Currently, SNMP-based interface templates in Zabbix use macros like {$IFCONTROL:"{#IFNAME}"} to control whether a discovered interface should generate alerts. While functional, this approach only allows suppression or activation of alerting on a binary basis and doesn't track deviations from intended interface states.

From a DevOps perspective, where infrastructure state should be described declaratively and monitored continuously, we propose the following enhancements:

---

🔧 Proposal: Expected interface state logic

Introduce a macro like:
 
zabbix
CopyEdit
{$IFEXPECTED:"{#IFNAME}"} = up / down / ignore
This would allow users to explicitly define the expected operational state of each discovered interface.

A new state monitoring trigger should be introduced in the template, which:

• Compares the current ifOperStatus against the expected value (default: up)

• Generates an alert if the state deviates (e.g., port is down when expected up, or vice versa)

• Works independently of traffic/error triggers and macro-based activation logic

This replaces the alerting role of the current "interface is down" trigger, which should be demoted to an internal or informational trigger used only to suppress dependent metrics (traffic, CRC, etc.).

---

✅ Benefits:

• Enables accurate detection of unintended active or inactive interfaces (e.g., unused ports becoming UP)

• Better aligns with state-based infrastructure monitoring and automation

• Reduces administrative overhead (no need for {$IFCONTROL} macros per interface)

• Clarifies the roles of different triggers (state alerting vs. dependency suppression)

---

🧩 Additional suggestion:

Reclassify the existing "interface is DOWN" trigger as informational / non-alerting, to reflect its new purpose: suppressing other metric-based triggers via dependency, rather than being an actual operational alert.