Zabbix 1.6 - Events - Date Range

[Palmertree]

Is there anyway to show a range of events for a number of days or is it just one day at a time? Need to be able to pick a "from" date to a "to" date to see how many times and event occurred.

[Aly]

Sorry, for now there is no such possibility.

[Palmertree]

Thanks Aly. Got around this by creating a report using IReport which worked.


Here is the SQL Query for ireports incase anyone else needs to the same thing. :-)

SELECT
     triggers.`description`,
     events.`clock`,
     hosts.`host`,
     items.`description`,
     sum(events.value)
FROM
     `triggers` triggers INNER JOIN `events` events ON triggers.`triggerid` = events.`objectid`
     INNER JOIN `functions` functions ON triggers.`triggerid` = functions.`triggerid`
     INNER JOIN `items` items ON functions.`itemid` = items.`itemid`
     INNER JOIN `hosts` hosts ON items.`hostid` = hosts.`hostid`
WHERE
     events.value = '1'
     AND ((FROM_UNIXTIME(events.`clock`) >= STR_TO_DATE('$P!{Begin_DateTime}','%a %b %d %k:%i:%s EST %Y'))
     OR (FROM_UNIXTIME(events.`clock`) >= STR_TO_DATE('$P!{Begin_DateTime}','%a %b %d %k:%i:%s EDT %Y')))
     AND ((FROM_UNIXTIME(events.`clock`) <= STR_TO_DATE('$P!{End_DateTime}','%a %b %d %k:%i:%s EST %Y'))
     OR (FROM_UNIXTIME(events.`clock`) <= STR_TO_DATE('$P!{End_DateTime}','%a %b %d %k:%i:%s EDT %Y')))
GROUP BY
     `hosts`.host,
     triggers.description
ORDER BY
     `hosts`.host ASC,
     triggers.description ASC

[bbrendon]

Thanks Aly. Got around this by creating a report using IReport which worked.

Damn you and your iReports. I'm so jealous. Someone create a howto already so I don't have to spend a month on a new project.

...Or who is for hire to help with this?

And regarding the fact that you can't see multiple days of events. PATHETIC. You could in the old version. Albeit 100 events, but that was usually multiple days. The new events screen sucks. :P

[Aly]

Damn you and your iReports. I'm so jealous. Someone create a howto already so I don't have to spend a month on a new project.

...Or who is for hire to help with this?

And regarding the fact that you can't see multiple days of events. PATHETIC. You could in the old version. Albeit 100 events, but that was usually multiple days. The new events screen sucks. :P

Something tells me that possibility to pick a range, will be back (something like it was in 1.5.x) :P

[mauibay]

Wow. I'll echo the opinions that limiting the event view to a single day, well, sucks. It's quite a backward step, IMHO.

Now that I know there isn't some non-obvious way to make the event list useful via the interface, I simply patched the source to return a window of multiple days instead of a single day, based on the date selected. It's an easy patch around line 242 of events.php:

// Day View Calc

        $start = $_REQUEST['nav_time'];
        $start  = mktime(0, 0, 0, date('m',$start)  , date('d',$start), date('Y',$start));
        $end = $start+86400;

For example, to return a week worth of events ending with the date selected, subtract 6 days from the start date and add to the end date accordingly:

// Day View Calc

        $start = $_REQUEST['nav_time'];
        $start  = mktime(0, 0, 0, date('m',$start)  , date('d',$start), date('Y',$start));
        $start = $start-86400*6;
        $end = $start+86400*7;

This will suit my needs for now, although I personally find 30 days much more useful to easily spot patterns that indicate problems.

<rant>
I'm still shocked this was crippled like this. Seriously, this is one of the most valuable troubleshooting tools I use to tell if a host has a cyclic problem or shares concurrent issues with other resources. Intraday events simply are rarely ever likely to provide enough useful data to, well, be useful! I want to look at least a week or month of events to compare and see patterns.

I was blown away when I had a resource down this morning, and the event list showed "None" simply because the event occurred right before the (rather arbitrary) boundary of midnight and so wasn't displayed. The date and time an event occurs is useful data to be sure, but it borders on useless for filtering how many recent events to display. I don't want to have to scroll through dates looking for events, I want to scroll through events looking for dates.
</rant>

Now to say simething nice... Zabbix does rock. Oh, very seriously does it rock.

[Alexei]

I'm still shocked this was crippled like this. Seriously, this is one of the most valuable troubleshooting tools I use to tell if a host has a cyclic problem or shares concurrent issues with other resources. Intraday events simply are rarely ever likely to provide enough useful data to, well, be useful! I want to look at least a week or month of events to compare and see patterns.

Perhaps it should be resolved in a different way. I think that a special daily/weekly/monthly report which would display number of problem for each host or a group of hosts with hourly/daily breakdown is what you need.

While I agree to some extent that the daily view maybe not the best tool for long term event analysis, remember that is not supposed for this.

What do you think?

[bbrendon]

Perhaps it should be resolved in a different way. I think that a special daily/weekly/monthly report which would display number of problem for each host or a group of hosts with hourly/daily breakdown is what you need.

While I agree to some extent that the daily view maybe not the best tool for long term event analysis, remember that is not supposed for this.

What do you think?

Thats fine. You could also make the events.php file have a start date on top, and end date on bottom and list events within that range on the with the newest at the top.

Or have a start and end calendar selection.

Or like you said a report. I never use reports because honestly, the are too hard to understand and I don't think the data is presented well. As a sysadmin, I would definately like events.php modified.

I would dump the reports section of zabbix and redo it. Maybe its better to require people to have iReports for zabbix reporting and have some documentation on how to get it up and running. Zabbix reports are horrible as of now.

