Shulou(Shulou.com)06/02 Report--

Zabbix alarm suppression

I think there are two ways to suppress alarm:

One is the dependency of the trigger, and the other is to adjust the time when the trigger triggers the action.

The first kind of alarm suppression

For example:

Router A-> Router B-> Router c

When we were monitoring the network equipment, all three devices monitored and monitored the network port. if the network of router An is down, then the network of router B and router C behind must be blocked, so at this time, all three routers will call the police, and there is no way to determine who has the problem, but we add trigger dependencies.

The dependency of the trigger is that A depends on B, so when an alarm occurs in B, A will not alarm again.

Thus it can be seen that router c depends on B and A, and router B depends on A.

For router c, when there is an alarm in B or A, c will not alarm again. Similarly, compared to B, when an alarm occurs in A, B will not alarm again, that is, it agrees that the problem arises, and there is only one machine alarm.

This can be used for alarm suppression.

The second alarm suppression:

The time when the problem is prompted after the problem is found by modifying the trigger

When we configure alarms, most of us find problems only with "immediately" alarms, but this situation is uncertain.

For example:

We monitor the status of the port and give an alarm when the port cannot be detected, but when the network jitters, the port will not be detected. This is inevitable, and it is not appropriate if we set the "immediately" alarm.

So we set the steps: there is a definition of the steps in the action, as follows:

When we define the monitoring item, his update time is updated every minute.

In the action-- > operation, there are steps (step). Step 1, that is, send it immediately. As we said before, port monitoring is not suitable.

Default procedure duration: you can also set it yourself after 60 seconds between step 1 and step 2

Next, if we set the step to 4, it means that we can send an alarm after three minutes (because step 1 is to send it immediately). We can scan port 5038 three times in three minutes. If it cannot be detected, we will send an alarm. This is more convincing.

The effect is that an alarm will not be sent until three minutes after the first port exception is found, and each detection is a port exception.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.