Zabbix global event correlation explained
Use the build in functionality to tell the monitoring software which is core device. This will allow us to concentrate on the root cause in case of event cascade happens.
Chapters:
00:00 - Explanation of how and why it works
05:03 - Create a dummy template to perform simulations really fast.
06:28 - Create 6 host objects. Now we have 2 locations. Each location has a central router and 2 standard devices.
07:23 - Label equipment. Configure which device holds the central connection and which devices are behind it.
09:21 - Final explanation of how the host labaling system makes sense with the 2 rules.
10:29 - Crash test. Simulation to demonstrate if a device in one site goes down, how the problem goes away if the core device goes down. Device goes down in another site but does not interfere with the equipment in the first site.
14:04 - Summarize the setup again, making a more bulletproof solution, and simulate again.
List all events closed by global correlation:
SELECT repercussion.clock, repercussion.name, rootCause.clock,
rootCause.name AS name FROM events repercussion
JOIN event_recovery ON (event_recovery.eventid=repercussion.eventid)
JOIN events rootCause ON (rootCause.eventid=event_recovery.c_eventid)
WHERE event_recovery.c_eventid IS NOT NULL
ORDER BY repercussion.clock ASC;
Delete all events (syntoms) closed by correlation rule. Root cause will remain:
DELETE FROM events WHERE eventid IN (
SELECT repercussion.eventid FROM events repercussion
JOIN event_recovery ON (event_recovery.eventid=repercussion.eventid)
JOIN events rootCause ON (rootCause.eventid=event_recovery.c_eventid)
WHERE event_recovery.c_eventid IS NOT NULL
ORDER BY repercussion.clock ASC
);