Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-22036

Reference a Dependent Item on the Event Name field of a Trigger in a Template

XMLWordPrintable

    • Icon: Problem report Problem report
    • Resolution: Unresolved
    • Icon: Trivial Trivial
    • None
    • 6.2.5
    • Templates (T)
    • None

      Hello,
      I'm having problems trying to reference a Dependent Item on the Event Name field of a trigger in a template.
      It was working on version 6.0.x, and it stopped working since I updated my Zabbix Server to 6.2.x.

      Steps to reproduce:

      1. Create a template (or use an existing one)
      2. Create an item (the 1102 ID says that some user deleted the Windows Security Logs):
        Key: eventlog[Security,,,,1102,,skip]
        Type: Zabbix Agent (active)
        Type of information: Log
        Update Interval: 1s
      3. Create a dependent item (I want to get the specific user that deleted the logs, so I did it with a regular expression):
        Key: WhoClearedSecurityLogs
        PreProcessing (regexp): Security ID:\s+([^\n]+)
        Master Key: (the item we created before this one)
      4. Create a trigger:
        Expression: last(/Log Monitoring/eventlog[Security,,,,1102,,skip])<>0
        Event Name: User {?last(//WhoClearedSecurityLogs)} cleared all Security logs from the server {HOST.NAME}

      Result:
      The expression {?last(//Key)} does not translate {?last(/HostName/Key)} when I apply it to the host. It used to work on version 6.0, but it's not working anymore.
      I can fix the problem going directly to the host, creating a copy and changing it to {?last(/HostName/Key)}.
      Expected:
      I was expecting that Zabbix would change the {?func(//...)} to {?func(/HostName/...)} when I apply the template to a host.

            aigars.kadikis Aigars Kadikis
            Rpk Mauricio Ripke
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: