:Ingest Zabbix (Zabbix 3.2 to 4.2) alerts into Log Service

Configure an alert notification method in the Zabbix console

1. Install the notification script on the server where Zabbix is installed.
   1. View the AlertScriptsPath parameter in the Zabbix configuration file to obtain the directory in which the notification script is installed.
   2. Store the alibaba_cloud_sls.py file in the directory.
   3. Run the following command to grant the execute permission on the alibaba_cloud_sls.py file to the current user:

      chmod +x alibaba_cloud_sls.py

2. Log on to the Zabbix console.
3. Add a notification method named Alibaba Cloud SLS.
   1. In the top navigation bar, choose Administration > Media types.
   2. In the upper-right corner of the Media types page, click Create media type.
   3. Set the parameters and click Add.
      

      The following table describes the parameters.

      Parameter	Description	Example
      Name	The name of the notification method.	Alibaba Cloud SLS
      Type	The format in which alerts are ingested into Log Service.	Script
      Script name	The name of the notification script.	alibaba_cloud_sls.py
      Script parameters	The parameters of the notification script. Take note of the following instructions: Notice You must set the parameters in sequence based on sample values. You must enter the full path of a webhook URL in the third line. The webhook URL is generated after you create an alert ingestion application in the Log Service console. For more information, see Obtain webhook URLs. If your Zabbix server is deployed on an Elastic Compute Service (ECS) instance, we recommend that you select the region where the ECS instance resides and use an internal endpoint that can be accessed over a LAN or virtual private cloud (VPC). You can also use the public endpoint that can be accessed over the Internet in a region. You must enter the path of a log file in the fourth line. The alibaba_cloud_sls.py script prints the error logs to the specified log file. Make sure that the Zabbix server has the required permissions to write data to the log file.	{ALERT.MESSAGE} {ALSERT.SUBJECT} http://cn-heyuan.log.aliyuncs.com/event/webhook/RAMAK_{ACCESS_KEY_ID}/zabbix /tmp/alibaba-cloud-alert/zabbix.log

4. Create an action.
   1. In the top navigation bar, choose Configuration > Actions.
   2. In the upper-right corner of the Actions page, click Create action.
   3. On the Operation tab, set the parameters.
      Notice If the Update operations tab is displayed on the Actions page, ignore the tab.

      

      The following table describes the parameters.

      Parameter	Description	Example
      Default subject	Set the value to firing.	firing
      Default message	The alert content in the JSON format. You can modify the value of the time_zone field and the value of the zabbix_url field based on your business requirements. You cannot modify the values of other fields. time_zone: the time zone. Default value: +0800. This value indicates the UTC+8 time zone. zabbix_url: the redirect link of the Zabbix console. Default value: 127.0.0.1.	{ "time_zone": "+0800", "zabbix_url": "127.0.0.1", "trigger_hostgroup_name": "{TRIGGER.HOSTGROUP.NAME}", "event_recovery_time": "{EVENT.RECOVERY.TIME}", "trigger_events_problem_ack": "{TRIGGER.EVENTS.PROBLEM.ACK}", "event_recovery_value": "{EVENT.RECOVERY.VALUE}", "host_ip": "{HOST.IP}", "trigger_state": "{TRIGGER.STATE}", "trigger_template_name": "{TRIGGER.TEMPLATE.NAME}", "event_status": "{EVENT.STATUS}", "event_value": "{EVENT.VALUE}", "event_time": "{EVENT.TIME}", "trigger_status": "{TRIGGER.STATUS}", "event_id": "{EVENT.ID}", "event_tags": "{EVENT.TAGS}", "trigger_expression": "{TRIGGER.EXPRESSION}", "event_date": "{EVENT.DATE}", "action_id": "{ACTION.ID}", "trigger_url": "{TRIGGER.URL}", "trigger_nseverity": "{TRIGGER.NSEVERITY}", "trigger_problem_events_problem_ack": "{TRIGGER.PROBLEM.EVENTS.PROBLEM.ACK}", "event_age": "{EVENT.AGE}", "trigger_id": "{TRIGGER.ID}", "action_name": "{ACTION.NAME}", "event_recovery_id": "{EVENT.RECOVERY.ID}", "trigger_events_problem_unack": "{TRIGGER.EVENTS.PROBLEM.UNACK}", "date": "{DATE}", "trigger_name": "{TRIGGER.NAME}", "event_ack_status": "{EVENT.ACK.STATUS}", "trigger_events_unack": "{TRIGGER.EVENTS.UNACK}", "event_recovery_date": "{EVENT.RECOVERY.DATE}", "trigger_problem_events_problem_unack": "{TRIGGER.PROBLEM.EVENTS.PROBLEM.UNACK}", "trigger_events_ack": "{TRIGGER.EVENTS.ACK}", "host_name": "{HOST.NAME}", "time": "{TIME}", "event_recovery_tags": "{EVENT.RECOVERY.TAGS}", "event_recovery_status": "{EVENT.RECOVERY.STATUS}", "trigger_description": "{TRIGGER.DESCRIPTION}", "trigger_value": "{TRIGGER.VALUE}" }

   4. On the Recovery operations tab, set the parameters.
      

      The following table describes the parameters.

      Parameter	Description	Example
      Default subject	Set the value to resolved.	resolved
      Default message	The alert content in the JSON format. You can modify the value of the time_zone field and the value of the zabbix_url field based on your business requirements. You cannot modify the values of other fields. time_zone: the time zone. Default value: +0800. This value indicates the UTC+8 time zone. zabbix_url: the redirect link of the Zabbix console. Default value: 127.0.0.1.	{ "time_zone": "+0800", "zabbix_url": "127.0.0.1", "trigger_hostgroup_name": "{TRIGGER.HOSTGROUP.NAME}", "event_recovery_time": "{EVENT.RECOVERY.TIME}", "trigger_events_problem_ack": "{TRIGGER.EVENTS.PROBLEM.ACK}", "event_recovery_value": "{EVENT.RECOVERY.VALUE}", "host_ip": "{HOST.IP}", "trigger_state": "{TRIGGER.STATE}", "trigger_template_name": "{TRIGGER.TEMPLATE.NAME}", "event_status": "{EVENT.STATUS}", "event_value": "{EVENT.VALUE}", "event_time": "{EVENT.TIME}", "trigger_status": "{TRIGGER.STATUS}", "event_id": "{EVENT.ID}", "event_tags": "{EVENT.TAGS}", "trigger_expression": "{TRIGGER.EXPRESSION}", "event_date": "{EVENT.DATE}", "action_id": "{ACTION.ID}", "trigger_url": "{TRIGGER.URL}", "trigger_nseverity": "{TRIGGER.NSEVERITY}", "trigger_problem_events_problem_ack": "{TRIGGER.PROBLEM.EVENTS.PROBLEM.ACK}", "event_age": "{EVENT.AGE}", "trigger_id": "{TRIGGER.ID}", "action_name": "{ACTION.NAME}", "event_recovery_id": "{EVENT.RECOVERY.ID}", "trigger_events_problem_unack": "{TRIGGER.EVENTS.PROBLEM.UNACK}", "date": "{DATE}", "trigger_name": "{TRIGGER.NAME}", "event_ack_status": "{EVENT.ACK.STATUS}", "trigger_events_unack": "{TRIGGER.EVENTS.UNACK}", "event_recovery_date": "{EVENT.RECOVERY.DATE}", "trigger_problem_events_problem_unack": "{TRIGGER.PROBLEM.EVENTS.PROBLEM.UNACK}", "trigger_events_ack": "{TRIGGER.EVENTS.ACK}", "host_name": "{HOST.NAME}", "time": "{TIME}", "event_recovery_tags": "{EVENT.RECOVERY.TAGS}", "event_recovery_status": "{EVENT.RECOVERY.STATUS}", "trigger_description": "{TRIGGER.DESCRIPTION}", "trigger_value": "{TRIGGER.VALUE}" }

   5. Click Add.
5. Configure a notification method for a specific user.
   1. In the top navigation bar, choose Administration > Users.
   2. In the user list, click the user that you want to manage.
      You can also click Create user to create a user.
   3. On the Media tab, click Add.
      You can also click Edit next to a media to modify the settings of the media.
   4. Set the Type parameter to Alibaba Cloud SLS and click Add.
      
   5. Click Update.

Alert parsing

A Zabbix alert contains more than 100 macros. For more information, see Zabbix documentation. Log Service selects only dozens of the macros to construct an alert. The following table provides examples of the macros in Zabbix alerts.

Field mappings

After a Zabbix alert is ingested into Log Service, the alert is converted to an alert that is supported by Log Service by using field mapping. The following table describes the mappings between the alert attributes of Log Service and the alert fields of Zabbix.

FAQ

How do I view operation logs?

1. Log on to the Zabbix console.
2. In the top navigation bar, choose Reports > Action log.