I have a situation where I want to monitor for changes in an auto-updating EDR package on all my Linux hosts, which works correctly. I have added the item key package.version[falcon-sensor] into a template called "Template Linux OS", which executes a script via a UserParameter to return the current package version.
I also have the following trigger alert associated with the item, which also works without a problem:
(last(/Template Linux OS/package.version[falcon-sensor],#1)<>last(/Template Linux OS/package.version[falcon-sensor],#2))
So far, so good.
However, I only want to apply this trigger to a small "canary group" subset of my Linux hosts.
My original idea was to create a separate template for the triggers, but if I add the above trigger to the new Template it gets saved into the "Template Linux OS" instead, which seems to be a long standing "feature" of Zabbix. I don't think I can link the templates without applying the trigger to all hosts, and I've not been able to find another way to conditionally add the trigger.
As the Canary group is only 6 servers worst case I can manually add the trigger to just those hosts, but is there a cleaner way to do this?
Thanks.
I also have the following trigger alert associated with the item, which also works without a problem:
(last(/Template Linux OS/package.version[falcon-sensor],#1)<>last(/Template Linux OS/package.version[falcon-sensor],#2))
So far, so good.
However, I only want to apply this trigger to a small "canary group" subset of my Linux hosts.
My original idea was to create a separate template for the triggers, but if I add the above trigger to the new Template it gets saved into the "Template Linux OS" instead, which seems to be a long standing "feature" of Zabbix. I don't think I can link the templates without applying the trigger to all hosts, and I've not been able to find another way to conditionally add the trigger.
As the Canary group is only 6 servers worst case I can manually add the trigger to just those hosts, but is there a cleaner way to do this?
Thanks.
Comment