Table of Contents
2 Conditions
Overview
An action is executed only in case an event matches a defined set of conditions.
Configuration
To set a condition:
- Go to Conditions tab in the action properties form
- Select conditions from the New condition dropdowns and click on Add
- Select the type of calculation (with more than one condition)
The following conditions can be set for trigger-based actions:
| Condition type | Supported operators | Description |
|---|---|---|
| Application | = like not like |
Specify an application or an application to exclude. = - event belongs to a trigger of the item that is linked to the specified application. like - event belongs to a trigger of the item that is linked to an application containing the string. not like - event belongs to a trigger of the item that is linked to an application not containing the string. |
| Host group | = <> |
Specify host groups or host groups to exclude. = - event belongs to this host group. <> - event does not belong to this host group. |
| Template | = <> |
Specify templates or templates to exclude. = - event belongs to a trigger inherited from this template. <> - event does not belong to a trigger inherited from this template. |
| Host | = <> |
Specify hosts or hosts to exclude. = - event belongs to this host. <> - event does not belong to this host. |
| Trigger | = <> |
Specify triggers or triggers to exclude. = - event is generated by this trigger. <> - event is generated by any other trigger, except this one. |
| Trigger name | like not like |
Specify a string in the trigger name or a string to exclude. like - event is generated by a trigger, containing this string in the name. Case sensitive. not like - this string cannot be found in the trigger name. Case sensitive. Note: Entered value will be compared to trigger name with all macros expanded. |
| Trigger severity | = <> >= <= |
Specify trigger severity. = - equal to trigger severity <> - not equal to trigger severity >= - more or equal to trigger severity <= - less or equal to trigger severity |
| Trigger value | = | Specify a trigger value. = - equal to trigger value (OK or PROBLEM) |
| Time period | in not in |
Specify a time period or a time period to exclude. in - event time is within the time period. not in - event time is not within the time period. See Time period specification page for description of the format. |
| Maintenance status | in not in |
Specify a host in maintenance or not in maintenance. in - host is in maintenance mode. not in - host is not in maintenance mode. Note: If several hosts are involved in the trigger expression, the condition matches if at least one of the hosts is/is not in maintenance mode. |
Trigger value:
- if a trigger changes status from OK to PROBLEM, trigger value is PROBLEM
- if a trigger changes status from PROBLEM to OK, trigger value is OK
When a new action for triggers is created, it gets two automatic conditions (both can be removed by the user):
- "Trigger value = PROBLEM" - so that notifications are sent for problems only. This means that if you configure an action without any more specific conditions, messages will be received for any problem. Having this condition by default is also important if you want to receive a single recovery message.
- "Maintenance status = not in maintenance" - so that notifications are not sent for hosts in maintenance.
The following conditions can be set for discovery-based events:
| Condition type | Supported operators | Description |
|---|---|---|
| Host IP | = <> |
Specify an IP address range or a range to exclude for a discovered host. = - host IP is in the range. <> - host IP is not in the range. It may have the following formats: Single IP: 192.168.1.33 Range of IP addresses: 192.168.1.1-254 (until Zabbix 2.4.4) 192.168.1-10.1-254 (from Zabbix 2.4.4) IP mask: 192.168.4.0/24 List: 192.168.1.1-254,192.168.2.1-100,192.168.2.200,192.168.4.0/24 |
| Service type | = <> |
Specify a service type of a discovered service or a service type to exclude. = - matches the discovered service. <> - does not match the discovered service. Available service types: SSH, LDAP, SMTP, FTP, HTTP, HTTPS (available since Zabbix 2.2 version), POP, NNTP, IMAP, TCP, Zabbix agent, SNMPv1 agent, SNMPv2 agent, SNMPv3 agent, ICMP ping, telnet (available since Zabbix 2.2 version). |
| Service port | = <> |
Specify a TCP port range of a discovered service or a range to exclude. = - service port is in the range. <> - service port is not in the range. |
| Discovery rule | = <> |
Specify a discovery rule or a discovery rule to exclude. = - using this discovery rule. <> - using any other discovery rule, except this one. |
| Discovery check | = <> |
Specify a discovery check or a discovery check to exclude. = - using this discovery check. <> - using any other discovery check, except this one. |
| Discovery object | = | Specify the discovered object. = - equal to discovered object (a device or a service). |
| Discovery status | = | Up - matches 'Host Up' and 'Service Up' events Down - matches 'Host Down' and 'Service Down' events Discovered - matches 'Host Discovered' and 'Service Discovered' events Lost - matches 'Host Lost' and 'Service Lost' events |
| Uptime/Downtime | >= <= |
Uptime for 'Host Up' and 'Service Up' events. Downtime for 'Host Down' and 'Service Down' events. >= - is more or equal to. Parameter is given in seconds. <= - is less or equal to. Parameter is given in seconds. |
| Received value | = <> >= <= like not like |
Specify the value received from an agent (Zabbix, SNMP). Case sensitive string comparison. If multiple Zabbix agent or SNMP checks are configured for a rule, received values for all of them are checked (each check generates a new event which is matched against all conditions). = - equal to the value. <> - not equal to the value. >= - more or equal to the value. <= - less or equal to the value. like - contains the substring. Parameter is given as a string. not like - does not contain the substring. Parameter is given as a string. |
| Proxy | = <> |
Specify a proxy or a proxy to exclude. = - using this proxy. <> - using any other proxy except this one. |
Service checks in a discovery rule, which result in discovery events, do not take place simultaneously. Therefore, if multiple values are configured for Service type, Service port or Received value conditions in the action, they will be compared to one discovery event at a time, but not to several events simultaneously. As a result, actions with multiple values for the same check types may not be executed correctly.
