Event tags

Overview

There is an option to define custom event tags in Zabbix. Event tags are defined on the trigger level. After the tags are defined, corresponding new events get marked with tag data.

Having custom event tags allows for more flexibility. Most importantly, events can be correlated based on event tags. In other uses, actions can be defined based on event tags.

Event tags are realized as a pair of the tag name and value. You can use only the name or pair it with a value:

MySQL, Service:MySQL, Services, Services:Customer, Applications, Application:Java, Priority:High

Use cases

Some use cases for this functionality are as follows:

1. Identify problems in a log file and close them separately

   • Define tags in the log trigger that will identify events using value extraction by the event correlation]]: select the option that OK event closes only matching events and choose the tag for matching; * See problem events created with a tag and closed individually. - Use it to filter notifications * Define tags on the trigger level to mark events by different tags; * Use tag filtering in action conditions to receive notifications only on the events that match tag data. - See event tag information in the frontend * Define tags on the trigger level to mark events by different tags; * See this information in //Monitoring// -> //Problems//. - Use information extracted from item value as tag value * Use an {{ITEM.VALUE}.regsub()} macro in the tag value; * See tag values in //Monitoring// -> //Problems// as extracted data from item value. - Identify problems better in notifications * Define tags on the trigger level; * Use an {EVENT.TAGS} macro in the problem notification; * Easier identify which application/service the notification belongs to. - Simplify configuration tasks by using tags on the template level * Define tags on the template trigger level; * See these tags on all triggers created from template triggers. - Create triggers with tags from low-level discovery (LLD) * Define tags on trigger prototypes; * Use LLD macros in the tag name or value; * See these tags on all triggers created from trigger prototypes. === Configuration === Event tags are defined in trigger configuration. Event tags can be defined for triggers, template triggers and trigger prototypes. {{:manual:config:triggers:event_tags.png|

Macro support

The following macros may be used in event tags:

• {ITEM.VALUE}, {ITEM.LASTVALUE}, {HOST.HOST}, {HOST.NAME}, {HOST.CONN}, {HOST.DNS}, {HOST.IP}, {HOST.PORT} and {HOST.ID} macros can be used to populate the tag name or tag value.

• {INVENTORY.*} macros can be used to reference host inventory values from one or several hosts in a trigger expression (supported since 4.0.0).

• User macros and user macro context is supported for the tag name/value. User macro context may include low-level discovery macros.

• Low-level discovery macros can be used for the tag name/value in trigger prototypes.

{EVENT.TAGS} and {EVENT.RECOVERY.TAGS} macros can be used in trigger-based notifications and they will resolve to a comma separated list of event tags or recovery event tags.

Substring extraction

Substring extraction is supported for populating the tag name or tag value, using a macro function - applying a regular expression to the value obtained by the {ITEM.VALUE}, {ITEM.LASTVALUE} macro or a low-level discovery macro. For example:

{{ITEM.VALUE}.regsub(pattern, output)}
{{ITEM.VALUE}.iregsub(pattern, output)}

{{#LLDMACRO}.regsub(pattern, output)}
{{#LLDMACRO}.iregsub(pattern, output)}

Tag name and value will be cut to 255 characters if their length exceeds 255 characters after macro resolution.

See also: Using macro functions in low-level discovery macros for event tagging.

Viewing event tags

Event tags, if defined, can be seen with new events in:

• Monitoring → Problems

• Monitoring → Problems → Event details

• Monitoring → Dashboard → Problems widget (in popup window that opens when rolling the mouse over problem name|

Only the first three tag entries are displayed. If there are more than three tag entries, it is indicated by three dots. If you roll your mouse over these three dots, all tag entries are displayed in a pop-up window.

Note that the order in which tags are displayed is affected by tag filtering and the Tag display priority option in the filter of Monitoring → Problems or the Problems dashboard widget.

Performance and storage effects

It is expected that the use of event tags may have the following effects:

• Event processing will be slower due to the creation of new records in the event tag table.

• Operations related to manipulations with triggers inherited from templates will be slower since it’s necessary to create one record per tag in the trigger tag table. Therefore the creation, update and removal of triggers will be slower.

• Synchronization of configuration cache will be slower due to trigger tags.

• Storage of event tags will require additional disk space which may be comparable to the size of existing trigger and event tables. Precise storage requirements depend very much on the number of tags created per trigger and event.