[mauibay]

Perhaps it should be resolved in a different way. I think that a special daily/weekly/monthly report which would display number of problem for each host or a group of hosts with hourly/daily breakdown is what you need.

While I agree to some extent that the daily view maybe not the best tool for long term event analysis, remember that is not supposed for this.

What do you think?

Perhaps my misunderstanding is that I don't see how or why it should be considered the "daily view" and expect it to be the "event view", showing the most recent events regardless of the day. The screen is titled "History of Events" but that's not what it is anymore. Instead of showing the event history, it's showing a window of time, regardless of whether or not that window contains any events.

I don't understand how it wouldn't be intended for event analysis, I frankly don't see what other function it has. It's the main screen to view, analyze, and acknowledge events. I don't consider everything over 24 hours to be "long term" and IMHO it's just silly to break up event viewing into 24 hour chunks, since it can easily prevent connected and consecutive events from appearing on the same view. If I see an OFF event, I want to see the ON event that preceeded it, not have it stuck on a previous page simply because it happened to be on the other side of a midnight boundary. If a given host has only a dozen events in a year, I'm not sure why anybody wouldn't want the default view to show them all.

I'm aware that many admins use these tools to monitor a wide range of diverse systems, and perhaps other people have so many events per day for a host that they don't want to display them all on a single page, but that's not my situation (and I suspect it's relatively rare.) In my case, forcing events to be viewed in increments of 24 hours means many days of empty pages, and it's _way_ inconvenient to have to go searching for the second-most-recent event because it happened 93 days ago and doesn't appear in the "Event History".

No offense intended, I'm sure I see the tools differently than many others do and I just see zero advantage due to my own tunnel vision based on my particular needs and limited imagination.

So while a daily/weekly/monthly reporting functions as you suggest would no doubt be a great addition, I see that as more of a management and statistics feature than a frontline or administrator feature. I think the default displays should be oriented for troubleshooting and acknowledging notifications because that's what I personally use the system for. When a trigger fires and the overview shows an alert, I want to click on it and see the recent events, not go fishing through day views or selecting report generation criteria. The event history in 1.4 did that, *click* and there it all was, with date and time given for each event. Now in 1.6 I need to tell it when the event happened to get it to show it to me, or go hunting for it, and that's just backwards.

On the plus side, this is one of the main reasons I love open source. In cases where my needs differ from the majority, I'm free to customize. I currently have my "History of Events" showing me a 28-day window ending with the date selected, which suits my needs just fine, it's just one of several simple patches I maintain for my copy, along with changes I've made to the overview display and various mods to compact my screen displays and minimize screen real-estate.

I'll say it again though, Zabbix does rock.!

PS, I don't consider myself a slow poster, but this forum expires sessions so fast I rarely can get a post typed up without having to re-login! I never learned brevity.

[Tristan]

Thanks Aly. Got around this by creating a report using IReport which worked.


Here is the SQL Query for ireports incase anyone else needs to the same thing. :-)

SELECT
     triggers.`description`,
     events.`clock`,
     hosts.`host`,
     items.`description`,
     sum(events.value)
FROM
     `triggers` triggers INNER JOIN `events` events ON triggers.`triggerid` = events.`objectid`
     INNER JOIN `functions` functions ON triggers.`triggerid` = functions.`triggerid`
     INNER JOIN `items` items ON functions.`itemid` = items.`itemid`
     INNER JOIN `hosts` hosts ON items.`hostid` = hosts.`hostid`
WHERE
     events.value = '1'
     AND ((FROM_UNIXTIME(events.`clock`) >= STR_TO_DATE('$P!{Begin_DateTime}','%a %b %d %k:%i:%s EST %Y'))
     OR (FROM_UNIXTIME(events.`clock`) >= STR_TO_DATE('$P!{Begin_DateTime}','%a %b %d %k:%i:%s EDT %Y')))
     AND ((FROM_UNIXTIME(events.`clock`) <= STR_TO_DATE('$P!{End_DateTime}','%a %b %d %k:%i:%s EST %Y'))
     OR (FROM_UNIXTIME(events.`clock`) <= STR_TO_DATE('$P!{End_DateTime}','%a %b %d %k:%i:%s EDT %Y')))
GROUP BY
     `hosts`.host,
     triggers.description
ORDER BY
     `hosts`.host ASC,
     triggers.description ASC

Question.. when i use this query i got an error in ireport about the datetime function. Could you tell me what i doing wrong?

i create a new report in ireport with the wizzard and add your sql code. WHen i run the report i got the error.

[shohn]

zxml

Any chance you could share a sanitized version of the ireport templates?



Also, for some reason when I try to query my database the "Free memory" item is not showing up in the db after an upgrade to 1.6. What is weird is that the graphing for Total and Free Memory still works, but when I attempt to query it out of the trends table it is cut off the day of the upgrade. Other data items are in there.... any idea?



SELECT hosts.`host` AS hosts_host, CONVERT_TZ(FROM_UNIXTIME(trends.`clock`),'+00:00', '-05:00') AS trends_clock, trends.`value_min` AS trends_value_min, trends.`value_avg` AS trends_value_avg, trends.`value_max` AS trends_value_max, trends.`num` AS trends_num, items.`description` AS items_description FROM `items` items INNER JOIN `trends` trends ON items.`itemid` = trends.`itemid` INNER JOIN `hosts` hosts ON items.`hostid` = hosts.`hostid` WHERE hosts.`host` = 'host1' AND items.`description` LIKE 'Free memory' AND (FROM_UNIXTIME(trends.`clock`) >= STR_TO_DATE('2008-10-1 12:00:00.0','%Y-%c-%d %k:%i:%s.0') AND FROM_UNIXTIME(trends.`clock`) <= STR_TO_DATE('2008-11-1 12:00:00.0','%Y-%c-%d %k:%i:%s.0'))