Linux

Dear Amanda!

Please mind, that:

"Reports">"Triggers top 100"

uses API method "trigger.get" behind the scenes.
Whereas you are referring to the "events.get" API call.

Let me turn your attention to the fact that "events" are not only "trigger events", but also "discovery events", "autoregistration events" and "internal events".

To get the "number of status changes" the following query is used (on frontend's PHP level):

// get 100 triggerids with max event count
$sql = 'SELECT e.objectid,count(distinct e.eventid) AS cnt_event'.
 ' FROM triggers t,events e'.
 ' WHERE t.triggerid=e.objectid'.
 ' AND e.source='.EVENT_SOURCE_TRIGGERS.
 ' AND e.object='.EVENT_OBJECT_TRIGGER.
 ' AND e.clock>='.zbx_dbstr($data['filter']['timeline']['from_ts']).
 ' AND e.clock<='.zbx_dbstr($data['filter']['timeline']['to_ts']);

As you can see - the query limits the output result by events belonging to "source of the event" - "trigger" and "type of object which generated the event" also "trigger".

Please correct me if I somewhere imprecisely understood your issue description.

Kind regards,
Antons Sincovs 

I'll show you with our data to make clear why I'm confused about that:

Using API filtering by severities:

24/08/2021 09:55:32:DEBUG:urllib2.Request(https://monitoracao.serpro/api_jsonrpc.php, {"jsonrpc": "2.0", "method": "event.get", "params":
{"source": "0", "object": "0", "time_from": "1629723300", "time_end": "1629809700", "selectHosts": ["host"], "severities": [4, 5], "output": ["name", "hosts"], "sortfield": ["clock", "eventid"], "sortorder": "DESC"}
, "id": "1", "auth": "df23da79b1a1be5a5da2f0cd35d21042"})

Result:
dfcdsrvv0633;WINDOWS;Alta utilizacao de CPU no servidor dfcdsrvv0633;36

36 = counting all events with same name (tried with objectid also, same thing)

Using API with no filter by severities:

24/08/2021 09:55:32:DEBUG:urllib2.Request(https://monitoracao.serpro/api_jsonrpc.php, {"jsonrpc": "2.0", "method": "event.get", "params":
{"source": "0", "object": "0", "time_from": "1629723300", "time_end": "1629809700", "selectHosts": ["host"], "output": ["name", "hosts"], "sortfield": ["clock", "eventid"], "sortorder": "DESC"}
, "id": "1", "auth": "df23da79b1a1be5a5da2f0cd35d21042"})

Result:
dfcdsrvv0633;WINDOWS;Alta utilizacao de CPU no servidor dfcdsrvv0633;73

73 = counting all events with same name (tried with objectid also, same thing)

Screenshot of same query with filter but showing count as API query above (last line):  

Maybe the API is doing a different SQL query?

Hi,

I think that I found out the difference. Event severity it's different from trigger priority that is used in toptriggers.php's query.

select e.objectid,e.name,e.severity,t.priority from events e,triggers t where t.triggerid=e.objectid and e.objectid=1495463 AND e.clock>='1629730209
 ' AND e.clock<='1629816609' AND t.priority IN (4,5) limit 100; 
 objectid |                      name                       | severity | priority  
 ---------+------------------------------------------------------------------ 
  1495463 | Alta utilizacao de CPU no servidor dfcdsrvv0633 |        0 |        4 
  1495463 | Alta utilizacao de CPU no servidor dfcdsrvv0633 |        4 |        4 
  1495463 | Alta utilizacao de CPU no servidor dfcdsrvv0633 |        0 |        4

In this way, I would have to get all events without filter for severity and then query each trigger to get the priority that I want...Well, it will take a little bit longer.

Maybe this could be at least documented or create a change to the API event.get call to return only events according to trigger priority?

"Severity" value for the corresponding event can flap between the parent trigger's "priority" and 0 value (for ok events). This is the reason why in your SQL query results you see entries with different "severity" and "priority" values for the events generated by the same trigger.

The priority will always be the trigger's level, but severity will flap between trigger's "priority" in case of a "problem event" and "0" when an "ok event" is generated.

Is this documented somewhere? I only found out because I saw the difference between toptriggers e API event.get.

It would be great if event.get had a filter for trigger priority or something like "select_triggers".

There is an additional field "event.value" which equals to "0" if a t*rigger changed state to "OK"* and "1" if a trigger changed state to problem.
You can find the API "event" object's details (and "value" property possible values for trigger events) here: https://www.zabbix.com/documentation/current/manual/api/reference/event/object
In the API "event" object's description "severity" is "Event current severity" which is "not classified" (0) for "ok events".
Here is a sample query:

select e.objectid,e.name,e.severity,t.priority,CASE e.value WHEN 1 THEN 'Problem' WHEN 0 THEN 'Ok' END as TriggerState,e.objectid from events e,triggers t where t.triggerid=e.objectid and e.objectid=13486 limit 4;
+----------+------------------------------------------------------------------+----------+----------+--------------+----------+
| objectid | name                                                             | severity | priority | TriggerState | objectid |
+----------+------------------------------------------------------------------+----------+----------+--------------+----------+
|    13486 | More than 100 items having missing data for more than 10 minutes |        2 |        2 | Problem      |    13486 |
|    13486 | More than 100 items having missing data for more than 10 minutes |        0 |        2 | Ok           |    13486 |
|    13486 | More than 100 items having missing data for more than 10 minutes |        2 |        2 | Problem      |    13486 |
|    13486 | More than 100 items having missing data for more than 10 minutes |        0 |        2 | Ok           |    13486 |
+----------+------------------------------------------------------------------+----------+----------+--------------+----------+

It's interesting but I couldn't see how the field 'value' would help to count status changes in triggers with specific priorities.

As far as I understood, the only way to achieve that is to call event.get to obtain all events for triggers in a specific interval then check each trigger counting the events if the trigger is set with the priority that I want.

If event.get had something that already did that would be easier.

You are right, Amanda, there is no such convenient way and your proposed approach seems the only one for now.
I mentioned the 'value' property just to show why "event severity" does not always equal "trigger priority".

Thank you for inquisity! If I ever come across some solution I will let you know.

Thanks!