Uploaded image for project: 'ZABBIX FEATURE REQUESTS'
  1. ZABBIX FEATURE REQUESTS
  2. ZBXNEXT-2246

Add detailed info/values to events via triggers

XMLWordPrintable

      Essentially I want to be able to have an Item's value displayed and persisted in an Event's details for the lifetime of the event (and therefore in the Monitoring->Events page, Dashboard, etc.).

      This need became apparent when creating Triggering on Windows Event Logs. We have a rule to catch all 'Critical' events in the Windows System log. If 20 different log events are captured, Zabbix triggers and creates 20 Events, all of which have the exact same name (based on the Trigger name). I'd prefer instead to name them with macro substitutions for the event ID, source application, etc. and even include the full event log data (from Windows) in a field somewhere on the Zabbix Event.

      I understand this is a challenge for a few reasons:
      1. Events contain no textual data or relationship to an explicit Item value
      2. Event names are resolved at display-time from the source Trigger name
      3. Macros in the Trigger name (eg. ITEM.LASTVALUE) are relative to the most recent Item data, not the point in time the event was generated
      4. Triggers are not explicitly related to Items or Item History values but instead are linked with Expressions which may define one or many Items.

      To overcome this issue, I've devised the following naive suggestions:
      1. Create an additional 'expression' field in Triggers that can be used to populate a 'Details' field in a resulting event (much like the messages in Actions). Eg. Details = "ID:

      {My Template:eventlog[...].eventid}

      \nDetails:

      {My Template:eventlog[...].value}

      "

      or

      2. Create macros to reference an Item in a Template's expression by index (0, 1, etc) and then link to the Items history for the same time stamp (only valid while the history is maintained). Eg. TRIGGER.EXPRITEM1.VALUE, TRIGGER.EXPRITEM2.LOG.SOURCE, etc.

      Additionally, create an additional field for Events in the database which captures the resolved value so that it persists if Item history does not?

            Unassigned Unassigned
            ryan.armstrong Ryan Armstrong
            Votes:
            3 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: