Skip to content

Triggers

A trigger is a query that specifies the criteria for initiating actions. Queries can range from simple comparisons ("event status equal to open") to complex series of comparisons with subordinate clauses. The ideal trigger query is specific enough to identify the criteria to initiate an action but no more. Too specific and you risk missing important changes in your environment; too broad and you risk sending misleading notifications.

Triggers cannot initiate actions. Only rules can initiate actions. Your user account must have the Manager role to create and manage triggers in the Zenoss Cloud interface.

Adding a trigger

You can add a trigger through the Zenoss Cloud interface on the TRIGGERS tab of the ADMIN > Actions page. You can also use the Zenoss API to create a trigger.

When you add a trigger with the ADD TRIGGER dialog, you specify the trigger metadata (in the following table) and a query.

Field Required? Description
Trigger name Yes

A unique, short identifier for the trigger.

The name of a trigger cannot be changed after the ADD TRIGGER dialog is saved.

Description No Additional text to further describe the trigger.
Type Yes The trigger type; Events is the default.
Tags No A list of arbitrary terms to associate with the trigger.

Query builder

A trigger query consists of one set of comparisons, and optionally, additional sets of subordinate comparisons. For each set of comparisons, you specify whether the set is satisfied when all or any of its comparisons are satisfied. The following graphic shows an example of the query builder in the ADD TRIGGER dialog. (The default query builder includes just one comparison set; this example has two.)

The following table describes the major components of the query builder.

Item Description
Comparison set 1 / 2

A trigger query consists of one or more comparison sets; this example has two. The comparisons in a subordinate set are evaluated when the comparisons in its superordinate set are satisfied.

Relationship type

The logic to use to join comparisons and the subordinate set, if any.

  • Relationship type All joins with logical AND.
  • Relationship type Any joins with logical OR.
Comparison
  • The left side specifies the field to use in the comparison, which varies by trigger type (for example, event fields).
  • The middle specifies the comparison operator. The available operators vary by the field selected for the left side.
  • The right side specifies the value to use in the comparison. The value type varies by the field selected for the left side, too.

Example query

For example, the following query includes two sets of comparisons:

The following text summarizes the logic of the preceding query:

"Source Type" equal to "cz"AND
"Summary" contains "periphery"AND
"Acknowledged" not equal to True
  AND
  "Severity" greater than or equal to "error"OR
  "Status" not equal to "closed"

The first set includes three comparisons, all of which must be satisfied. The second, subordinate set includes two comparisons, either one of which must be satisfied. The second set is not evaluated unless the first set is satisfied.

Event fields in triggers

The following table describes the event fields available in the trigger editor.

Field Description
Severity

The event severity level.

The value is one of critical, error, warning, info, or debug.

Status

The event status.

The value is one of open, suppressed, or closed.

Acknowledged

A value that indicates whether the event has been acknowledged.

  • If true, the event has been acknowledged.
  • If any other value, the event has not been acknowledged.
Summary The event summary.
Body The body of the event message.
Type (Sources other than Collection Zones only) Information about the event type.
Name The event name.
Source The instance identifier of the source type. For example, cz0.
Source Type

The class name of the application sending data.

For events originating in a Collection Zone, the value is cz.

CZ Event Class

The name of the event class associated with the event, either at creation or during a subsequent mapping.

Each Collection Zone can have its own set of customized event classes.

CZ Message The body of the event message.
CZ Entity Title

The title of entity from which the event originated.

CZ Entity ID

The ID of entity from which the event originated.

CZ Entity Type

The type of entity from which the event originated.

The value is one of DEVICE, COMPONENT, SERVICE, or ORGANIZER.

CZ Parent Entity Type

The type of the parent entity from which the event originated.

The value is one of DEVICE, COMPONENT, SERVICE, or ORGANIZER.

CZ Parent Entity Title The title of the parent entity from which the event originated.
CZ Parent Entity ID The ID of the parent entity from which the event originated.
CZ Device Class

The name of the device class associated with the event.

Each Collection Zone can have its own set of customized device classes.

CZ Production State

The production state name, if the state is one of the default states.

The value is one of Production, Pre-Production, Test, Maintenance, or Decommissioned.

CZ Production State (Custom)

A number that represents a customized production state.

Each Collection Zone can have its own set of customized production states.

CZ Priority

The device priority, if the priority is one of the default priorities.

The value is one of highest, high, normal, low, lowest, or trivial.

CZ Priority (Custom)

A number that represents a customized device priority.

Each Collection Zone can have its own set of customized device priorities.

CZ Collector

The name of the collector where the event originated.

CZ Agent

The name of the service that generated the event.

For example, zenperfsnmp or zenpython.

Note

The names of event fields are different in the Zenoss API. For more information, see Event field names in trigger queries.