Eventlog monitoring and ITEM.LASTVALUE

[Calypso]

Hi all,

Currently I'm working on the eventlog monitoring. Everything is running smoothly except for one thing. I use ITEM.LASTVALUE in my action to report the message of the event to the user.

When I get a number of events at the same time there is a delay between the trigger which creates the event and the moment the trigger raises and the action reads out the ITEM.LASTVALUE, a new trigger can occur and thus the value of ITEM.LASTVALUE changes to the message of the latest trigger.

Result is that I can get multiple messages with exactly the same message (ITEM.LASTVALUE) instead of the different messages I'm expecting.

Is there a way to fix this?

[[email protected]]

Try {ITEM.VALUE1}
That is the value of the item that launched the trigger.

[Calypso]

Try {ITEM.VALUE1}
That is the value of the item that launched the trigger.

True, tried it, but that one isn't recognized (translated in the message) in an action. At least not in my version 1.6.5

[[email protected]]

It works in a trigger, but not in an action.

That is exactly conform the manual v.1.6 p90.

I am not very happy with that, just like you.

Is it a bug ?

[gospodin.horoshiy]

any solution for using {ITEM.VALUE1} in actions yet?

[NOB]

any solution for using {ITEM.VALUE1} in actions yet?

If I understand the entry in the ChangeLog for ZABBIX 1.7.0 correctly

- [DEV-358] added notification/trigger description macros {ITEM.LASTVALUE[1..9]} (Sasha)

It is in 1.7.x and will be in 1.8.

Regards

Norbert.

[gospodin.horoshiy]

mmm can't wait! I'm itching

[DSon]

ITEM.VALUE / VALUE1 ... Historical?

Hi,

I've tried using both ITEM.VALUE and ITEM.VALUE1 in my actions however when a new event is posted to the event log it gives me the values for this, instead of the actual value of the item WHEN IT SET THE TRIGGER.

Oh, and I'm using 1.8.1 which - according to the manual - allows the reporting of "HISTORICAL" values.

To explain further, here is my trigger:

((({TRIGGER.VALUE}#2 | {Template_APP_Live:eventlog[My Event Log].nodata(120)}#1) & ({Template_APP_Live:eventlog[My Event Log].logseverity(4)}=4 & {Template_APP_Live:eventlog[My Event Log].str("Data content error")}=1 | {Template_APP_Live:eventlog[My Event Log].str("File corrupt")}=1 | {Template_APP_Live:eventlog[My Event Log].str("Could not find file")}=1)) | ({TRIGGER.VALUE}=1 & ({Template_APP_Live:eventlog[My Event Log].logseverity(2)}#2 & {Template_APP_Live:eventlog[My Event Log].str("Previous error event(s) resolved by")}#1)))

What the above does is to set trigger = true when an error event occurs containing any of the four possible strings of text. This trigger is then set = false if an event is then logged containing the string "Previous error event(s) resolved by".

The problem is my action is reporting the latest value for the item instead of the value that caused the trigger = true event.

Here is my action message:

++ PROBLEM MESSAGE SENT {DATE} {TIME} ++
PROBLEM DATE/TIME: [{EVENT.DATE} {EVENT.TIME}]
PROBLEM SYSTEM: [{HOSTNAME}]
PROBLEM ITEM: [{TRIGGER.NAME}]
PROBLEM EVENT LOG DATE/TIME: [{ITEM.LOG.DATE} {ITEM.LOG.TIME}]
PROBLEM EVENT LOG ID: [{ITEM.LOG.EVENTID}]
PROBLEM EVENT LOG SEVERITY: [{ITEM.LOG.SEVERITY}]
PROBLEM EVENT LOG SOURCE: [{ITEM.LOG.SOURCE}]
PROBLEM EVENT LOG VALUE:
[{ITEM.VALUE1}]
PROBLEM AGE: [{EVENT.AGE}]
PROBLEM EXPLANATION:
[{TRIGGER.COMMENT}]
++ PROBLEM MESSAGE END ++

As stated previously, using ITEM.VALUE, LASTVALUE and ITEM.VALUE1 still reports the latest event details. I've also noticed that the ITEM.LOG.EVENTID / SEVERITY / SOURCE are all incorrect - they are the latest item value instead of the original value that caused the trigger.

Hope someone can help me with this - surely I'm not the only one to struggle?

DSon.

[_Phoenix_]

I have the same problem.
But {EVENT.ID} - always different. Does somebody know, how get log value by eventid?

[xibbaz]

This is still happening in 1.8.8.

Any updates on this bug?

[GArmao]

same issue here, but with zabbix trapper text item so I guess it's not only related to eventlog.
I have a trigger set up to generate events on "Normal + Multiple events", and an action that sends an email with "ITEM.VALUE" (but I tried with "ITEM.VALUE1" and "ITEM.LASTVALUE"), when I receive many errors at once, I receive many emails but all of them containing the same "ITEM.VALUE" message, which is actually the last error received instead of the error at the time of the trigger.


it seems the error has been already reported and fixed in 2.0

https://support.zabbix.com/browse/ZBX-2776

[xibbaz]

Well, that is great news. But since I'm waiting for the final 2.0 release, in the meantime, I have created an action that launch a remote command on the host to parse the log file for the searched string and email it directly, therefore completely bypassing Zabbix for this specific purpose.

But since it is claimed to be fixed, at least I don't have to elaborate too much on this workaround.

Thanks