Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode).

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.

Monitoring the availability status of the agent.

For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold.

No data timeout for active agents. Consider to keep it relatively high.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.

For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as time threshold.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The critical threshold of the CPU utilization expressed in %.

The CPU utilization expressed in %.

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent

executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt

Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode

functions of the Windows® Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure

calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a

component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is

sustained, there may be a processor bottleneck or an application or hardware related issue that can

significantly diminish overall system performance.

The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing

in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue

and are waiting to be executed.

The CPU utilization is too high. The system might be slow to respond.

"The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."
The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
hardware failure. This should never be higher than 20%.

• Windows: High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

• Windows: High CPU utilization
• Windows: CPU interrupt time is too high

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

• Windows: High CPU utilization

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the Memory util item.

The warning threshold of the minimum free swap.

Used memory in bytes.

The total memory expressed in bytes.

Memory utilization in %.

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes,

Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays

the last observed value only; it is not an average.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Preprocessing

• JavaScript: return (100 - value)

The used space of swap volume/file in percent.

The total space of the swap volume/file expressed in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less

than 5,000, there may well be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages

faulted per second because only one page is faulted in each fault operation, hence this is also equal

to the number of page fault operations. This counter includes both hard faults (those that require

disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most

processors can handle large numbers of soft faults without significant consequence. However, hard faults,

which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects

that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).

A typical Event ID 2019 is recorded in the system event log.

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

• Windows: High memory utilization

The Memory Free System Page Table Entries is less than {$MEM.PAGETABLECRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.

• Windows: High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

• Windows: High memory utilization

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem utilization in percent.

The warning threshold of the filesystem utilization in percent.

Discovery of file systems of different types.

Used storage in bytes

Total space in bytes

Space utilization in % for {#FSNAME}

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} limit.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} limit.

• {#FSLABEL}({#FSNAME}): Disk space is critically low

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

The warning threshold of disk time utilization in percent.

Disk read average response time (in s) before the trigger would fire.

Disk write average response time (in s) before the trigger would fire.

Discovery of installed physical disks.

Preprocessing

• Replace: {#INSTANCE} -> {#DEVNAME}

Rate of read operations on the disk.

Rate of write operations on the disk.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing

• JavaScript: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

The disk appears to be under heavy load.

• {#DEVNAME}: Disk read request responses are too high
• {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation.

This trigger might indicate the disk {#DEVNAME} saturation.

The system uptime expressed in the following format: "N days, hh:mm:ss".

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

System description of the host.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of processes.

The number of threads used by all running processes.

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

The device uptime is less than 10 minutes.

The name of the system has changed. Acknowledge to close the problem manually.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

Raw data of win32_networkadapter.

Preprocessing

• Discard unchanged with heartbeat: 1h

Discovery of installed network interfaces.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Incoming traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

Outgoing traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

The number of incoming packets dropped on the network interface.

Preprocessing

• Change per second

The number of outgoing packets dropped on the network interface.

Preprocessing

• Change per second

The number of incoming packets with errors on the network interface.

Preprocessing

• Change per second

The number of outgoing packets with errors on the network interface.

Preprocessing

• Change per second

Estimated bandwidth of the network interface if any.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].Speed.first()

  ⛔️Custom on fail: Set value to: 0

• JavaScript: return (value=='9223372036854775807' ? 0 : value)

• Discard unchanged with heartbeat: 1h

The type of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

• Discard unchanged with heartbeat: 1d

The operational status of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

• Discard unchanged with heartbeat: 1d

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important.
No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

Discovery of Windows services of different types as defined in template's macros.

The service has a state other than "Running" for the last three times.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The critical threshold of the CPU utilization expressed in %.

The CPU utilization expressed in %.

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent

executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt

Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode

functions of the Windows® Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure

calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a

component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is

sustained, there may be a processor bottleneck or an application or hardware related issue that can

significantly diminish overall system performance.

The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing

in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue

and are waiting to be executed.

The CPU utilization is too high. The system might be slow to respond.

"The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."
The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
hardware failure. This should never be higher than 20%.

• Windows: High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

• Windows: High CPU utilization
• Windows: CPU interrupt time is too high

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

• Windows: High CPU utilization

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the Memory util item.

The warning threshold of the minimum free swap.

Used memory in bytes.

The total memory expressed in bytes.

Memory utilization in %.

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes,

Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays

the last observed value only; it is not an average.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Preprocessing

• JavaScript: return (100 - value)

The used space of swap volume/file in percent.

The total space of the swap volume/file expressed in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less

than 5,000, there may well be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages

faulted per second because only one page is faulted in each fault operation, hence this is also equal

to the number of page fault operations. This counter includes both hard faults (those that require

disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most

processors can handle large numbers of soft faults without significant consequence. However, hard faults,

which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects

that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).

A typical Event ID 2019 is recorded in the system event log.

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

• Windows: High memory utilization

The Memory Free System Page Table Entries is less than {$MEM.PAGETABLECRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.

• Windows: High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

• Windows: High memory utilization

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem utilization in percent.

The warning threshold of the filesystem utilization in percent.

Discovery of file systems of different types.

Used storage in bytes

Total space in bytes

Space utilization in % for {#FSNAME}

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} limit.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} limit.

• {#FSLABEL}({#FSNAME}): Disk space is critically low

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

The warning threshold of disk time utilization in percent.

Disk read average response time (in s) before the trigger would fire.

Disk write average response time (in s) before the trigger would fire.

Discovery of installed physical disks.

Preprocessing

• Replace: {#INSTANCE} -> {#DEVNAME}

Rate of read operations on the disk.

Rate of write operations on the disk.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing

• JavaScript: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

The disk appears to be under heavy load.

• {#DEVNAME}: Disk read request responses are too high
• {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation.

This trigger might indicate the disk {#DEVNAME} saturation.

The upper threshold for difference of system time.

The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping.

The system uptime expressed in the following format: "N days, hh:mm:ss".

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

System description of the host.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of processes.

The number of threads used by all running processes.

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

The device uptime is less than 10 minutes.

The host's system time is different from Zabbix server time.

The name of the system has changed. Acknowledge to close the problem manually.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

Raw data of win32_networkadapter.

Preprocessing

• Discard unchanged with heartbeat: 1h

Discovery of installed network interfaces.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Incoming traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

Outgoing traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

The number of incoming packets dropped on the network interface.

Preprocessing

• Change per second

The number of outgoing packets dropped on the network interface.

Preprocessing

• Change per second

The number of incoming packets with errors on the network interface.

Preprocessing

• Change per second

The number of outgoing packets with errors on the network interface.

Preprocessing

• Change per second

Estimated bandwidth of the network interface if any.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].Speed.first()

  ⛔️Custom on fail: Set value to: 0

• JavaScript: return (value=='9223372036854775807' ? 0 : value)

• Discard unchanged with heartbeat: 1h

The type of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

• Discard unchanged with heartbeat: 1d

The operational status of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

• Discard unchanged with heartbeat: 1d

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important.
No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

Discovery of Windows services of different types as defined in template's macros.

The service has a state other than "Running" for the last three times.

This macro is used for trigger expression. It can be overridden on the host or linked on the template level.

This macro is used for trigger expression. It can be overridden on the host or linked on the template level.

This macro is used in the filter of attribute and disk discoveries. It can be overridden on the host or linked on the template level.

This macro is used in the filter of attribute and disk discoveries. It can be overridden on the host or linked on the template level.

Discovery SMART disks.

This metric will contain smartctl errors.

Preprocessing

• JSON Path: $.error

• Discard unchanged with heartbeat: 1h

Preprocessing

• JSON Path: $.model_name

• Discard unchanged with heartbeat: 6h

Preprocessing

• JSON Path: $.serial_number

• Discard unchanged with heartbeat: 6h

The disk is passed the SMART self-test or not.

Preprocessing

• JSON Path: $.self_test_passed

• Discard unchanged with heartbeat: 6h

Current drive temperature.

Preprocessing

• JSON Path: $.temperature

• Discard unchanged with heartbeat: 6h

Count of hours in power-on state. The raw value of this attribute

shows total count of hours (or minutes, or seconds, depending on manufacturer)

in power-on state. "By default, the total expected lifetime of a hard disk

in perfect condition is defined as 5 years (running every day and night on

all days). This is equal to 1825 days in 24/7 mode or 43800 hours." On some

pre-2005 drives, this raw value may advance erratically and/or "wrap around"

(reset to zero periodically). https://en.wikipedia.org/wiki/S.M.A.R.T.#KnownATAS.M.A.R.T._attributes

Preprocessing

• JSON Path: $.power_on_time

• Discard unchanged with heartbeat: 6h

Contains a vendor specific estimate of the percentage of NVM subsystem

life used based on the actual usage and the manufacturer's prediction of NVM

life. A value of 100 indicates that the estimated endurance of the NVM in

the NVM subsystem has been consumed, but may not indicate an NVM subsystem

failure. The value is allowed to exceed 100. Percentages greater than 254

shall be represented as 255. This value shall be updated once per power-on

hour (when the controller is not in a sleep state).

Preprocessing

• JSON Path: $.percentage_used

• Discard unchanged with heartbeat: 6h

This field indicates critical warnings for the state of the controller.

Preprocessing

• JSON Path: $.critical_warning

• Discard unchanged with heartbeat: 6h

Contains the number of occurrences where the controller detected

an unrecovered data integrity error. Errors such as uncorrectable ECC, CRC

checksum failure, or LBA tag mismatch are included in this field.

Preprocessing

• JSON Path: $.media_errors

• Discard unchanged with heartbeat: 6h

The exit statuses of smartctl are defined by a bitmask but in decimal value. The eight different bits in the exit status have the following meanings for ATA disks; some of these values may also be returned for SCSI disks.

Bit 0: Command line did not parse.

Bit 1: Device open failed, device did not return an IDENTIFY DEVICE structure, or device is in a low-power mode (see '-n' option above).

Bit 2: Some SMART or other ATA command to the disk failed, or there was a checksum error in a SMART data structure (see '-b' option above).

Bit 3: SMART status check returned "DISK FAILING".

Bit 4: We found prefail Attributes <= threshold.

Bit 5: SMART status check returned "DISK OK" but we found that some (usage or prefail) Attributes have been <= threshold at some time in the past.

Bit 6: The device error log contains records of errors.

Bit 7: The device self-test log contains records of errors. [ATA only] Failed self-tests outdated by a newer successful extended self-test are ignored.

Preprocessing

• JSON Path: $.exit_status

• Discard unchanged with heartbeat: 6h

Stores data related to the rate of hardware read errors that occurred when reading data from a disk surface. The raw value has different structure for different vendors and is often not meaningful as a decimal number. For some drives, this number may increase during normal operation without necessarily signifying errors.

Preprocessing

• JSON Path: $.raw_read_error_rate.value

• Discard unchanged with heartbeat: 6h

Average time of spindle spin up (from zero RPM to fully operational [milliseconds]).

Preprocessing

• JSON Path: $.spin_up_time.value

• Discard unchanged with heartbeat: 6h

A tally of spindle start/stop cycles. The spindle turns on, and hence the count is increased, both when the hard disk is turned on after having before been turned entirely off (disconnected from power source) and when the hard disk returns from having previously been put to sleep mode.

Preprocessing

• JSON Path: $.start_stop_count.value

• Discard unchanged with heartbeat: 6h

This attribute indicates the count of full hard disk power on/off cycles.

Preprocessing

• JSON Path: $.power_cycle_count.value

• Discard unchanged with heartbeat: 6h

The count of errors that could not be recovered using hardware ECC.

Preprocessing

• JSON Path: $.reported_uncorrect.value

• Discard unchanged with heartbeat: 6h

Rate of seek errors of the magnetic heads. If there is a partial failure in the mechanical positioning system, then seek errors will arise. Such a failure may be due to numerous factors, such as damage to a servo, or thermal widening of the hard disk. The raw value has different structure for different vendors and is often not meaningful as a decimal number. For some drives, this number may increase during normal operation without necessarily signifying errors.

Preprocessing

• JSON Path: $.seek_error_rate.value

• Discard unchanged with heartbeat: 6h

Percentage of used reserve blocks divided by total reserve blocks.

Preprocessing

• JSON Path: $.bad_block_rate.value

• Discard unchanged with heartbeat: 6h

The total number of flash program operation failures since the drive was deployed.

Preprocessing

• JSON Path: $.program_fail_count_chip.value

• Discard unchanged with heartbeat: 6h

Disk discovered attribute.

Preprocessing

• JSON Path: $.reallocated_sector_ct.value

• Discard unchanged with heartbeat: 6h

Device serial number has changed. Acknowledge to close the problem manually.

• SMART [{#NAME}]: Average disk temperature is critical

Command line did not parse.

Device open failed, device did not return an IDENTIFY DEVICE structure, or device is in a low-power mode.

Some SMART or other ATA command to the disk failed,
or there was a checksum error in a SMART data structure.

SMART status check returned "DISK FAILING".

We found prefail Attributes <= threshold.

SMART status check returned "DISK OK" but we found that some (usage
or prefail) Attributes have been <= threshold at some time in the past.

The device error log contains records of errors.

The device self-test log contains records of errors. [ATA only]
Failed self-tests outdated by a newer successful extended self-test are ignored.

This macro is used for trigger expression. It can be overridden on the host or linked on the template level.

This macro is used for trigger expression. It can be overridden on the host or linked on the template level.

This macro is used in the filter of attribute and disk discoveries. It can be overridden on the host or linked on the template level.

This macro is used in the filter of attribute and disk discoveries. It can be overridden on the host or linked on the template level.

Discovery SMART disks.

This metric will contain smartctl errors.

Preprocessing

• JSON Path: $.error

• Discard unchanged with heartbeat: 1h

Preprocessing

• JSON Path: $.model_name

• Discard unchanged with heartbeat: 6h

Preprocessing

• JSON Path: $.serial_number

• Discard unchanged with heartbeat: 6h

The disk is passed the SMART self-test or not.

Preprocessing

• JSON Path: $.self_test_passed

• Discard unchanged with heartbeat: 6h

Current drive temperature.

Preprocessing

• JSON Path: $.temperature

• Discard unchanged with heartbeat: 6h

Count of hours in power-on state. The raw value of this attribute

shows total count of hours (or minutes, or seconds, depending on manufacturer)

in power-on state. "By default, the total expected lifetime of a hard disk

in perfect condition is defined as 5 years (running every day and night on

all days). This is equal to 1825 days in 24/7 mode or 43800 hours." On some

pre-2005 drives, this raw value may advance erratically and/or "wrap around"

(reset to zero periodically). https://en.wikipedia.org/wiki/S.M.A.R.T.#KnownATAS.M.A.R.T._attributes

Preprocessing

• JSON Path: $.power_on_time

• Discard unchanged with heartbeat: 6h

Contains a vendor specific estimate of the percentage of NVM subsystem

life used based on the actual usage and the manufacturer's prediction of NVM

life. A value of 100 indicates that the estimated endurance of the NVM in

the NVM subsystem has been consumed, but may not indicate an NVM subsystem

failure. The value is allowed to exceed 100. Percentages greater than 254

shall be represented as 255. This value shall be updated once per power-on

hour (when the controller is not in a sleep state).

Preprocessing

• JSON Path: $.percentage_used

• Discard unchanged with heartbeat: 6h

This field indicates critical warnings for the state of the controller.

Preprocessing

• JSON Path: $.critical_warning

• Discard unchanged with heartbeat: 6h

Contains the number of occurrences where the controller detected

an unrecovered data integrity error. Errors such as uncorrectable ECC, CRC

checksum failure, or LBA tag mismatch are included in this field.

Preprocessing

• JSON Path: $.media_errors

• Discard unchanged with heartbeat: 6h

The exit statuses of smartctl are defined by a bitmask but in decimal value. The eight different bits in the exit status have the following meanings for ATA disks; some of these values may also be returned for SCSI disks.

Bit 0: Command line did not parse.

Bit 1: Device open failed, device did not return an IDENTIFY DEVICE structure, or device is in a low-power mode (see '-n' option above).

Bit 2: Some SMART or other ATA command to the disk failed, or there was a checksum error in a SMART data structure (see '-b' option above).

Bit 3: SMART status check returned "DISK FAILING".

Bit 4: We found prefail Attributes <= threshold.

Bit 5: SMART status check returned "DISK OK" but we found that some (usage or prefail) Attributes have been <= threshold at some time in the past.

Bit 6: The device error log contains records of errors.

Bit 7: The device self-test log contains records of errors. [ATA only] Failed self-tests outdated by a newer successful extended self-test are ignored.

Preprocessing

• JSON Path: $.exit_status

• Discard unchanged with heartbeat: 6h

Stores data related to the rate of hardware read errors that occurred when reading data from a disk surface. The raw value has different structure for different vendors and is often not meaningful as a decimal number. For some drives, this number may increase during normal operation without necessarily signifying errors.

