[ZBX-17276] Incorrect closing of problems by global correlation Created: 2020 Feb 06 Updated: 2020 Mar 25 Resolved: 2020 Mar 25 |
|
Status: | Closed |
Project: | ZABBIX BUGS AND ISSUES |
Component/s: | Server (S) |
Affects Version/s: | 4.4.5 |
Fix Version/s: | None |
Type: | Problem report | Priority: | Trivial |
Reporter: | Anton Palmov | Assignee: | Igor Gorbach (Inactive) |
Resolution: | Won't fix | Votes: | 1 |
Labels: | None | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified |
Attachments: |
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() |
Description |
Steps to reproduce: **1. Create a global correlation rule with a condition "Value of old event tag SOMETAG equals value of new event tag SOMETAG" and an operation "Close new event" 2. Create a trigger, which contains 2 different items. These items should be updated at the same time, for example 3. Get or generate a problem Result:
Expected:
|
Comments |
Comment by Igor Gorbach (Inactive) [ 2020 Feb 07 ] |
Hello, Anton! Thank you for your issue! Please, attach to issue (screenshots):
Best regards, Igor.
|
Comment by Anton Palmov [ 2020 Feb 07 ] |
Hello, Igor! Sure, here it is: 1) Event correlation rule 2) Trigger
|
Comment by Igor Gorbach (Inactive) [ 2020 Feb 10 ] |
Hello, Anton! Best regards, Igor |
Comment by Anton Palmov [ 2020 Feb 10 ] |
Hello, Igor! At this case we use global correlation for reduce the number of similar alerts / alerts with one root cause. We also monitor EIGRP sessions between our head office and regional offices, which are created as prototypes on another hosts (head and regional routers). And we don't want to see these alerts if the regional device, for example, isn't available at all. So we decided to use tags and global correlation because we can't use classic dependencies at this case (I mean we can't create dependency for trigger already created from a prototype). And this approach generally works, apart from the above problem because of which we risk missing a problem. So we had to disable this rule.
|
Comment by Igor Gorbach (Inactive) [ 2020 Feb 24 ] |
Hello, Anton! Please, attach the screenshots of problem details for problems which were closed by global correlation rule Regards, Igor! |
Comment by Anton Palmov [ 2020 Feb 24 ] |
Hello, Igor |
Comment by Anton Palmov [ 2020 Feb 24 ] |
+ |
Comment by Igor Gorbach (Inactive) [ 2020 Mar 25 ] |
Anton, I think you have mutually exclusive parameters in your correlation rule From one side - you compare the values of old event tag with new event tag (Region )and result must be true (equals) From the other side you compart the same tags values with {$REGION_PREFIX} usermacro as a value Then we have the rule MGP=MGP and MGP!=MGP So, this is not Zabbix issue, just incorrect settings in global correlation rule, so I resolve the issue More help: Zabbix International Community in Telegram Regards, Igor P.S. Please, try to exclude from your correlation rules steps "B" and "E":
|