Zabbix email altering - 1000's generated

[william1872]

Hi,

One of my customers lost a WAN link over the weekend and zabbix continuously alerted every time a icmp ping was performed, he's using v1.6. I thought zabbix alerted once for a node down / and once when the node was up again, or is that not the case and can zabbix be configured to that type of setting?

William

[william1872]

can anyone help with this please?

[MrKen]

Zabbix can be personalized to suit any situation.

Can you post a copy of your Trigger expression?

[william1872]

Hi MrKen,

Sorry for the delayed reply I've been away, here's the ping config..

<item type="3" key="icmpping" value_type="3">
<description>Ping Network Device</description>
<ipmi_sensor/>
<delay>300</delay>
<history>90</history>
<trends>365</trends>
<status>0</status>
<data_type>0</data_type>
<units>64</units>
<multiplier>0</multiplier>
<delta>0</delta>
<formula>1</formula>
<lastlogsize>0</lastlogsize>
<logtimefmt/>
<delay_flex/>
<authtype>0</authtype>
<username/>
<password/>
<publickey/>
<privatekey/>
<params/>
<trapper_hosts/>
<snmp_community>public</snmp_community>
<snmp_oid>interfaces.ifTable.ifEntry.ifInOctets. 1</snmp_oid>
<snmp_port>161</snmp_port>
<snmpv3_securityname/>
<snmpv3_securitylevel>0</snmpv3_securitylevel>
<snmpv3_authpassphrase/>
<snmpv3_privpassphrase/>

[MrKen]

That's very nice, but, that is the Item configuration. What we need is your Trigger expression. It should be something like: {MyServer:icmpping.blah?}

[william1872]

oops.. sorry, here's the Trigger for the ping test.

<trigger>
<description>Ping connection lost</description>
<type>0</type>
<expression>{Template_Windows_Client:icmpping.last (0)}<1</expression>
<url/>
<status>0</status>
<priority>5</priority>
<comments/>
</trigger>

[MrKen]

The icmpping will give a result of 0=Fail, or 1=OK. So your trigger means that if the 'last' value is less than 1 then the trigger will fire. It should not continue to fire while the value remains at 0.

Check your latest data for the period in question to see whether the ping result was down, up, down, up, down, etc (i.e. a flapping trigger).

This is the trigger that I use for icmpping
({Template_Windows_Client:icmpping.max(300)}=0)|({ Template_Windows_Client:icmpping.nodata(300)}=1)

It means that the ping must fail for 5 minutes before it fires the trigger, OR, there is no data from the client for 5 minutes.

Hope that helps.
MrKen

[william1872]

Hi MrKen,

That does help, and from memory the trigger was flapping. The WAN connection was down for about 12 hours, the configuration for your trigger would that still fire alerts every five minutes or stop on the first fail until connectivity is restored?

Regards

William

[MrKen]

. . . the configuration for your trigger would that still fire alerts every five minutes or stop on the first fail until connectivity is restored?

I guess that would depend on the flappiness. If the status changes back to Ping=OK, then it would be ready to fire again the next time there is 5 minutes of Not OK.

Perhaps you might be better using a different Item/Trigger for your customer, something like a Port status check. Maybe a 'Simple Check' for tcp, ssh, http connectivity.

[william1872]

I'll do some testing with the client.... thanks for your help