"Problems" on a host, not listed in "Problems" tab and displayed as "OK" on map

[ybizeul]

I have a SNMP host (No using agent interface field, just SNMP Interface) and "Template Module Generic SNMPv2" template.

That template defines "Template Module Generic SNMPv2: ICMP ping" Item and "Template Module Generic SNMPv2: Unavailable by ICMP ping" trigger

If I look at the host configuration, I see that trigger listed as "PROBLEM" (which is normal as the host isn't reachable)

But if I go in Monitoring > Problems, and remove all the filters, itis not displayed here
If I go on the Map, the device that trigger is attached to is displayed as "OK"

[Markku]

Hi, in your second image (Monitoring - Problems) you have the Application filter set to "Storage", is that correct, is your icmpping item in Storage application?

Markku

[ybizeul]

Sorry for the confusion, I was doing some tests wjile taking screenshots. Here is a more representative one.

Choosing "Minimum severity" or check "Show suppressed problems" doesn't change anything.

[Markku]

Is there a specific reason why SNMP status is red in the first image?

I don't quite get the configuration idea. If you have removed the Agent interface, how should icmpping item actually work?

Markku

[ybizeul]

It's in red because the host is indeed unreachable. Here is the host configuration :

[Markku]

Right, but again, for me it looks strange that you are using icmpping but have deleted the Agent interface. You know, icmpping doesn't have anything to do with SNMP. Can you try adding the Agent interface IP?

Markku

[ybizeul]

I think I see what you mean. I think that the actual IP for the host is determined based on any agent type configured, whether it's Zabbix Agent (which is not even available for that device) or SNMP which seemed more appropriate.

I configured the IP address of that server anyway as an Agent Interface, but after refresh I still get the same result.

[Markku]

Ok, thanks for trying that, good to know, I've always just used the Agent interface for ping items. So, back to the original problem: problem is not shown in Monitoring - Problems. I don't have an answer for you as all my problems are nicely shown in both host trigger configuration screen and in the Problems list. But for others maybe wiser in this issue, what's your Zabbix version? I guess 4.2 because the trigger configuration screen looks different from my 4.0.x screens.

Is there anything suspicious in zabbix_server.log?

Markku

[ybizeul]

Nothing special in zabbix_agentd.log or zabbix_server.log.
I had that issue since 4.0, then I decided to try and update to 4.2 and see if it would change anything but it didn't.

Thanks for trying !

[ybizeul]

I can't do it again, but I found a page where I was able to list all the triggers for all hosts, by filtering by "Problem" only, I was able to find more devices presenting the same problem.
It appears that any device for which the agent isn't reachable, they won't be listed in the problems list.

Put it another way : the triggers following a successful collection of data are working fine and reported as "Problems" but if Zabbix can't even communicate with the host, it's not reported as Problem.

[Markku]

Would that be the trigger configuration screen, by selecting multiple host groups in the filter and entering the trigger name in the Name filter? (If that is a new feature in 4.2, in 4.0 you can select just one host anyway.)

Unfortunately the devices I monitor with both SNMP and ping are so reliable that I don't have samples about them being down recently. I can just tell that the ping-only-monitored devices look fine in the problems lists.

Markku

[Markku]

I just tested with a device, put a firewall rule to prevent communication from Zabbix server to the monitored host. I see a normal problem from a icmpping trigger, and zabbix_server.log shows:

24351:20190731:204033.161 SNMP agent item "volumes.size.free[1]" on host "nas01.xxx" failed: first network error, wait for 15 seconds
24355:20190731:204133.325 temporarily disabling SNMP agent checks on host "nas01.xxx": host unavailable

And, when I removed the firewall rule, the icmpping trigger was cleared and server shows:

24355:20190731:204633.364 enabling SNMP agent checks on host "nas01.xxx": host became available

"Refresh unsupported items" is set to 1 minute in this setup.

Update: And I have two interfaces in the host: Agent interface and SNMP interface, both having the same IP address.

Markku

[ybizeul]

I think I figured it out, but hard to check.

In some circumstances, I think "Problems" expire, maybe on restart, maybe after a while, maybe on database cleanup... Anyway all the problems I was watching were there for a while. After fixing connectivity and triggering the problem again, it appears in the problems list.