-
Type:
Change Request
-
Resolution: Unresolved
-
Priority:
Minor
-
None
-
Affects Version/s: None
-
Component/s: Documentation (D)
-
None
Hi,
Currently in Zabbix documentation Global event correlation is described in this way:
To configure global correlation safely, observe the following important tips: 1. Reduce the correlation scope. Always set a unique tag for the new event that is paired with old events and use the New event tag name correlation condition; 2. Add a condition based on the old event when using the Close old event operation (or else all existing problems could be closed); 3. Avoid using common tag names that may end up being used by different correlation configurations; 4. Keep the number of correlation rules limited to the ones you really need.
Main issue is with point 2.:
Add a condition based on the old event when using the Close old event operation (or else all existing problems could be closed);
Documentation does not have a clear statement what would happen if Zabbix user would set a condition for New Events, but would not set any condition for old events,
In "parameter" section there is small note about potential issues:
# https://www.zabbix.com/documentation/current/en/manual/config/event_correlation/global#configuration Note that if no old event condition is specified, all old events may be matched and closed. Similarly if no new event condition is specified, all new events may be matched and closed.
But since it can be easily skipped, due to placement of this line, it would be great to make this statement in it's own "warning" as for one about event tags for unrelated problems,
that one about lack of condition for old events is actually more important, because especially on bigger system, which did ran for some time this can generate a lot of troubles if Zabbix would start to edit/close every old event and etc..