Missing Tags in Events Zabbix 5.0

[josoko]

Hello

Based on this article, i presume that all tags should be correlated in an Zabbix event, if the "Tags" are part of template which is assigned to a host.

Use Case:

Affected device: vfw-1234
- We have a main template e.g. fos-main.
- The fos-main template contains the fos-interface and the fos-sys template.
- The host vfw-1234 itself has a host tag "VNFTYPE" with the value "vfw".
- The fos-sys template contains for the trigger "system uptime" the tag "TIGGER" with the value "REBOOT"

So far so good.

After a reboot, Zabbix es createing an event which contains all Tags with the value:
- VNFTYPE:vfw
- TRIGGER:REBOOT

To be able to control the alerts in a better way, i want to add a customer template which contains tags only:
- Template name: customer-1234
- Tag on this template: CUSTOMER-ID:1234

So far so good.

In the Zabbix monitoring host section I can see all tags which have been assigned to this host vfw-1234, including the tags in the new customer-1234 template.

Now, if I reboot the host vfw-1234 the new Tags are NOT part of the event. I can just see the tags:
- VNFTYPE:vfw
- TRIGGER:REBOOT

But the tag CUSTOMER-ID:1234, which has been assigned in a customer template is not appearing in the event.

Why is the new tag CUSTOMER-ID:1234 not visible in the Event?

We are using Zabbix 5.0.

thx in advanced!

[cyber]

Because your "reboot" trigger is part of fos-sys template, which has no knowledge of tags coming from "customer-1234" template.

[josoko]

No. I do not agree. Based on this documentation it should work.
- https://www.zabbix.com/documentation...config/tagging

A problem event inherits all tags from the whole chain of templates, hosts, items, web scenarios, triggers. Completely identical tag:value combinations (after resolved macros) are merged into one rather than being duplicated, when marking the event.

Otherwise all additional Tags become usless in events, where it makes sense to have them, to provide additional information in alerting flows.

And btw. Host Tags are working. It's also not a part of the template where the triggers are.

All tags are visible in the "monitoring => host section". That means, Zabbix is already aware of the additional Tags. They will just not be handovered to events.

[cyber]

yes you can see all tags from that "Monitoring -> host". That is according to docs

Tags	Tags of the host and all linked templates, with macros unresolved.

But that does not mean, that all those tags apply to all events generated by that host. (From the page you linked: A problem event inherits all tags from the whole chain of templates, hosts, items, web scenarios, triggers).

you have host with tags
you have 2 templates attached to this host, each with their own tags.
there are triggers in one template and none in other..

Now... What happens... your trigger from that one template triggers and it inherits all tags from that chain: trigger (if they exists), then from that template, it is part of, and then from host... whatever there is in that other template, it will not inherit. It is not part of "chain".

If you want to apply also tags from that other template, those templates should be linked... You can, for example, have a template with only macros and tags for specific host. Then you can link other template to this "macro template", which uses those macros and tags. When you attach first one to host, other template will be applied automatically. Anything from that intermediate template will be inherited..
Trigger fires... Event inherits tags from trigger config, then from first template, then from second (linked) template, then from host...

[josoko]

Hello @cyber

I tested that now in Zabbix 5.0.11 and 5.0.19:

On host vfw-1234 are these templates assigned

TEMPLATE MAIN:
TEMPLATE SYS1:
ITEMS:
- Item1
- Item2
TRIGGERS:
- Trigger 1
- Trigger 2

TEMPLATE NQA:
ITEM PROTOTYPE:
- Item NQA TEST1
- Item NQA TEST1
TRIGGERS PROTOYPE:
- Trigger NQA TEST1 (Includes TAG TRIGGER:NQA-PROBE-FAIL1)
- Handovers SNMPINDEX to TAG SNMPINDEX:(#SNMPINDEX)
- Handovers DEST IP to TAG NQADSTIP:(#NQADSTIP)
- Handovers SRC IP to TAG NQASRCIP:(#NQASRCIP)
- Trigger NQA TEST1 (Includes TAG TRIGGER:NQA-PROBE-FAIL2)
- Handovers SNMPINDEX to TAG SNMPINDEX:(#SNMPINDEX)
- Handovers DEST IP to TAG NQADSTIP:(#NQADSTIP)
- Handovers SRC IP to TAG NQASRCIP:(#NQASRCIP)
TEMPLATE WITH TAGS ONLY (LINKED TEMPLATE TO TEMPLATE NQA):
TAGS:
- DC:DC1
- DC-NAME:DCS1234

The trigger is generating an event. In this event i can only see the Tags:

- SNMPINDEX:(VALUE-OF-SNMPINDEX)
- NQADSTIP:(Some IP Address)
- NQASRCIP:(Some IP Address)

But this Tags are still missing:
- DC:DC1
- DC-NAME:DCS1234

Based on your picture, that should work:
Template NQA which is linked to "TEMPLATE WITH TAGS ONLY" should also provide the Tags

DC:DC1

and

DC-NAME:DCS1234

if the Trigger Prototye Trigger NQA TEST1/2 is creating an event.

Or am i still wrong?

My conclusion here is, Zabbix is providing the Tags from the HOST Config and the Tags in the Template which includes the Triggers only.

[josoko]

cyber

Nope. Not working in Zabbix 5.0.19.
Only Tags wich are part of the "Host Config" or in this template where the Trigger is located will be considered. The rest will be ignored.

[cyber]

I assume from your description, that NQA template is attached to host and has "linked to tags template" in config? In this case trigger from NQA template will not inherit tags from "tags template" as it is further away from host in "chain"...

Can you try other way around ... attach that "tags template" to host and then add that NQA template as linked to "tags template", in this case NQA template will be last in chain and trigger will "pass through" that "tags template" and inherit its contents.

[josoko]

Hello cyber

Here how it is linked and not working:
"Template SNMPv3 vPE NQA Monitor" Hosts 1 Applications 1 Items Triggers Graphs Screens 2 Discovery 3 Web "Template DC CEEBIL021, Template DC DC2"
- host vfw-1234 => Template SNMPv3 vPE NQA Monitor (Template DC CEEBIL021, Template DC DC2)
- Template SNMPv3 vPE NQA Monitor => System Template with Items and Triggers
- Template DC CEEBIL021 => Tag Template 1 with infoset 1
- Template DC DC2 => Tag Template 2 with infoset 2

By that way it should work, because dependend on where the host is located we want to inform the support team, where the incident affected host is located.
And it's not possible to gather all information into just one "Tag" template.

That makes the whole process it inefficient.

And I don't think, that I can attach the system template twice for the same host.

But I am right now testing the other way of linking the templates.

[josoko]

cyber

Yep. The other way is working. But this approach is insufficient for us. It has its limmits of how we can add information in the events.

Tags are the best way to add additional information into an event and forward them to other systems like OpsGenie, ServiceNow or other communication channels. But if the structure is restricted in that way, it makes pretty hard to assign these additional information in flexible manner.

[cyber]

Add info to hosts inventory. Then add host level tags. Tags can use inventory macros as values. You can update inventory over API. Also items can populate inventory fields.

[josoko]

Hello cyber

Ok, that could be a game changer.
Thank you for this hint. We will check that.

From my perspective we can close this post.