-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Minor
-
None
-
Affects Version/s: 6.0.49, 7.0.32, 7.4.16, 8.0.0
-
Component/s: Server (S)
Environment
- Zabbix server and frontend 8.0.0 (tag "8.0.0", commit "c81e276e505"), PostgreSQL 16.15.
Steps to reproduce
- Create host "neg-test" with items "t1", "t2" and "t3", type "Zabbix trapper", type of information "Numeric (unsigned)".
- Create triggers on this host:
- "Two tags", expression "last(/neg-test/t1)=1", tags "svc" = "A" and "svc" = "B";
- "Only A", expression "last(/neg-test/t2)=1", tag "svc" = "A";
- "Only B", expression "last(/neg-test/t3)=1", tag "svc" = "B".
- Go to Data collection → Event processing and click Create event correlation.
- Set Name "svc not A". Add condition "New event tag value" with Tag "svc", Operator "does not equal" and Value "A".
- In Operations select Close new event and click Add.
- After configuration cache update, send value 1 to "t1", "t2" and "t3", for example "zabbix_sender -z 127.0.0.1 -s neg-test -k t1 -o 1".
- Open Monitoring → Problems with Show "Recent problems", or run query from block 1.
1. Query
SELECT p.name, string_agg(pt.tag || '=' || pt.value, ', ' ORDER BY pt.value) AS tags, p.r_eventid IS NOT NULL AS closed, c.name AS correlation FROM problem p JOIN problem_tag pt ON pt.eventid = p.eventid LEFT JOIN correlation c ON c.correlationid = p.correlationid WHERE p.name IN ('Two tags', 'Only A', 'Only B') GROUP BY p.eventid, p.name, p.r_eventid, c.name ORDER BY p.eventid;
Result
Correlation "svc not A" closes "Two tags", although this event has tag "svc" = "A":
name | tags | closed | correlation ----------+--------------+--------+------------- Two tags | svc=A, svc=B | t | svc not A Only B | svc=B | t | svc not A Only A | svc=A | f |
| Check | Result |
|---|---|
| "does not equal" "A", new event with "svc=A" and "svc=B", 3 runs | Event closed |
| "does not contain" "A", new event with "svc=A" and "svc=B", 2 runs | Event closed |
| "does not equal" "A", new event with only "svc=A" | Event stays open |
| "does not equal" "A", new event with only "svc=B" | Event closed |
| "Old event tag value" "does not equal" "A", old event with "svc=A" and "svc=B", 2 runs | Old event stays open |
Expected
Event with tag "svc" = "A" does not match "does not equal" "A". Documentation says "does not equal - does not have the new event tag value" (Global event correlation). "Old event tag value" condition already works this way for old events.
Affects "New event tag value" conditions with "does not equal" and "does not contain" when new event has more than one tag with this name.