Home / server / Questions / 968984
Accepted
maar
Asked: 2019-05-28 05:24:19 +0800 CST

Zabbix - Web scenarios trigger. How to ignore the first failed attempts?

  • 772

Problem:

Trigger send an e-mail immediately when the site is unreachable.

System:

Linux Debian Stretch, Zabbix 4.2.1.

Current configuration of the web scenario:

Scenario: 
Name: website.com 
Update interval: 30s 
Attempts: 3 
Agent: Zabbix

Steps: 
(just one) 
Name: website.com 
URL: http://website.com/page.php
Follow redirects: checked 
Timeout: 30s

(rest unchanged)

Current configuration of the trigger:

Name: The website.com can't be reached!
Expression: {VIRTUALMACHINE:web.test.fail[website.com].last(3m)}>0

(rest unchanged)

Explanation

The trigger has to send an e-mail if the site is unreachable for 3 minutes (or 3 last checks with timeout 30 seconds on every check). I was trying to do it in many ways (below*), but with each trigger expression that I tried the e-mail notification was sent immediately when the zabbix detected the problem for the first time (and not for the nth attempt).

*
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3m)}<>0
{VIRTUALMACHINE:web.test.rspcode[website.com,website.com].last(0)}#200
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}#0
{VIRTUALMACHINE:web.test.fail[website.com].sum(#3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].last(3)}>0
{VIRTUALMACHINE:web.test.fail[website.com].min(1)}>0

Please if you give an answer explain it. Feel free to ask.

monitoring

2 Answers

  1. Best Answer

    Solution/Workaround

    I added tags on each trigger and I edited an e-mail actions by adding tag conditions.

    For example:

    First send an e-mail action: Can't ping the server.

    ACTION tab
Conditions:
Tag value server equals icmpping

    (rest unchanged)

    Second send an e-mail action: Can't reach the website.

    ACTION tab
Conditions:
Tag value server equals web

OPERATIONS tab
Default operation step duration: 3m
Operation details: Steps = 2-2; Step duration = 0

    (rest unchanged)

    Trigger expression:
{VIRTUALMACHINE:web.test.fail[website.com].last()}>0

    Now Zabbix will send me a message 3 minutes after detecting that the website is down and If the problem will be resolved during these 3 minutes Zabbix won't send an e-mail.

    • 1

  2. Item web.tyest.fail returns the failed step of the scenario. Given that, you can achieve the desired result like this:

    {VIRTUALMACHINE:web.test.fail[website.com].min(#3)}>0

    This will check the last 3 values and alert if they all are above 0 (failures). Consider this scenario:

    • All is good and values of 0 come in.
    • Site goes down, and a non-zero value arrives. The minimum value over the last 3 values is still 0, no alert.
    • Site still down, another non-zero value arrives. The minimum value over the last 3 values is still 0 (there's one 0 left in the last 3 values), no alert.
    • Site still down, another non-zero value arrives. The minimum value over the last 3 values is now non-zero, and the trigger will fire.

    A few additional notes on the expressions you tried:

    • Values 3 and 3m that you used for function last() were ignored.
    • Value 1 that you used for function min min() means seconds, thus that trigger expression would mostly not work at all.
    • 1