[ZBX-8114] Duplicate email / trigger fires twice Created: 2014 Apr 17  Updated: 2017 May 30  Resolved: 2014 Jun 04

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Server (S)
Affects Version/s: 2.0.9, 2.0.10, 2.0.11, 2.2.2
Fix Version/s: None

Type: Incident report Priority: Major
Reporter: hullzabbix Assignee: Unassigned
Resolution: Won't fix Votes: 0
Labels: action, actionoperations, actions, duplicates, trigger, triggers
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Centos 5.6 server
Zabbix 2.2.2
Agent 2.2.1

Attachments: PNG File emails.png     PNG File eventhistory.PNG     PNG File latestdata.PNG     PNG File trigger.PNG    
Issue Links:
Duplicate

 Description   

We monitor the windows event log on a Windows Server 2012 machine (also effects 2008 r2). Details below. We have zabbix setup to send an email to a user when error messages appear in the application log, of source axMonitoring.

The issue we're having is we'll get duplicate emails. Watching the dashboard whilst this happens, I can see that the trigger fires, the email gets sent. The trigger will then clear after about 35 seconds (nodata(30)) and then it will fire again for another 35 seconds.

I've attached the latest data of SERVER application log, you can see it's correctly reading and not getting duplicates.

Item:
eventlog[Application]
Interval 5 (also tried 10, 30, 60)

Trigger:

{SERVER:eventlog[Application].nodata(30)}

#1 &

{SERVER:eventlog[Application].logsource(axMonitoring1)}

=1
(also tried nodata(45) and nodata(60)

Action:
Trigger value = Problem
Trigger = SERVER: axMonitoring
Date/Time:

{EVENT.DATE}

{EVENT.TIME}

Description:

{ITEM.VALUE}

Send message to users (email only)

 Comments   
Comment by hullzabbix [ 2014 Apr 17 ]

I missed one piece of info. The trigger has "Multiple PROBLEM events generation" checked, as we get groups of events we need to email on every occurrence. If this is unchecked, we'll only get the one email within the 30-35 seconds.

Comment by Alexander Vladishev [ 2014 Apr 17 ]

You have two conditions to firing trigger:

  • we should have data within 30 seconds
  • the last record should have "axMonitoring1" log source

When the server receives a new value is generated problematic event on the second condition.

Second PROBLEM event created by first condition when since we have data within 30 sec.

I think there should not be the first condition.

Comment by hullzabbix [ 2014 Apr 17 ]

Apologies, I set up a test axMonitoring1 - so I wasn't effecting live systems. The alert seen in the screenshot is running from the correct trigger axMonitoring. I've uploaded a screenshot.

I'm not really sure what you mean by two conditions. I have the one trigger. If I remove nodata condition then the trigger will be active forever.

Comment by Alexander Vladishev [ 2014 Apr 17 ]

All time-base trigger functions (nodata(), time(), date(), fuzzytime() ...) are processed when data is coming and every 30 seconds by "timer" process.

The second PROBLEM event is generated by "timer" process.

Comment by Alexander Vladishev [ 2014 Apr 17 ]

If you want to receive notifications when "axMonitoring" log records are coming the trigger expression should be like this:

{SERVER:eventlog[Application].logsource(axMonitoring1)}

=1

Comment by hullzabbix [ 2014 Apr 17 ]

You're absolutely right. I know I'm not the only one with the same perception of this "issue" though. It's common throughout the forum to want an email sent on windows event logs and then the trigger to clear instantly. It seems the common method is to use nodata. Is there a method of clearing the trigger from the dashboard when the email has been sent?

Or is it a case of setting information event to be hidden? It is possible to set a global setting (for all users) to hide the information level errors from the dashboard?

Comment by richlv [ 2014 Apr 17 ]

the problem also mentioned in https://support.zabbix.com/browse/ZBXNEXT-1604?focusedCommentId=106365#comment-106365

Comment by Oleg Ivanivskyi [ 2014 Jun 04 ]

Not a bug. It's how Zabbix works.
In such case you could use the mentioned above trigger expression (2014 Apr 17 16:21) and decrease trigger severity to "Not classified" or "Information".

I'm closing this issue. As an option, you could create a new feature request if you would like to have such feature (https://support.zabbix.com/browse/ZBXNEXT).

Comment by Oleksii Zagorskyi [ 2014 Jun 12 ]

Configuration mistake is enabled "Multiple PROBLEM events generation" option.
For such trigger expressions (where nodata() used only to return trigger to OK after some time) the option supposed to be disabled.

Generated at Fri Apr 19 00:40:12 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.