troubles with action configuration

[markusf]

I've a problem with configuring actions correctly. (zabbix 1.8.5)
we have checks and triggers for different departments of our company.
so the departments should not get the alerts from the others - only there own.

I tought, the simplest way to do so, is to use "Trigger description" (Trigger Name).
Each Triggername has to have an uniq keyword at the beginning.
Our technical department has the most checks and triggers - so it would be very hard, to update our more than 2000 triggers.
so I want to exclude all the other "Trigger description" keywords.

but this doesn't work, because I need to configure the last part in brackets from E to J used with AND.
I also need the OR with A, B - so I cannot use "AND" for everything.
with this configuration "bug" the logic is not correct starting at E.
for example an alert with trigger name "support: website down", the server is not in maintenance and the severity ist high.
A will match = okay
C will match = okay
D will match = okay
E will match: "sales:" != "support:"
and it seems, as the check doesn't go on with F (this would be the right one) and stops in this point of the rule.

so the alert will get through but it shouldn't - that is the worse point

here is the whole configuration from my action:
(A or B) and (C) and (D) and (E or F or G or H or I)

(A) Trigger severity = "High"
(B) Trigger severity = "Disaster"
(C) Trigger value = "PROBLEM"
(D) Maintenance status not in "maintenance"
(E) Trigger description not like "sales:"
(F) Trigger description not like "support:"
(G) Trigger description not like "management:"
(H) Trigger description not like "projects:"
(I) Trigger description not like "supervisor:"
---------------------------------------------------

what I need would be like this:
(A or B) and (C) and (D) and (E and F and G and H and I)

but this is not possible in the webinterface.

has anyone any ideas?
is this a bug?

kind regards
max

[ghoz]

lets say its a limitation ...

maybe you could create hostgroups per department , and use that as a filter ?

[Alexei]

Wouldn't it be more practical to have separation based either on user permission or host groups? Like one host group per department, if possible?

[markusf]

thanks for your answers, but hostgroup per department is also not possible:
lets say server A has services monitored for technican and for supervisors.

when you create hostgroups "supervisors" and "technican" both including server A, then supervisor will get technican alerts and the other way, because the host is in both groups ...
the problem is, to set triggers on the same hosts for different departments and to coordinate different alerts.

the next thing is, that our setup is relatively big with 450 hosts and 23000 services.

is there a way to "break" the limitation?
any other practicable ideas?

[ghoz]

you could use a filtering mechanism on 'application' but i'm not sure it would answer the problem of triggers to 2 departments for the same item.

as a last resort, I'm afraid you'll have to keep your orignial scheme using trigger names , and change your 2000 triggers...

Maybe a skillfully crafted sql could do that for you.
Or use the api to rename your triggers...

Or a swarm of underpayed but trusted trainees :-)

[markusf]

problem solved

the solution is simple:

what I needed was like this:
(A or B) and (C) and (D) and (E and F and G and H and I)

so how to solve the OR from "A or B" - the rest all could be AND?
I use "Trigger severity >= "High"" instead of "Trigger severity = "High"" OR "Trigger severity = "Disaster""

so this is my solution:
(A) Trigger severity >= "High"
(B) Trigger value = "PROBLEM"
(C) Maintenance status not in "maintenance"
(D) Trigger description not like "sales:"
(E) Trigger description not like "support:"
(F) Trigger description not like "management:"
(G) Trigger description not like "projects:"
(H) Trigger description not like "supervisor:"
---------------------------------------------------
(A) and (B) and (C) and (D and E and F and G and H)

I hope this solution can be helpfull for people, having similar problems.