事件标签

概述

可以选择在Zabbix中定义自定义事件标签。 事件标签在触发器级别定义。定义标签后，相应的新事件将被标签数据标记。 拥有自定义事件标签可以提供更大的灵活性。最重要的是，事件可以是基于事件标签的correlated。此外，可以基于事件标签来定义动作。 事件标签通过一对tag name 和 value实现。您只能使用名称或将其与值配对： MySQL, 服务:MySQL, 服务, 服务:客户, 应用, 应用:Java, 优先级:高

用例

此功能的一些用例如下：

1. 识别日志文件中的问题并单独关闭它们

   • 在日志触发器中定义标签，它将使用event correlation]]：选择匹配标签的选项的OK事件并关闭匹配事件； * 查看使用标签创建的问题事件并单独关闭。 - 用标签来过滤通知 * 在触发级别定义标签以通过不同标签标记事件； * 在动作条件中使用标签过滤仅接收与标签数据匹配的事件的通知。 - 在前端查看事件标签的信息 * 在触发器级别定义标签以通过不同标签标记事件； * 在//Monitoring// -> //Problems//查看这个信息 - 使用从项目值中提取的信息作为标签值 * 用{{ITEM.VALUE}.regsub()}宏作为标签值 * 在//Monitoring// -> //Problems// 中查看从监控项的值中提取的标签数据 - 在通知中更好的识别问题 * 在触发器级别定义标签； * 在问题通知中使用宏{EVENT.TAGS}； * 更容易识别通知所属的应用程序/服务。 - 使用模板级别的标签简化配置任务 * 在模板级别定义标签； * 在模板触发器创建的所有触发器上查看这些标签。 - 在低级别发现（LLD）中创建带标签的触发器 * 在触发器原型上定义标签； * 在标签名字和值中使用宏； * 在触发器原型创建的所有触发器上查看这些标签。 === 配置 === 事件标签在触发器配置中定义。可以为触发器，模板触发器和触发器原型定义事件标签。 {{:manual:config:triggers:event_tags.png|

宏支持

可以在事件标签中使用以下宏：

• {ITEM.VALUE}, {ITEM.LASTVALUE}, {HOST.HOST}, {HOST.NAME}, {HOST.CONN}, {HOST.DNS}, {HOST.IP}, {HOST.PORT} and {HOST.ID} 这些宏可用用于填充标签名和标签值。

• {INVENTORY.*} macros 可用于引用触发器表达式中一个或多个主机的主机清单值（从4.0.0开始支持）。

• User macros和用户宏可用于标签名/值。用户宏可能包括低级别发现的宏。

• 低级别发现的宏可以用于触发器原型的标签名/值。

{EVENT.TAGS}和{EVENT.RECOVERY.TAGS}宏可用于基于触发器的通知，它们将解析为逗号分隔的事件标签或恢复事件标签列表。

提取子串

使用宏 function支持子串提取以填充标签名称或标签值 - 将正则表达式应用于{ITEM.VALUE}, {ITEM.LASTVALUE}宏或低级发现宏。 例如：

{{ITEM.VALUE}.regsub(pattern, output)}
{{ITEM.VALUE}.iregsub(pattern, output)}

{{#LLDMACRO}.regsub(pattern, output)}
{{#LLDMACRO}.iregsub(pattern, output)}

如果使用宏后长度超过255个字符，则标签名称和值将被剪切为255个字符。 同样可查看:在low-level discovery macros中使用宏函数作为事件标签。

查看事件标签

事件标记（如果已定义）可以在以下新事件中看到：

• Monitoring → Problems

• Monitoring → Problems → Event details

• Monitoring → Dashboard → Problems 窗口小部件 (在鼠标悬停在问题名称上时打开的弹出窗口中|

仅显示前三个标签条目。 如果有三个以上的标签条目，则用三个点表示。 如果将鼠标悬停在这三个点上，则所有标记条目都会显示在弹出窗口中。 请注意，标签显示的顺序受标签过滤和监控中 - > 问题或问题仪表板小组件过滤器中的标签显示优先级选项的影响。

性能和存储效果

预计事件标签的使用可能具有以下效果：

• 由于在事件标签表中创建了新记录，事件处理将变慢。

• 与从模板继承的触发器进行相关的操作将会变慢，因为必须在触发器标签表中为每个标签创建一条记录。 因此，触发器的创建，更新和删除将会变慢。

• 由于触发器标签，配置缓存的同步将变慢。

• 存储事件标签将需要额外的磁盘空间，这可能与现有触发器和事件表的大小相当。精确的存储要求在很大程度上取决于每个触发器和事件创建的标签数量。