query with escalations actions

[allen_zhou]

Hi Guys,

I'm using 1.8.5 zabbix
My met below strange things when I enable escalations in actions configuration.
Could you guys help to check if this is normal?

1.The Recovery message also was delay 2 minutes(I think this is not correct)
2.I didn't receive the PROBLEM notification but received the OK one when my syslogd process recovered in 2 minutes.(it also should not be..in my opinion,if the system didn't send me the PROBLEM one ,it also should not send me the OK one)

appreciated for any of your reply

Best Regards,
allen

[zabbix_zen]

To fully understand escalations you do need to read the manual.

1)
Your recovery message applies by default a 120sec(2min) pause between any escalation step as you configured in 'Period (seconds)' in the upper left corner.
If you want the first step to be executed as soon as the event is Triggered, you must configure 'Delay: Immediately' on the screen upper right corner.

2)
When selecting 'Recovery message' it's mandatory to add the Action condition,
Trigger value = "PROBLEM"
so you both receive the PROBLEM and OK event messages.

[allen_zhou]

Hi Zabbix_zen,

Thanks for your reply.
I still have some query in my mind..
1.for example:
The problem occurred at 11:18
I received the problem notification message at 11:20
the problem was recovered at 11:21
but I can only receive the recovery message at 11:23

Do you mean it is correctly?
But I think we should recovery message as soon as the problem was recovered.


2.I think I didn't explain clearly so that you can't understand me.
I'd also like to give an example:
The problem occurred at 11:18
The problem was recovered at 11:19 so the system didn't send out problem notification message to me
but I still receive the recovery message at 11:21
I think this recovery message can't make sense because the system didn't send problem notification message to me,where is this recovery message come from?


Hoping can receive your reply asap.

Thanks

Allen

[zabbix_zen]

1)

1)
Your recovery message applies by default a 120sec(2min) pause between any escalation step as you configured in 'Period (seconds)'
...
you must configure 'Delay: Immediately'

You'll start receiving both the PROBLEM and OK notifications as soon as you set the 1st step as 'Delay: Immediately'


Think of the 'Period (seconds)' as a default pause between each and any step, useful to avoid having to specify a pause period between a large number of steps
Eg:
Step1 = problem + immediately(00s): send email to Support
Step2 = Step1 + default_period: send SMS to Support
Step3 = Step2 + default_period: send SMS to System Admin
Step4 = Step 3 + 40min: send SMS to team leader

So, in your case:
Problem: 11:18 + 2min = 11:20
OK: 11:21 + 2min = 11:23

2)

2)
When selecting 'Recovery message' it's mandatory to add the Action condition,
Trigger value = "PROBLEM"
so you both receive the PROBLEM and OK event messages.

I agree it's not a logic behavior, but as soon as you set this, it'll behave as expected.

[allen_zhou]

Hi zabbix_zen,

Thanks for your patience.
For item one, I think the system have no problem as it's designed like that.
But do you think it's better to send out the recovery message to all users in the steps right after the problem recovery?
Image that when you escalate to Boss after the problem last 1 hour.
you missed the notification email then your boss told you there was a problem lasted 1 hour
you fixed the bug right after your boss told you this.
But your boss only can receive the recovery message after one more 1 hour..
He must think that how dare this guy is! fix the problem take 1 hour to fix the bug after I sent out the order.I may fire him some days later


For question two.
I still can't understand as I still received the recovery message after I unselect the recovery message item

How can I make the system won't send out the recovery message when it didn't send out the
problem message?
Any suggestion on this?


Regards,
Allen

[ghoz]

You really have to add a “Trigger value = PROBLEM” to your action.

A trigger fires when there is a problem AND when there is a recovery ( both are what I understand as 'events')

When you setup your action for a specific trigger without filtering by trigger value=problem, the action will run for problem AND for recovery, with escalation and everything.


In order to avoid that, add the famous trigger value=problem , and watch your troubles go away....

For reference, look closer at the documentation and the red note

[allen_zhou]

Hi ghoz,

Thanks for your reminding..
After added the trigger,every thing's working as expected..


Thanks very much..
God dammit ..I never notice the red part notes
It's my mistake..

Regards,

Allen