[ZBX-17276] Incorrect closing of problems by global correlation Created: 2020 Feb 06  Updated: 2020 Mar 25  Resolved: 2020 Mar 25

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Server (S)
Affects Version/s: 4.4.5
Fix Version/s: None

Type: Problem report Priority: Trivial
Reporter: Anton Palmov Assignee: Igor Gorbach (Inactive)
Resolution: Won't fix Votes: 1
Labels: None
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: PNG File image-2020-02-06-14-55-56-404.png     PNG File image-2020-02-06-15-00-47-977.png     PNG File image-2020-02-06-15-04-43-959.png     PNG File image-2020-02-07-16-11-39-153.png     PNG File image-2020-02-07-16-15-48-103.png     PNG File image-2020-02-07-16-16-08-306.png     PNG File image-2020-02-07-16-16-42-412.png     PNG File image-2020-02-10-10-45-18-098.png     PNG File image-2020-02-10-10-45-29-584.png     PNG File image-2020-02-10-10-47-43-623.png     PNG File image-2020-02-10-10-48-32-509.png     PNG File image-2020-02-24-11-32-36-312.png     PNG File image-2020-02-24-11-34-25-346.png    

 Description   

Steps to reproduce:

**1. Create a global correlation rule with a condition "Value of old event tag SOMETAG equals value of new event tag SOMETAG" and an operation "Close new event"

2. Create a trigger, which contains 2 different items. These items should be updated at the same time, for example

3. Get or generate a problem 

Result:
Instead of one problem, two are generated at once, and they close automatically

 

Expected:
One new problem in "PROBLEM" status

 



 Comments   
Comment by Igor Gorbach (Inactive) [ 2020 Feb 07 ]

Hello, Anton!

Thank you for your issue!

Please, attach to issue (screenshots): 

  1. Correlation parameters and operations (with TAG Name and Value)
  2. Trigger parameters (Expression, tag names and values)

Best regards, Igor.

 

Comment by Anton Palmov [ 2020 Feb 07 ]

Hello, Igor!

Sure, here it is:

1) Event correlation rule

2) Trigger

 

 

 

Comment by Igor Gorbach (Inactive) [ 2020 Feb 10 ]

Hello, Anton!
Can you explain the purpose and the logic of global correlation for better understanding?
Can you describe the correlation scenario, what result is expected?
Also, attach to issue detailed info from correlation rule settings and operations and some screenshots from "Monitoring-Problems" where we can see events with Tags and values from triggers (please, attach one "Event details" screenshot).

Best regards, Igor

Comment by Anton Palmov [ 2020 Feb 10 ]

Hello, Igor!

At this case we use global correlation for reduce the number of similar alerts / alerts with one root cause.

We also monitor EIGRP sessions between our head office and regional offices, which are created as prototypes on another hosts (head and regional routers). And we don't want to see these alerts if the regional device, for example, isn't available at all. So we decided to use tags and global correlation because we can't use classic dependencies at this case (I mean we can't create dependency for trigger already created from a prototype). And this approach generally works, apart from the above problem because of which we risk missing a problem. So we had to disable this rule.

 

 

 

Comment by Igor Gorbach (Inactive) [ 2020 Feb 24 ]

Hello, Anton!

Please, attach the screenshots of problem details for problems which were closed by global correlation rule

Regards, Igor!

Comment by Anton Palmov [ 2020 Feb 24 ]

Hello, Igor

Comment by Anton Palmov [ 2020 Feb 24 ]

+

Comment by Igor Gorbach (Inactive) [ 2020 Mar 25 ]

Anton, I think you have mutually exclusive parameters in your correlation rule

From one side - you compare the values of  old event tag with new event tag  (Region )and result must be true (equals)

From the other side you compart the same tags values with {$REGION_PREFIX} usermacro as a value

Then we have the rule

MGP=MGP

and MGP!=MGP

So, this is not Zabbix issue, just incorrect settings in global correlation rule, so I resolve the issue

More help:

Zabbix International Community in Telegram
or
Zabbix Forum

Regards, Igor

P.S. Please, try to exclude from your correlation rules steps "B" and "E":

 

 

Generated at Mon Mar 17 11:01:53 EET 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.