The following conditions can be set for actions based on active agent auto-registration:
| Condition type | Supported operators | Description |
|---|---|---|
| Host metadata | like not like |
Specify host metadata or host metadata to exclude. like - host metadata contains the string. not like - host metadata does not contain the string. Host metadata can be specified in an agent configuration file. |
| Host name | like not like |
Specify a host name or a host name to exclude. like - host name contains the string. not like - host name does not contain the string. |
| Proxy | = <> |
Specify a proxy or a proxy to exclude. = - using this proxy. <> - using any other proxy except this one. |
The following conditions can be set for actions based on internal events:
| Condition type | Supported operators | Description |
|---|---|---|
| Application | = like not like |
Specify an application or an application to exclude. = - event belongs to an item that is linked to the specified application. like - event belongs to an item that is linked to an application containing the string. not like - event belongs to an item that is linked to an application not containing the string. |
| Event type | = | Item in "not supported" state - matches events where an item goes from a 'normal' to 'not supported' state Item in "normal" state - matches events where an item goes from a 'not supported' to 'normal' state Low-level discovery rule in "not supported" state - matches events where a low-level discovery rule goes from a 'normal' to 'not supported' state ** Low-level discovery rule in "normal" state** - matches events where a low-level discovery rule goes from a 'not supported' to 'normal' state Trigger in "unknown" state - matches events where a trigger goes from a 'normal' to 'unknown' state ** Trigger in "normal" state** - matches events where a trigger goes from an 'unknown' to 'normal' state |
| Host group | = <> |
Specify host groups or host groups to exclude. = - event belongs to this host group. <> - event does not belong to this host group. |
| Template | = <> |
Specify templates or templates to exclude. = - event belongs to an item/trigger/low-level discovery rule inherited from this template. <> - event does not belong to an item/trigger/low-level discovery rule inherited from this template. |
| Host | = <> |
Specify hosts or hosts to exclude. = - event belongs to this host. <> - event does not belong to this host. |
Type of calculation
The following options of calculating conditions are available:
- And - all conditions must be met
Note that "And" calculation should not be used between several triggers when they are selected as a Trigger= condition. Actions can only be executed based on the event of one trigger.
- Or - enough if one condition is met
- And/Or - combination of the two: AND with different condition types and OR with the same condition type, for example:
Host group = Oracle servers
Host group = MySQL servers
Trigger name like 'Database is down'
Trigger name like 'Database is unavailable'
is evaluated as
(Host group = Oracle servers or Host group = MySQL servers) and (Trigger name like 'Database is down' or Trigger name like 'Database is unavailable')
- Custom expression - a user-defined calculation formula for evaluating action conditions. It must include all conditions (represented as uppercase letters A, B, C, ...) and may include spaces, tabs, brackets ( ), and (case sensitive), or (case sensitive).
While the previous example with And/Or would be represented as (A or B) and (C or D), in a custom expression you may as well have multiple other ways of calculation:
(A and B) and (C or D)
(A and B) or (C and D)
((A or B) and C) or D
etc.
Actions disabled due to deleted objects
If a certain object (host, template, trigger, etc) used in an action condition/operation is deleted, the condition/operation is removed and the action is disabled to avoid incorrect execution of the action. The action can be re-enabled by the user.
This behavior takes place when deleting:
- host groups ("host group" condition, "remote command" operation on a specific host group);
- hosts ("host" condition, "remote command" operation on a specific host);
- templates ("template" condition, "link to template" and "unlink from template" operations);
- triggers ("trigger" condition);
- discovery rules (when using "discovery rule" and "discovery check" conditions);
- proxies ("proxy" condition).
Note: If a remote command has many target hosts, and we delete one of them, only this host will be removed from the target list, the operation itself will remain. But, if it's the only host, the operation will be removed, too. The same goes for "link to template" and "unlink from template" operations.
Actions are not disabled when deleting a user or user group used in a "send message" operation.