Close problem automatically via Zabbix API

fake_first_name_45777 fake_last_name_45777

Technical Support Engineer at Zabbix

November 20, 2020

Today we are talking about a use case when it’s impossible to find a proper way to write a recovery expression for the Zabbix trigger. In other words, we know how to identify problems. But there is no good way to detect when the problem is gone. This mostly relates to a huge environment, for […]

This mostly relates to a huge environment, for example:

Got one log file. There are hundreds of patterns inside. We respect all of them. We need them
SNMP trap item (snmptrap.fallback) with different patterns being written inside

In these situations, the trigger is most likely configured to “Event generation mode: Multiple.” This practically means: when a “problematic metric” hits the instance, it will open +1 additional problem.

Goal:
I just need to receive an email about the record, then close the event.

As a workaround (let’s call it a solution here), we can define an action which will:

contact an API endpoint
manually acknowledge the event and close it

The biggest reason why this functionality is possible is that: when an event hits the action, the operation actually knows the event ID of the problem. The macro {EVENT.ID} saves the day.

To solve the problem, we need to install API characteristics at the global level:

     {$Z_API_PHP}=http://127.0.0.1/api_jsonrpc.php
    {$Z_API_USER}=api
{$Z_API_PASSWORD}=zabbix

NOTE
‘http://127.0.0.1/api_jsonrpc.php’ means the frontend server runs on the same server as systemd:zabbix-server. If it is not the case, we need to plot a front-end address of Zabbix GUI + add ‘api_jsonrpc.php’.

We will have 2 actions. The first one will deliver a notification to email:

After 1 minute, a second action will close the event:

This is a full bash snippet we must put inside. No need to change anything. It works with copy and paste:

URL={$Z_API_PHP}
USER={$Z_API_USER}
PASSWORD={$Z_API_PASSWORD}

# authorization
AUTH=$(curl -sk -X POST -H "Content-Type: application/json" -d '
{
	"jsonrpc": "2.0",
	"method": "user.login",
	"params": {
		"user": "'"$USER"'",
		"password": "'"$PASSWORD"'"
	},
	"id": 1,
	"auth": null
}
' $URL | \
grep -E -o "([0-9a-f]{32,32})")

# acknowledge and close event
curl -sk -X POST -H "Content-Type: application/json" -d '
{
	"jsonrpc": "2.0",
	"method": "event.acknowledge",
	"params": {
		"eventids": "{EVENT.ID}",
		"action": 1,
		"message": "Problem resolved."
	},
	"auth": "'"$AUTH"'",
	"id": 1
}' $URL

# close api key
curl -sk -X POST -H "Content-Type: application/json" -d '
{
    "jsonrpc": "2.0",
    "method": "user.logout",
    "params": [],
    "id": 1,
    "auth": "'"$AUTH"'"
}
' $URL

Tags:

api

fake_first_name_45777 fake_last_name_45777

Technical Support Engineer at Zabbix