-
Type:
Incident report
-
Resolution: Unresolved
-
Priority:
Trivial
-
None
-
Affects Version/s: 7.0.31, 7.4.14
-
Component/s: Templates (T)
-
None
1.
In the official template "OS processes by Zabbix agent", the Processes discovery rule (key custom.proc.discovery, dependent on "Get process summary") has Disable lost resources = Immediately by default.
This setting stops the template from doing its main job of alerting when a monitored process gets terminated.
What happens:
- A monitored process gets terminated.
- The process is no longer in the proc.get summary output, so the next discovery run marks it as a lost resource.
- Because of "Disable lost resources = Immediately", the discovered items and the "process is not running" trigger are disabled at once.
- The problem either never fires or fires and then disappears a few seconds later. Nobody gets alerted about the stopped process.
Expected behavior:
When a monitored process stops, its items and triggers should stay enabled. The "process is not running" problem should stay open until the process starts again.
Request:
This must be reworked - change the default in the official template, preferably to disable After with a reasonable period.
2. The LLD rule gets performed every time when its master item gets polled, i.e. each 1 minute.
This is against generic best approaches approach to not run LLD rules too often, as its a bit resources consuming routine.
Normally there should be 2 preprocessing steps - JsonPath to take only $.name and $.vsize and then discard unchanged with heartbeat.