Zabbix 4.2: Template and host-level tags

In information systems word “tag” is a well-known and widely used term that helps to describe an item and allows it to be easily found again by browsing or searching.

In Zabbix, tags provide a useful way to group related events together and quickly tell users what a certain event is about. Tags are similar to, but more specific than, groups. The use of tags is completely optional, but may be extremely useful, for example, in event correlation, when defining tag-based user permissions, configuring maintenance and email notifications, or when filtering your content by specific tags.

If you have not used event tagging before and wonder what benefits it brings, or just want to know which improvements to event tags are awaiting you in Zabbix 4.2, you’re in the right place.

What are tags in Zabbix?

The possibility to tag events first appeared in Zabbix 3.2 as a part of event correlation. Event tags are realized as a pair of the tag name and value. You can either use just the name or pair it with a value, e.g. MySQL, Service:MySQL, Application:Java etc.

In Zabbix 4.0, we have added the possibility to configure host maintenance on trigger level, so that it could be limited to triggers/services with the corresponding tags. Another powerful feature is tag-based permissions for user groups to see problems filtered by tag name and its value. Moreover, we also made it possible to filter problems by tags in Monitoring → Problems and the Problems dashboard widget, and in Configuration → Hosts → Triggers.

What’s new in Zabbix 4.2

Prior to 4.2, event tagging was confined to individual triggers only. This means that each time one wanted to change specific tags on multiple triggers, he or she had to do it by configuring triggers one by one. Another option, of course, was to replace all existing tags with the ones you want, but it was acceptable only in some cases.

While working on Zabbix 4.2, we have decided to go further and give Zabbix users even more flexibility and ease of use. As a result, we have added the possibility to define tags also on template and host levels. In addition to that, we have also extended mass update functionality to easily add new tags to multiple templates, hosts or triggers at once, or remove specific ones.

Of course, we have not forgotten macro support. The following ones may be used in template and host-level tags:

• {HOST.HOST}, {HOST.NAME}, {HOST.CONN}, {HOST.DNS}, {HOST.IP}, {HOST.PORT} and {HOST.ID} macros
• {INVENTORY.*} macros
• User macros

After the tags are defined, corresponding new events get marked with tag data:

• with template level tags – host problems that are created by triggers from this template will be marked
• with host level tags – all problems of the host will be marked
• with trigger level tags – problem of this trigger will be marked

An event inherits all tags from the whole chain of templates, hosts, triggers. Completely identical tag:value combinations (after resolved macros) are merged into one rather than being duplicated when marking the event.

Use cases

Let’s take a look at some real-world usage examples.

First of all, we will define tags on template level.
1. Go to Configuration → Templates → Template DB MySQL
2. Click on the Tags tab
3. Enter tag and value pair Service:MySQL in the form and click Update

Problem 1: You want only MySQL problems to be displayed in the Problems view.
Solution:
1. Go to Monitoring → Problems
2. Specify tag Service:MySQL as filter parameter and press Apply

Problem 2: You want to limit database administrators to only see MySQL problems.
Solution:
1. Go to Administration → User groups
2. Click on Create user group
3. Name the user group
4. Click on the Tag filter tab, select desired host group and specify tag Service:MySQL

Problem 3: You want to limit notifications received by DB administrators about MySQL problems from other applications on the same host.
Solution:
1. Go to Configuration → Actions
2. From the Event source dropdown select Triggers
3. Click on Create action
4. Name the action
5. From the New condition dropdown select Tag value and specify tag Service:MySQL and click Add
6. To set notification to be sent only if the host is not in maintenance, add another condition Problem is suppressed – No. Then from the Type of calculation dropdown select And

7. Go to the Operations tab
8. Select Send message as Operation type
9. Specify DB administrators as the user group notifications will be sent to

Problem 4: You want MySQL problems to be hidden while DB is under maintenance.
Solution:
1. Go to Configuration → Maintenance
2. Click on Create maintenance period
3. Fill in required fields
4. Go to the Hosts and groups tab
5. Select desired host groups or hosts and specify tag Service:MySQL

Problem 5: You want old MySQL related events to be closed (correlated), when a host is up again.
Solution:
1. Go to Configuration → Event correlation
2. Click on Create correlation to the right
3. Enter parameters of the correlation rule in the form
4. Click on the Operations tab and from New operation dropdown select Close old events

Conclusion

As you can see, with the introduction of the possibility to define tags on template and host level in the new version of Zabbix, tagging has become more convenient and transparent.  No more hardship and dark magic defining tags for each trigger – you can simply define them in one place and then use them in filters, event correlation, maintenance etc.

When talking about more complex scenarios, you may need a bit more time to choose proper tags and configure your templates, triggers, actions etc. accordingly, as nothing should be done halfheartedly. As a result, however, you will receive a very flexible and powerful tool for everyday tasks.

About Andrey Griscenko

Developer at Zabbix.

View all posts by Andrey Griscenko