A Zabbix module providing detailed incident investigation with temporal patterns, occurrence heatmaps, SLA impact, and action timeline.
Developed by Monzphere
- Temporal patterns: heatmap showing which weekdays and hours incidents occur most frequently
- Monthly drill-down: click a month to see daily distribution of incidents
- Monthly comparison: trend (↗ ↘ →) and percentage change vs previous month
- SLA by service: impact on affected services with SLI/SLO, visual gauge and compact tree
- Timeline and Actions: toggle between event list and actions table (alerts, commands, status) using native Zabbix layout
- Recommendations: highest-risk hours and days for planning
- Quick comparison: "Same slot last week" and "Same day last week" when filters are applied
- Export: report exportable via print/PDF
- Direct access: magnifying glass icon (🔍) on the problem list and problem widgets that opens investigation for that event
- Maintenance integration: visualization of maintenance periods and their correlation with incidents (see Maintenance integration below)
The module displays Zabbix maintenances in the investigation views to help correlate incidents with planned maintenance windows.
- Heatmap (day × hour): Cells that had incidents during a maintenance period show a wrench icon (🔧). The legend "Icon = incident during maintenance" explains this.
- Last 12 months: Each month has an orange bar below the incident bar when maintenances occurred in that month. The number inside the bar indicates how many maintenances. Click the orange bar to open a tooltip (Zabbix native style) with the list of maintenances and their date ranges.
- Daily distribution (drilldown): When you click a month, each day shows segments. Orange segments indicate days with maintenance; the number shows how many maintenances that day. Click a segment to see details in a tooltip.
- Maintenances are fetched for the host and host groups of the incident, for the last 12 months.
- Recurring timeperiods (daily, weekly, monthly) are expanded into concrete segments.
- Legends remain visible even when there are no maintenances in the current view.
- Configuration → Maintenance read access is required for maintenance data to be shown.
- Zabbix 7.0.x and 7.4.x (tested on both versions)
- PHP 8.0+
- Zabbix with Services and SLA configured (optional, for SLA impact panel)
If the module does not work on your Zabbix version, please open an issue on GitHub.
git clone https://github.com/Monzphere/IncidentInvestigation.git
# or download the ZIP and extractCopy the module folder to Zabbix's modules directory:
cp -r TimePattern /usr/share/zabbix/modules/IncidentInvestigationIf the modules directory does not exist, create it:
mkdir -p /usr/share/zabbix/modules
cp -r TimePattern /usr/share/zabbix/modules/IncidentInvestigation- Go to Administration → General → Modules
- Find Incident Investigation
- Click Enable
The module does not add a menu item. Access is through:
- From the problem list: in Monitoring → Problems, click the magnifying glass icon (🔍) next to each problem to open the investigation for that event
- From problem widgets: the same icon appears on problem widgets in dashboards
- Direct URL:
zabbix.php?action=incident.investigation.view&eventid=12345(replace with the desired eventid)
IncidentInvestigation/
├── Module.php
├── manifest.json
├── actions/
│ ├── CControllerIncidentInvestigationView.php
│ └── CControllerIncidentServiceImpact.php
├── assets/
│ ├── css/
│ │ ├── blue-theme.css
│ │ └── dark-theme.css
│ └── js/
│ └── problem-investigation-icon.js
├── views/
│ ├── incident.investigation.view.php
│ ├── layout.htmlpage.php
│ └── js/
│ └── incident.investigation.js.php
└── README.md
Open source and free for the community.
We thank our partner Lunio for investing in collaboration toward open source and free solutions, contributing to the monitoring ecosystem and supporting the Zabbix community.
Monzphere – monzphere.com