problem_get
Read-only
Retrieve unresolved Zabbix problems as raw rows with numeric severities and Unix timestamps for scripts, bulk audits, or advanced filters not exposed by the operator-facing active problems view.
Instructions
Low-level audit retrieval of unresolved Zabbix problems. Returns raw rows with numeric severities and Unix timestamps, no host name, no severity label. For an operator chat question ('what is wrong right now', 'active problems', 'current alerts', 'real problems') call problem_active_get instead -- it returns the same problems but with disabled-trigger/host noise dropped, host names attached, and human-readable time/severity, so the LLM does not have to post-process or chain three tools. Reach for problem_get only when you specifically need raw rows for a script, a bulk audit of every problem (including stale ones), or filters problem_active_get does not expose ('acknowledged', 'suppressed', 'recent', 'time_from', 'time_till'). For historical events (including resolved), use event.get instead. The newest problems come first unless a sort is given.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Keys: acknowledged, cause_eventid (6.4+), cep_ruleid (8.0+), clock, correlationid, eventid, flags (8.0+), name, ns, object, objectid, r_clock, r_eventid, r_ns, severity, source, userid. Text properties cannot be filtered; use 'search' for them. | |
| object | No | Problem object type: 0=trigger, 1=discovered host, 2=discovered service, 3=autoregistration, 4=item, 5=LLD rule. | |
| output | No | Properties of the problem object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: eventid, name, severity, clock, r_clock, objectid. Properties: acknowledged, cause_eventid (6.4+), cep_ruleid (8.0+), clock, correlationid, eventid, flags (8.0+), name, ns, object, objectid, opdata, r_clock, r_eventid, r_ns, severity, source, suppressed, urls, userid. | |
| recent | No | true = also return problems that were resolved a moment ago (for as long as 'Display OK triggers for' in the Zabbix settings says); false or omitted = unresolved problems only. It is not a filter for new problems: use time_from for that. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Keys: name. | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| source | No | Problem source: 0=trigger (default), 1=discovery, 2=autoregistration, 3=internal. | |
| hostids | No | Return only problems for the given hosts. | |
| evaltype | No | Tag filter evaluation mode: 0=AND/OR (default, all tag conditions must match), 2=OR (any tag condition may match). | |
| eventids | No | Return only problems with the given event IDs. | |
| groupids | No | Return only problems for hosts in the given host groups. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| monitored | No | [MCP-side filter, applied after the Zabbix call; not a problem.get parameter] If true, drop problems whose trigger is disabled (status != 0) or whose host is disabled (status != 0). Same semantic as host_get's 'monitored' / item_get's 'monitored'. Useful to skip stale problems lingering on de-monitored objects. Default: false (returns every problem Zabbix has on file). | |
| objectids | No | Return only problems for the given trigger/item/LLD rule IDs. | |
| sortfield | No | Sort by one or more of: eventid (a list for several; pair with 'sortorder'). No other property is sortable. When omitted, the result is sorted by eventid with the newest first. | |
| sortorder | No | Sort order: 'ASC' (ascending) or 'DESC' (descending). 'DESC' while 'sortfield' is omitted (newest first); 'ASC' alone returns the oldest first. | |
| time_from | No | Return only problems created after this time (Unix timestamp, ISO 8601 date-time such as 2026-04-01T08:00:00Z, or a relative time such as now-1h, now/d or now-7d/d; a value without a zone is read in the zone resolved for the call). | |
| time_till | No | Return only problems created before this time (Unix timestamp, ISO 8601 date-time such as 2026-04-01T08:00:00Z, or a relative time such as now-1h, now/d or now-7d/d; a value without a zone is read in the zone resolved for the call). | |
| suppressed | No | Filter by suppression state: true = only suppressed problems (silenced by a maintenance window or by hand), false = only problems that are not suppressed. Omit it for both. | |
| countOutput | No | Return the count of matching results instead of the actual data. | |
| searchByAny | No | If true, return results matching ANY search field (OR). Default is ALL fields (AND). | |
| acknowledged | No | Filter by acknowledgement state: true=acknowledged only, false=unacknowledged only. | |
| extra_params | No | Other native problem.get parameters, merged into the request as-is. Parameters: action (7.0+), action_userids (7.0+), eventid_from, eventid_till, severities, symptom (6.4+), tags. Sub-object selects (value 'extend', 'count' or a list of property names): selectAcknowledges, selectSuppressionData, selectTags. Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. | |
| severity_min | No | Minimum severity to return: 0=not classified, 1=information, 2=warning, 3=average, 4=high, 5=disaster. | |
| searchWildcardsEnabled | No | If true, enable * and ? wildcards in search patterns. |