ExportXMLWordPrintable

      Environment

      • Zabbix server and frontend 8.0.0 (tag "8.0.0", commit "c81e276e505"), PostgreSQL 16.15.

      Steps to reproduce

      1. Create host "neg-test" with items "t1", "t2" and "t3", type "Zabbix trapper", type of information "Numeric (unsigned)".
      2. Create triggers on this host:
        1. "Two tags", expression "last(/neg-test/t1)=1", tags "svc" = "A" and "svc" = "B";
        2. "Only A", expression "last(/neg-test/t2)=1", tag "svc" = "A";
        3. "Only B", expression "last(/neg-test/t3)=1", tag "svc" = "B".
      3. Go to Data collection → Event processing and click Create event correlation.
      4. Set Name "svc not A". Add condition "New event tag value" with Tag "svc", Operator "does not equal" and Value "A".
      5. In Operations select Close new event and click Add.
      6. After configuration cache update, send value 1 to "t1", "t2" and "t3", for example "zabbix_sender -z 127.0.0.1 -s neg-test -k t1 -o 1".
      7. Open Monitoring → Problems with Show "Recent problems", or run query from block 1.

      1. Query

      SELECT p.name, string_agg(pt.tag || '=' || pt.value, ', ' ORDER BY pt.value) AS tags,
          p.r_eventid IS NOT NULL AS closed, c.name AS correlation
      FROM problem p
      JOIN problem_tag pt ON pt.eventid = p.eventid
      LEFT JOIN correlation c ON c.correlationid = p.correlationid
      WHERE p.name IN ('Two tags', 'Only A', 'Only B')
      GROUP BY p.eventid, p.name, p.r_eventid, c.name
      ORDER BY p.eventid;
      

      Result

      Correlation "svc not A" closes "Two tags", although this event has tag "svc" = "A":

         name   |     tags     | closed | correlation
      ----------+--------------+--------+-------------
       Two tags | svc=A, svc=B | t      | svc not A
       Only B   | svc=B        | t      | svc not A
       Only A   | svc=A        | f      |
      
      Check Result
      "does not equal" "A", new event with "svc=A" and "svc=B", 3 runs Event closed
      "does not contain" "A", new event with "svc=A" and "svc=B", 2 runs Event closed
      "does not equal" "A", new event with only "svc=A" Event stays open
      "does not equal" "A", new event with only "svc=B" Event closed
      "Old event tag value" "does not equal" "A", old event with "svc=A" and "svc=B", 2 runs Old event stays open

      Expected

      Event with tag "svc" = "A" does not match "does not equal" "A". Documentation says "does not equal - does not have the new event tag value" (Global event correlation). "Old event tag value" condition already works this way for old events.
      Affects "New event tag value" conditions with "does not equal" and "does not contain" when new event has more than one tag with this name.

            Assignee:
            Zabbix Development Team
            Reporter:
            Piotr Wegrzyn
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: