-
Change Request
-
Resolution: Duplicate
-
Minor
-
None
-
2.2.1
Essentially I want to be able to have an Item's value displayed and persisted in an Event's details for the lifetime of the event (and therefore in the Monitoring->Events page, Dashboard, etc.).
This need became apparent when creating Triggering on Windows Event Logs. We have a rule to catch all 'Critical' events in the Windows System log. If 20 different log events are captured, Zabbix triggers and creates 20 Events, all of which have the exact same name (based on the Trigger name). I'd prefer instead to name them with macro substitutions for the event ID, source application, etc. and even include the full event log data (from Windows) in a field somewhere on the Zabbix Event.
I understand this is a challenge for a few reasons:
1. Events contain no textual data or relationship to an explicit Item value
2. Event names are resolved at display-time from the source Trigger name
3. Macros in the Trigger name (eg. ITEM.LASTVALUE) are relative to the most recent Item data, not the point in time the event was generated
4. Triggers are not explicitly related to Items or Item History values but instead are linked with Expressions which may define one or many Items.
To overcome this issue, I've devised the following naive suggestions:
1. Create an additional 'expression' field in Triggers that can be used to populate a 'Details' field in a resulting event (much like the messages in Actions). Eg. Details = "ID:
\nDetails:
{My Template:eventlog[...].value}"
or
2. Create macros to reference an Item in a Template's expression by index (0, 1, etc) and then link to the Items history for the same time stamp (only valid while the history is maintained). Eg. TRIGGER.EXPRITEM1.VALUE, TRIGGER.EXPRITEM2.LOG.SOURCE, etc.
Additionally, create an additional field for Events in the database which captures the resolved value so that it persists if Item history does not?
- duplicates
-
ZBXNEXT-2087 Custom fields to use and show in dashboard events
- Closed