{"id":40965,"date":"2023-10-14T16:46:46","date_gmt":"2023-10-14T16:46:46","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=40965"},"modified":"2023-10-14T16:46:46","modified_gmt":"2023-10-14T16:46:46","slug":"zabbix-event-correlation-rules","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/zabbix-event-correlation-rules\/","title":{"rendered":"Zabbix Event correlation rules"},"content":{"rendered":"\n<p><br>Zabbix event correlation rules allow you to correlate events from different sources and generate new events based on the correlation results. This can be useful for detecting complex problems that span multiple systems or for reducing the number of alerts that you need to respond to.<\/p>\n\n\n\n<p>To create a Zabbix event correlation rule, you need to specify the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Name:<\/strong>&nbsp;The name of the correlation rule.<\/li>\n\n\n\n<li><strong>Conditions:<\/strong>&nbsp;The conditions that must be met in order for the correlation rule to fire.<\/li>\n\n\n\n<li><strong>Operations:<\/strong>&nbsp;The operations that should be performed when the correlation rule fires.<\/li>\n<\/ul>\n\n\n\n<p>The conditions for a Zabbix event correlation rule can be based on the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Event type:<\/strong>&nbsp;The type of event.<\/li>\n\n\n\n<li><strong>Event source:<\/strong>&nbsp;The source of the event.<\/li>\n\n\n\n<li><strong>Event severity:<\/strong>&nbsp;The severity of the event.<\/li>\n\n\n\n<li><strong>Event message:<\/strong>&nbsp;The message of the event.<\/li>\n<\/ul>\n\n\n\n<p>The operations for a Zabbix event correlation rule can be based on the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Generate new event:<\/strong>&nbsp;Generate a new event based on the correlation results.<\/li>\n\n\n\n<li><strong>Close event:<\/strong>&nbsp;Close the event that triggered the correlation rule.<\/li>\n\n\n\n<li><strong>Close matched old events:<\/strong>&nbsp;Close any matching old events that are still open.<\/li>\n\n\n\n<li><strong>Send email notification:<\/strong>&nbsp;Send an email notification about the correlation results.<\/li>\n\n\n\n<li><strong>Execute external script:<\/strong>&nbsp;Execute an external script based on the correlation results.<\/li>\n<\/ul>\n\n\n\n<p>Once you have created a Zabbix event correlation rule, you need to enable it. To do this, go to the <strong>Configuration<\/strong> > <strong>Event correlation<\/strong> page and click the <strong>Enable<\/strong> checkbox next to the correlation rule.<\/p>\n\n\n\n<p><strong>Use Case Example:<\/strong><\/p>\n\n\n\n<p>Imagine you&#8217;re monitoring a network and you have separate triggers for detecting when a server goes down and when its primary application becomes unresponsive. If the server goes down, the application obviously won&#8217;t respond. Without event correlation, you&#8217;d get two alerts: one for the server and one for the application. However, with event correlation, you can set a rule to close the application event if a server-down event occurs for the same server. This way, you get a single alert about the root cause (the server going down) and avoid the noise of the related alert (application unresponsive).<\/p>\n\n\n\n<p>Here is an example of a simple Zabbix event correlation rule:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">Name: Web server down\n<span class=\"hljs-attr\">Conditions<\/span>:\n- Event type: Web server down\n- Event source: Web server host\n<span class=\"hljs-attr\">Operations<\/span>:\n- Generate <span class=\"hljs-keyword\">new<\/span> event: High priority event <span class=\"hljs-keyword\">with<\/span> the message <span class=\"hljs-string\">\"Web server is down\"<\/span>\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>This correlation rule will generate a new high priority event with the message &#8220;Web server is down&#8221; whenever an event of the type &#8220;Web server down&#8221; is received from the web server host.<\/p>\n\n\n\n<p>You can create more complex Zabbix event correlation rules to detect more complex problems. For example, you could create a correlation rule to detect a denial-of-service attack on your web servers. This correlation rule could look for events such as a high number of failed login attempts or a high volume of traffic from a single IP address.<\/p>\n\n\n\n<p><strong>Benefits of using Zabbix event correlation rules<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Zabbix event correlation rules can help you to detect complex problems that span multiple systems.<\/li>\n\n\n\n<li>Zabbix event correlation rules can help you to reduce the number of alerts that you need to respond to.<\/li>\n\n\n\n<li>Zabbix event correlation rules can help you to improve the overall responsiveness of your monitoring system.<\/li>\n<\/ul>\n\n\n\n<p>Here&#8217;s how to set up event correlation rules in Zabbix:<\/p>\n\n\n\n<p><strong>1. Navigate to Event Correlation:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go to <code>Configuration<\/code> and select <code>Event correlation<\/code>.<\/li>\n<\/ul>\n\n\n\n<p><strong>2. Create a New Correlation Rule:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click on <code>Create correlation rule<\/code>.<\/li>\n<\/ul>\n\n\n\n<p><strong>3. Define the Event Source:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Under <code>Source<\/code>, you can choose between <code>Trigger event<\/code> and <code>Internal event<\/code>. Most often, you&#8217;ll use <code>Trigger event<\/code>.<\/li>\n<\/ul>\n\n\n\n<p><strong>4. Define the Conditions:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Here, you specify what circumstances must be met for the correlation rule to take effect.<\/li>\n\n\n\n<li>For instance, you can set conditions based on:\n<ul class=\"wp-block-list\">\n<li>Event tag name and value.<\/li>\n\n\n\n<li>New severity.<\/li>\n\n\n\n<li>Old severity.<\/li>\n\n\n\n<li>Event ID.<\/li>\n\n\n\n<li>and more.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p><strong>5. Define the Operations:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Here&#8217;s where you define what should happen when the conditions are met.<\/li>\n\n\n\n<li>Operations might include:\n<ul class=\"wp-block-list\">\n<li>Close event.<\/li>\n\n\n\n<li>Close all related events.<\/li>\n\n\n\n<li>Add a message to an event.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p><strong>6. Save the Rule:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Once you&#8217;ve defined the conditions and operations for your correlation rule, click <code>Add<\/code> to save it.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Zabbix event correlation rules allow you to correlate events from different sources and generate new events based on the correlation results. This can be useful for detecting complex problems that span multiple systems or for reducing the number of alerts that you need to respond to. To create a Zabbix event correlation rule, you need&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-40965","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/40965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=40965"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/40965\/revisions"}],"predecessor-version":[{"id":40966,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/40965\/revisions\/40966"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=40965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=40965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=40965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}