Ad Widget

Collapse

Log Monitoring, trigger goes off, but no actions

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • leon.kofman@gmail.com
    Junior Member
    • Sep 2008
    • 10

    #1

    Log Monitoring, trigger goes off, but no actions

    I having a strange problem with windows log monitoring.

    I followed the "cook book" to create windows log monitoring system, and it woks for most part, except I do not get emails when there is a problem:

    Here is the configuration:

    Item:
    Type "Zabbix Agent (active)"
    key "eventlog[application]"
    Type of information "log"

    Trigger:
    ({Template_Windows:eventlog[application].logsource(SMVI)}=1)&({Template_Windows:eventlog[application].str(ERROR com.netapp.smvi.task.vmware.snapshot.VmSnapshotCre ateDelay)}=1)&({Template_Windows:eventlog[application].nodata(30)}#1)

    Action:
    Subject {TRIGGER.NAME}: {STATUS}
    Message {HOSTNAME}: {ITEM.LASTVALUE}
    Conditions Host = srqsanmgmt AND Trigger value = "PROBLEM"

    Trigger works, but actions do not. Here is what I see in under Events:
    009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully OK High 56m 30s No
    -
    2009.Jun.11 11:05:12 srqsanmgmt: VMWare Snapshot did not compelete sucsesfully PROBLEM High 0s No
    -

    If you notice, both of these events happen at the same time, and I believe that's the problem. The trigger supposed to set to "PROBLEM" when there is new data within 30 seconds, and set to "OK" where no new events are detected.

    However, in this case, it sets to "PROBLEM", and then get set back to OK right-away, so action never get a chance to be kicked off.

    What I am missing?

    I would appreciate any help!

    ----------------------
    Zabbix 1.6.4
    80 clients
    ----------------------
  • richlv
    Senior Member
    Zabbix Certified Trainer
    Zabbix Certified SpecialistZabbix Certified Professional
    • Oct 2005
    • 3112

    #2
    not quite sure about trigger flapping, but action should be executed anyway. does the user, specified in the operations, has at least read access to the systems, generating the event ?
    Zabbix 3.0 Network Monitoring book

    Comment

    • leon.kofman@gmail.com
      Junior Member
      • Sep 2008
      • 10

      #3
      Yes, the user has access to those hosts. What is strange, is sometimes the action works. I think it's some kind of a bug. The trigger goes to PROBLEM then to OK right away. There is no time in between, and action has no time to be kicked of.

      It also worth mentioning, that the log monitoring is on the windows machine.

      Does anyone has any suggestions? I have been hitting my head against it for couple of weeks with no luck.

      Thanks!

      Comment

      Working...