problem_active_get
Fetches active Zabbix problems, filtering out disabled triggers/hosts and low-severity events, so you see only actionable issues.
Instructions
Real, actionable problems right now -- the PRIMARY tool for an LLM asked "what is wrong on the Zabbix server?".
Returns only problems where BOTH the trigger AND the host are enabled, with severity Warning (2) or above. Skips the noise that problem_get would return: stale alerts on disabled triggers, problems on hosts that were taken out of monitoring but not deleted, and Information / Not classified events that operators do not act on.
Each problem comes back with the host name, severity_label
("warning", "high", "disaster", ...), and time rendered as a
human-readable UTC string. Use this whenever the operator asks
"active problems", "current issues", "what is firing", "real
problems", or "skip disabled".
For an unfiltered raw view (e.g. to also see stale problems), use problem_get instead.
Returns {"problems": [...], "count": N, "filtered_out": M} where filtered_out = problems dropped due to disabled trigger/host.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max problems to return after filtering disabled triggers/hosts (default 50). | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| hostids | No | Restrict to problems on these hosts. | |
| groupids | No | Restrict to problems on hosts in these host groups. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| sortfield | No | Problem sort key; problem.get can only sort by 'eventid' (default). | eventid |
| sortorder | No | 'ASC' or 'DESC' (default 'DESC'). | DESC |
| severities | No | Severity floor as a list of numeric codes. Default [2,3,4,5] (Warning and above). Pass [0,1,2,3,4,5] to include Information / Not classified. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |