Hi,
we are rolling out zabbix to monitor the services of a medium organization (around 100 people).
We currently plan on giving most users read access to most of the hosts so that everyone is on the same page about how big a potential failure is. We also plan on giving write access to teams to the hosts they operate so that they can customize the monitoring to their needs.
If we do this most of the people will have read access to many hosts that they don't operate and that they can not fix problems when they appear. They will however have write access to the hosts for whom they can react to problems. To reduce the noise of unactionable notification we only want to notify the users on "their" hosts. Previously we did this by putting hosts and users in groups and adding trigger actions to only notify the users of group a on problem on hosts on group a. We fear that when we roll this strategy out to the whole organization that might result in a huge number of trigger actions that could get hard to manage.
Therefore the Idea is to have a trigger action that simply says "notify all users that have write access to this host". Our first attempt on this was having a script media type called "Email (Read/Write Hosts)". It calls a script that checks if the user has write access and sends out a Mail if they have and simply ignores it if they don't. You can find a bash version of the script attached. It resorts to 'cat' and 'grep' for "parsing" the json because jq is unfortunately not available on the container that runs zabbix. I would not suggest running this in other peoples production environment. This seems to get the effect but I see two problems: 1. this will result in all users in the list of the Recipient of a problem but only some of them actually get a notification. This reduces transparency. 2. This only works for mail notifications.
My suggestion is to add an option to the "Send message" operation. It could simply be "Only notify users with Read-Write Access". It would only create notifications for users that have Read-Write access to any host that participated in this trigger. The reasoning behind this is that if there are multiple hosts in the trigger people responsible (marked by having Read-Write Access) for any host could potentially fix the problem.
I would be willing to help test/implement this but I am not fluent enough in C an the Zabbix server code to create a merge request. The PHP/Webfrontend side would (IHMO) be nearly trivial.
Please correct me if some of my assumption an incorrect or this could be impemented with existing features.
Kind regards
Clemens
we are rolling out zabbix to monitor the services of a medium organization (around 100 people).
We currently plan on giving most users read access to most of the hosts so that everyone is on the same page about how big a potential failure is. We also plan on giving write access to teams to the hosts they operate so that they can customize the monitoring to their needs.
If we do this most of the people will have read access to many hosts that they don't operate and that they can not fix problems when they appear. They will however have write access to the hosts for whom they can react to problems. To reduce the noise of unactionable notification we only want to notify the users on "their" hosts. Previously we did this by putting hosts and users in groups and adding trigger actions to only notify the users of group a on problem on hosts on group a. We fear that when we roll this strategy out to the whole organization that might result in a huge number of trigger actions that could get hard to manage.
Therefore the Idea is to have a trigger action that simply says "notify all users that have write access to this host". Our first attempt on this was having a script media type called "Email (Read/Write Hosts)". It calls a script that checks if the user has write access and sends out a Mail if they have and simply ignores it if they don't. You can find a bash version of the script attached. It resorts to 'cat' and 'grep' for "parsing" the json because jq is unfortunately not available on the container that runs zabbix. I would not suggest running this in other peoples production environment. This seems to get the effect but I see two problems: 1. this will result in all users in the list of the Recipient of a problem but only some of them actually get a notification. This reduces transparency. 2. This only works for mail notifications.
My suggestion is to add an option to the "Send message" operation. It could simply be "Only notify users with Read-Write Access". It would only create notifications for users that have Read-Write access to any host that participated in this trigger. The reasoning behind this is that if there are multiple hosts in the trigger people responsible (marked by having Read-Write Access) for any host could potentially fix the problem.
I would be willing to help test/implement this but I am not fluent enough in C an the Zabbix server code to create a merge request. The PHP/Webfrontend side would (IHMO) be nearly trivial.
Please correct me if some of my assumption an incorrect or this could be impemented with existing features.
Kind regards
Clemens