Willing to know more about zabbix event correlation? Our in-house experts are here to help you out with this article. Our server management support is here to offer a lending hand with your queries and issues.

Zabbix event correlation

Event correlation allows to correlate problem events to their resolution in a manner that is very precise and flexible.

Event correlation can defined:

• on trigger level – one trigger may use to relate separate problems to their solution
• globally – problems can correlate to their solution from a different trigger/polling method using global correlation rules

Trigger-based event correlation

Trigger-based event correlation allows to correlate separate problems reported by one trigger.

While generally an OK event can close all problem events created by one trigger, there are cases when a more detail approach is need.

This is the case with triggers that have Multiple Problem Event Generation enabled.

Such triggers are normally used for log monitoring, trap processing, etc.

It is possible in Zabbix to relate problem events based on tagging.

Tags are use to extract values and create identification for problem events.

Taking advantage of that, problems can also close individually based on matching tag.

In other words, the same trigger can create separate events identified by the event tag.

Therefore, problem events can identify one-by-one and close separately based on the identification by the event tag.

Global event correlation

Global event correlation allows to reach out over all metrics monitored by Zabbix and create correlations.

It is possible to correlate events created by completely different triggers and apply the same operations to them all.

By creating intelligent correlation rules it is actually possible to save yourself from thousands of repetitive notifications and focus on root causes of a problem!

Global event correlation is a powerful mechanism, which allows you to untie yourself from one-trigger based problem and resolution logic.

So far, a single problem event was created by one trigger and we were dependent on that same trigger for the problem resolution.

We could not resolve a problem created by one trigger with another trigger.

But with event correlation based on event tagging, we can.

In another use, global correlation can identify similar triggers and apply the same operation to them.

What if we could get only one problem report per network port problem? No need to report them all. That is also possible with global event correlation.

Global event correlation is configured in correlation rules.

A correlation rule defines how the new problem events are paired with existing problem events and what to do in case of a match.

If a problem is closed by global correlation, it is report in the Info column of Monitoring → Problems.

Configuring global correlation rules is available to Super Admin level users only.

Event correlation must configure very carefully, as it can negatively affect event processing performance or, if misconfigured, close more events than was intended

To configure global correlation safely, observe the following important tips:

• Firstly, reduce the correlation scope. Always set a unique tag for the new event that is pair with old events and use the New event tag correlation condition;
• Then, add a condition based on the old event when using the Close old event operation.
• Next, avoid using common tag names that may end up use by different correlation configurations;
• Finally, keep the number of correlation rules limit to the ones you really need.

[Looking for a solution to another query? We’re happy to help.]

Conclusion

In this article, we provide a quick and simple solution from our Support team to know more about zabbix event correlation