1 specific alert is not reaching MS Teams

[sigafoos]

Hi all,
In my setup, I have all of the alerts sending to MS Teams via a script. Every single alert that reports as successful inside of Zabbix, has made it to MS Teams, aside from one particular alert. Every time it is triggered, it states that it successfully sent, but never arrives. The only difference I can see offhand is that this template is using trigger prototypes, which is not the case for most of my other templates. Just putting it out there to see what you guys' think? Not sure which log would be best to monitor for the alert errors.

[tim.mooney]

Does the script you use on your Zabbix server for Teams integration log anything? Is there enough error checking in the script to detect (and log) when Teams rejects a message (when sending fails for some reason)?

My suspicion is that it's a problem with the integration; Teams doesn't like something about the contents of the message it's receiving and it's rejecting the message.

[sigafoos]

Tim,
Thanks for the followup. I did not build the script, but I have attached here in hopes that someone has ideas how to setup error logging for messages that bounce back from Teams or dropped for whatever reason.

[tim.mooney]

Thanks for including the script.

A big problem with how Zabbix integrates with custom alert scripts is that the information that Zabbix provides to the script is provided via command line arguments. The reason that's a problem is that you have to then be careful about quoting and any characters that the shell may interpret as special characters. There are entire classes of security vulnerabilities related to quoting and "command injection". That shouldn't really be a problem here, because you control the text in the alerts that Zabbix emits, but the command-line nature of the problem does mean that you have to be aware of how the shell may "helpfully" expand, alter, or interpret any special characters in what it sees.

In this case, the subject and body/message are potentially interpreted by the shell multiple times. After seeing the script, it definitely reinforces my initial guess, that it's probably something in the content of the message just not making it through the integration cleanly.

The great news is that the new Zabbix webhook feature doesn't have these problems. Rather than using a traditional alert script, I think it would be very much advisable to try the webhook method of integration.

There have already been several pre-canned webhooks added, but it doesn't look like there's an official one for Teams yet. However, it looks like a post in the Zabbix reddit might have just what you need. Might be worth giving that a try, it looks pretty promising.

[sigafoos]

Thanks for the input, Tim. I will work with those and see what I can build!