Preprocessing

• JSON Path: $.raw_read_error_rate.value

• Discard unchanged with heartbeat: 6h

Average time of spindle spin up (from zero RPM to fully operational [milliseconds]).

Preprocessing

• JSON Path: $.spin_up_time.value

• Discard unchanged with heartbeat: 6h

A tally of spindle start/stop cycles. The spindle turns on, and hence the count is increased, both when the hard disk is turned on after having before been turned entirely off (disconnected from power source) and when the hard disk returns from having previously been put to sleep mode.

Preprocessing

• JSON Path: $.start_stop_count.value

• Discard unchanged with heartbeat: 6h

This attribute indicates the count of full hard disk power on/off cycles.

Preprocessing

• JSON Path: $.power_cycle_count.value

• Discard unchanged with heartbeat: 6h

The count of errors that could not be recovered using hardware ECC.

Preprocessing

• JSON Path: $.reported_uncorrect.value

• Discard unchanged with heartbeat: 6h

Rate of seek errors of the magnetic heads. If there is a partial failure in the mechanical positioning system, then seek errors will arise. Such a failure may be due to numerous factors, such as damage to a servo, or thermal widening of the hard disk. The raw value has different structure for different vendors and is often not meaningful as a decimal number. For some drives, this number may increase during normal operation without necessarily signifying errors.

Preprocessing

• JSON Path: $.seek_error_rate.value

• Discard unchanged with heartbeat: 6h

Percentage of used reserve blocks divided by total reserve blocks.

Preprocessing

• JSON Path: $.bad_block_rate.value

• Discard unchanged with heartbeat: 6h

The total number of flash program operation failures since the drive was deployed.

Preprocessing

• JSON Path: $.program_fail_count_chip.value

• Discard unchanged with heartbeat: 6h

Disk discovered attribute.

Preprocessing

• JSON Path: $.reallocated_sector_ct.value

• Discard unchanged with heartbeat: 6h

Device serial number has changed. Acknowledge to close the problem manually.

• SMART [{#NAME}]: Average disk temperature is critical

Command line did not parse.

Device open failed, device did not return an IDENTIFY DEVICE structure, or device is in a low-power mode.

Some SMART or other ATA command to the disk failed,
or there was a checksum error in a SMART data structure.

SMART status check returned "DISK FAILING".

We found prefail Attributes <= threshold.

SMART status check returned "DISK OK" but we found that some (usage
or prefail) Attributes have been <= threshold at some time in the past.

The device error log contains records of errors.

The device self-test log contains records of errors. [ATA only]
Failed self-tests outdated by a newer successful extended self-test are ignored.

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

MIB: UCD-SNMP-MIB

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

Memory used by kernel buffers (Buffers in /proc/meminfo).

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

Memory used by the page cache and slabs (Cached and Slab in /proc/meminfo).

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

The total memory expressed in bytes.

Preprocessing

• Custom multiplier: 1024

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

MIB: UCD-SNMP-MIB

The total amount of swap space configured for this host.

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

The amount of swap space currently unused or available.

Preprocessing

• Custom multiplier: 1024

The free space of the swap volume/file expressed in %.

The system is running out of free memory.

• Linux: Lack of available memory

If there is no swap configured, this trigger is ignored.

• Linux: Lack of available memory
• Linux: High memory utilization

This macro is used in block devices discovery. Can be overridden on the host or linked template level

This macro is used in block devices discovery. Can be overridden on the host or linked template level

Block devices are discovered from UCD-DISKIO-MIB::diskIOTable (http://net-snmp.sourceforge.net/docs/mibs/ucdDiskIOMIB.html#diskIOTable)

MIB: UCD-DISKIO-MIB

The number of read accesses from this device since boot.

Preprocessing

• Change per second

MIB: UCD-DISKIO-MIB

The number of write accesses from this device since boot.

Preprocessing

• Change per second

MIB: UCD-DISKIO-MIB

The 1 minute average load of disk (%)

Load per CPU considered sustainable. Tune if needed.

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: HOST-RESOURCES-MIB

Count the number of CPU cores by counting number of cores discovered in hrProcessorTable using LLD

Preprocessing

• JavaScript: The text is too long. Please see the template.

Preprocessing

• Change per second

Preprocessing

• Change per second

The load average per CPU is too high. The system may be slow to respond.

