-
Change Request
-
Resolution: Unresolved
-
Major
-
None
-
3.4.4
-
None
Let's talk about this feature:
https://www.zabbix.com/documentation/3.4/manual/config/event_correlation/trigger
This works right only if expression are simple, like "A=B"
but if you have something like this "A=B and C=D and E=F" in some cases zabbix will be triggered for 3 times.
It would be nice to catch this situation. It will very usefull in SNMP Trap parsing.
For example i have a TRAP:
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (550825447) 63 days, 18:04:14.47
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: ThreeParMIB::alertNotify
ThreeParMIB::component.1 type=4 value=STRING: "test_trap"
ThreeParMIB::details.1 type=4 value=STRING: "This is a test trap sent from InServ XXXX, Serial Number xxxx"
ThreeParMIB::nodeID.1 type=66 value=Gauge32: 3
ThreeParMIB::severity.1 type=2 value=INTEGER: 6
ThreeParMIB::timeOccurred.1 type=4 value=STRING: "2017-11-17 15:02:39 MSK"
ThreeParMIB::id.1 type=66 value=Gauge32: 4294967295
ThreeParMIB::messageCode.1 type=66 value=Gauge32: 4294967295
ThreeParMIB::state.1 type=2 value=INTEGER: 5
ThreeParMIB::serialNumber.1 type=4 value=STRING: "XXX"
ThreeParMIB::catalogKey.1 type=4 value=""
ThreeParMIB::detailedMessage.1 type=4 value=""
Based on new feature "dependent items" i had parse this text to separated items
...
key[severity] ThreeParMIB\:\:severity\..value=(.:\s)?\"(.*)?\"
key[state] ThreeParMIB\:\:state\..value=(.:\s)?\"(.*)?\"
key[detail] ThreeParMIB\:\:detail\..value=(.:\s)?\"(.*)?\"
So i have trigger expression for this items:
key[severity].last=6 and key[state].last()=2 and key[detail].strlen()>0
and i would like to have triger name like this:
Event
with state
{ITEM.VALUE2}:
{ITEM.VALUE3}to generate informative notifications, but
with "Multiple PROBLEM event generation mode" - event generate 3 time
without "Multiple PROBLEM event generation mode" - one event will generate, but next TRAPS will be lost, cause there is no zabbix function ".onupdate()"
..