Table of Contents
1 Conditions
Overview
It is possible to define that an action is executed only if the event matches a defined set of conditions. Conditions are set when configuring the action.
Condition matching is case-sensitive.
Trigger actions
The following conditions can be used in trigger-based actions:
| Condition type | Supported operators | Description |
|---|---|---|
| Host group | equals does not equal |
Specify host groups or host groups to exclude. equals - event belongs to this host group. does not equal - event does not belong to this host group. Specifying a parent host group implicitly selects all nested host groups. To specify the parent group only, all nested groups have to be additionally set with the does not equal operator. |
| Template | equals does not equal |
Specify templates or templates to exclude. equals - event belongs to a trigger inherited from this template. does not equal - event does not belong to a trigger inherited from this template. |
| Host | equals does not equal |
Specify hosts or hosts to exclude. equals - event belongs to this host. does not equal - event does not belong to this host. |
| Tag name | equals does not equal contains does not contain |
Specify event tag or event tag to exclude. equals - event has this tag. does not equal - event does not have this tag. contains - event has a tag containing this string. does not contain - event does not have a tag containing this string. |
| Tag value | equals does not equal contains does not contain |
Specify event tag and value combination or tag and value combination to exclude. equals - event has this tag and value. does not equal - event does not have this tag and value. contains - event has a tag and value containing these strings. does not contain - event does not have a tag and value containing these strings. |
| Trigger | equals does not equal |
Specify triggers or triggers to exclude. equals - event is generated by this trigger. does not equal - event is generated by any other trigger, except this one. |
| Event name | contains does not contain |
Specify a string in the name of the event generated by the trigger or a string to exclude. By default, the event name matches the trigger name unless a custom event name is specified in trigger configuration. contains - event name contains this string. does not contain - this string is excluded from the event name. Note: Entered value will be compared to event name with all macros expanded. |
| Trigger severity | equals does not equal is greater than or equals is less than or equals |
Specify trigger severity. equals - equal to trigger severity. does not equal - not equal to trigger severity. is greater than or equals - more or equal to trigger severity. is less than or equals - less or equal to trigger severity. |
| Time period | in not in |
Specify a time period or a time period to exclude. in - event time is within the time period. not in - event time is not within the time period. See the time period specification page for description of the format. User macros are supported, since Zabbix 3.4.0. |
| Problem is suppressed | no yes |
Specify if the problem is suppressed (not shown) because of host maintenance. no - problem is not suppressed. yes - problem is suppressed. |
Service actions
The following conditions can be used in service actions:
| Condition type | Supported operators | Description |
|---|---|---|
| Service | equals does not equal |
Specify a service or a service to exclude. equals - event belongs to this service. does not equal - event does not belong to this service. Specifying a parent service implicitly selects all child services. To specify the parent service only, all nested services have to be additionally set with the does not equal operator. |
| Service name | contains does not contain |
Specify a string in the service name or a string to exclude. contains - event is generated by a service, containing this string in the name. does not contain - this string cannot be found in the service name. |
| Service tag name | equals does not equal contains does not contain |
Specify an event tag or an event tag to exclude. Service event tags can be defined in the service configuration section Tags. equals - event has this tag. does not equal - event does not have this tag. contains - event has a tag containing this string. does not contain - event does not have a tag containing this string. |
| Service tag value | equals does not equal contains does not contain |
Specify an event tag and value combination or a tag and value combination to exclude. Service event tags can be defined in the service configuration section Tags. equals - event has this tag and value. does not equal - event does not have this tag and value. contains - event has a tag and value containing these strings. does not contain - event does not have a tag and value containing these strings. |
Make sure to define message templates for Service actions in the Alerts → Media types menu. Otherwise, the notifications will not be sent.
Discovery actions
The following conditions can be used in discovery-based events:
| Condition type | Supported operators | Description |
|---|---|---|
| Host IP | equals does not equal |
Specify an IP address range or a range to exclude for a discovered host. equals - host IP is in the range. does not equal - host IP is not in the range. It may have the following formats: Single IP: 192.168.1.33 Range of IP addresses: 192.168.1-10.1-254 IP mask: 192.168.4.0/24 List: 192.168.1.1-254, 192.168.2.1-100, 192.168.2.200, 192.168.4.0/24 Support for spaces in the list format is provided since Zabbix 3.0.0. |
| Service type | equals does not equal |
Specify a service type of a discovered service or a service type to exclude. equals - matches the discovered service. does not equal - does not match the discovered service. Available service types: SSH, LDAP, SMTP, FTP, HTTP, HTTPS (available since Zabbix 2.2 version), POP, NNTP, IMAP, TCP, Zabbix agent, SNMPv1 agent, SNMPv2 agent, SNMPv3 agent, ICMP ping, telnet (available since Zabbix 2.2 version). |
| Service port | equals does not equal |
Specify a TCP port range of a discovered service or a range to exclude. equals - service port is in the range. does not equal - service port is not in the range. |
| Discovery rule | equals does not equal |
Specify a discovery rule or a discovery rule to exclude. equals - using this discovery rule. does not equal - using any other discovery rule, except this one. |
| Discovery check | equals does not equal |
Specify a discovery check or a discovery check to exclude. equals - using this discovery check. does not equal - using any other discovery check, except this one. |
| Discovery object | equals | Specify the discovered object. equals - equal to discovered object (a device or a service). |
| Discovery status | equals | Up - matches 'Host Up' and 'Service Up' events. Down - matches 'Host Down' and 'Service Down' events. Discovered - matches 'Host Discovered' and 'Service Discovered' events. Lost - matches 'Host Lost' and 'Service Lost' events. |
| Uptime/Downtime | is greater than or equals is less than or equals |
Uptime for 'Host Up' and 'Service Up' events. Downtime for 'Host Down' and 'Service Down' events. is greater than or equals - is more or equal to. Parameter is given in seconds. is less than or equals - is less or equal to. Parameter is given in seconds. |
| Received value | equals does not equal is greater than or equals is less than or equals contains does not contain |
Specify the value received from an agent (Zabbix, SNMP) check in a discovery rule. String comparison. If several Zabbix agent or SNMP checks are configured for a rule, received values for each of them are checked (each check generates a new event which is matched against all conditions). equals - equal to the value. does not equal - not equal to the value. is greater than or equals - more or equal to the value. is less than or equals - less or equal to the value. contains - contains the substring. Parameter is given as a string. does not contain - does not contain the substring. Parameter is given as a string. |
| Proxy | equals does not equal |
Specify a proxy or a proxy to exclude. equals - using this proxy. does not equal - using any other proxy except this one. |
Service checks in a discovery rule, which result in discovery events, do not take place simultaneously. Therefore, if multiple values are configured for Service type, Service port or Received value conditions in the action, they will be compared to one discovery event at a time, but not to several events simultaneously. As a result, actions with multiple values for the same check types may not be executed correctly.
