger:
Name:Error in log file
Trigger: {host:log[/var/log/mylog.file,ERROR].nodata(1)}#1

Action:
Condition: Trigger like "Error in log file"
Operation: Send message to user
Subject of operation: {HOSTNAME}:{TRIGGER.NAME}
Body of operation: {{HOSTNAME}:{TRIGGER.KEY}.last(0)}

This may not be the best example, but it should get across the level of details and information that I would like to see. This much detail should give everyone a really good idea on how to create their own variation. Also it gives a starting point for discussion if there is an improvement to be made as everyone will know what goal is to be accomplished.

[nelsonab]

I like that idea. I'm game. :-)

[cstackpole]

Alright! Well I have 7 votes and no bad postings so I will go ahead and pull together what I have and post it on the Wiki. I am hoping to have some down time later this week so I will try to get it all up there then. I will post back when it is up.

Have fun!