Autoregistration actions
The following conditions can be used in actions based on active agent autoregistration:
| Condition type | Supported operators | Description |
|---|---|---|
| Host metadata | contains does not contain matches does not match |
Specify host metadata or host metadata to exclude. contains - host metadata contains the string. does not contain - host metadata does not contain the string. Host metadata can be specified in an agent configuration file. matches - host metadata matches regular expression. does not match - host metadata does not match regular expression. |
| Host name | contains does not contain matches does not match |
Specify a host name or a host name to exclude. contains - host name contains the string. does not contain - host name does not contain the string. matches - host name matches regular expression. does not match - host name does not match regular expression. |
| Proxy | equals does not equal |
Specify a proxy or a proxy to exclude. equals - using this proxy. does not equal - using any other proxy except this one. |
Internal event actions
The following conditions can be set for actions based on internal events:
| Condition type | Supported operators | Description |
|---|---|---|
| Event type | equals | Item in "not supported" state - matches events where an item goes from a 'normal' to 'not supported' state. Low-level discovery rule in "not supported" state - matches events where a low-level discovery rule goes from a 'normal' to 'not supported' state. Trigger in "unknown" state - matches events where a trigger goes from a 'normal' to 'unknown' state. |
| Host group | equals does not equal |
Specify host groups or host groups to exclude. equals - event belongs to this host group. does not equal - event does not belong to this host group. |
| Tag name | equals does not equal contains does not contain |
Specify event tag or event tag to exclude. equals - event has this tag. does not equal - event does not have this tag. contains - event has a tag containing this string. does not contain - event does not have a tag containing this string. |
| Tag value | equals does not equal contains does not contain |
Specify event tag and value combination or tag and value combination to exclude. equals - event has this tag and value. does not equal - event does not have this tag and value. contains - event has a tag and value containing these strings. does not contain - event does not have a tag and value containing these strings. |
| Template | equals does not equal |
Specify templates or templates to exclude. equals - event belongs to an item/trigger/low-level discovery rule inherited from this template. does not equal - event does not belong to an item/trigger/low-level discovery rule inherited from this template. |
| Host | equals does not equal |
Specify hosts or hosts to exclude. equals - event belongs to this host. does not equal - event does not belong to this host. |
Type of calculation
The following options of calculating conditions are available:
- And - all conditions must be met
Note that using "And" calculation is disallowed between several triggers when they are selected as a Trigger= condition. Actions can only be executed based on the event of one trigger.
- Or - enough if one condition is met
- And/Or - combination of the two: AND with different condition types and OR with the same condition type, for example:
Host group equals Oracle servers
Host group equals MySQL servers
Event name contains 'Database is down'
Event name contains 'Database is unavailable'
is evaluated as
(Host group equals Oracle servers or Host group equals MySQL servers) and (Event name contains 'Database is down' or Event name contains 'Database is unavailable')
- Custom expression - a user-defined calculation formula for evaluating action conditions. It must include all conditions (represented as uppercase letters A, B, C, ...) and may include spaces, tabs, brackets ( ), and (case sensitive), or (case sensitive), not (case sensitive).
While the previous example with And/Or would be represented as (A or B) and (C or D), in a custom expression you may as well have multiple other ways of calculation:
(A and B) and (C or D)
(A and B) or (C and D)
((A or B) and C) or D
(not (A or B) and C) or not D
etc.
Actions disabled due to deleted objects
If a certain object (host, template, trigger, etc.) used in an action condition/operation is deleted, the condition/operation is removed and the action is disabled to avoid incorrect execution of the action. The action can be re-enabled by the user.
This behavior takes place when deleting:
- host groups ("host group" condition, "remote command" operation on a specific host group);
- hosts ("host" condition, "remote command" operation on a specific host);
- templates ("template" condition, "link to template" and "unlink from template" operations);
- triggers ("trigger" condition);
- discovery rules (when using "discovery rule" and "discovery check" conditions).
If a remote command has many target hosts, and we delete one of them, only this host will be removed from the target list, the operation itself will remain. But, if it's the only host, the operation will be removed, too. The same goes for "link to template" and "unlink from template" operations.
Actions are not disabled when deleting a user or user group used in a "send message" operation.