This discovery will create set of per core CPU metrics from UCD-SNMP-MIB, using {#CPU.COUNT} in preprocessing. That's the only reason why LLD is used.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The time the CPU has spent doing nothing.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The time the CPU has spent running the kernel and its processes.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The time the CPU has spent running users' processes that are not niced.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The amount of time the CPU has been servicing software interrupts.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The time the CPU has spent running users' processes that have been niced.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The amount of time the CPU has been waiting for I/O to complete.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The amount of time the CPU has been servicing hardware interrupts.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Guest time - the time spent on running a virtual CPU for a guest operating system.

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing

• Change per second

• JavaScript: The text is too long. Please see the template.

The CPU utilization expressed in %.

Preprocessing

• JavaScript: //Calculate utilization<br>return (100 - value)

The CPU utilization is too high. The system might be slow to respond.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

HOST-RESOURCES-MIB::hrStorage discovery with storage filter

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing

• Custom multiplier: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main storage allocated to a buffer pool might be modified or the amount of disk space allocated to virtual storage might be modified.

Preprocessing

• Custom multiplier: {#ALLOC_UNITS}

The space utilization expressed in % for {#FSNAME}.

MIB: UCD-SNMP-MIB

If having problems collecting this item make sure access to UCD-SNMP-MIB is allowed.

Preprocessing

• JavaScript: return (100-value);

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} limit.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} limit.

• {#FSNAME}: Disk space is critically low

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

• {#FSNAME}: Running out of free inodes

The CPU load per core is considered sustainable. If necessary, it can be tuned.

Preprocessing

• Discard unchanged with heartbeat: 1d

The CPU utilization expressed in %.

Preprocessing

• JavaScript: //Calculate utilization<br>return (100 - value)

The time the CPU has spent doing nothing.

The time the CPU has spent running the kernel and its processes.

The time the CPU has spent running users' processes that are not niced.

The time the CPU has spent running users' processes that have been niced.

The amount of time the CPU has been waiting for I/O to complete.

The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

The amount of time the CPU has been servicing hardware interrupts.

The amount of time the CPU has been servicing software interrupts.

Guest time - the time spent on running a virtual CPU for a guest operating system.

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing

• Change per second

Preprocessing

• Change per second

The load average per CPU is too high. The system may be slow to respond.

The CPU utilization is too high. The system might be slow to respond.

• Linux: Load average is too high

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

The critical threshold of the filesystem metadata utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

The discovery of mounted filesystems with different types.

Used storage in bytes

Total space in bytes

The space utilization expressed in % for {#FSNAME}.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} limit.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} limit.

• {#FSNAME}: Disk space is critically low

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

• {#FSNAME}: Running out of free inodes

This macro is used as a threshold in the memory utilization trigger.

This macro is used as a threshold in the memory available trigger.

The percentage of used memory is calculated as 100-pavailable.

Preprocessing

• JavaScript: return (100-value);

The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

The total memory expressed in bytes.

The available memory:

- in Linux - available = free + buffers + cache;

- on other platforms calculation may vary.

See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

The total space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

The system is running out of free memory.

• Linux: Lack of available memory

If there is no swap configured, this trigger is ignored.

• Linux: Lack of available memory
• Linux: High memory utilization

The average response time (in ms) of disk read before the trigger would fire.

The average response time (in ms) of disk write before the trigger would fire.

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

The contents of get /sys/block/{#DEVNAME}/stat to get the disk statistics.

Preprocessing

• JavaScript: return JSON.stringify(value.trim().split(/ +/));

r/s (read operations per second) - the number (after merges) of read requests completed per second for the device.

Preprocessing

• JSON Path: $[0]

• Change per second

w/s (write operations per second) - the number (after merges) of write requests completed per second for the device.

Preprocessing

• JSON Path: $[4]

• Change per second

The rate of total read time counter; used in r_await calculation.

Preprocessing

• JSON Path: $[3]

• Change per second

• Custom multiplier: 0.001

The rate of total write time counter; used in w_await calculation.

Preprocessing

• JSON Path: $[7]

• Change per second

• Custom multiplier: 0.001

This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.

This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

Preprocessing

• JSON Path: $[10]

• Change per second

• Custom multiplier: 0.001

This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests.

Preprocessing

• JSON Path: $[9]

• Change per second

• Custom multiplier: 0.1

This trigger might indicate the disk {#DEVNAME} saturation.

It filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

This macro is used as a threshold in the interface utilization trigger.

The discovery of network interfaces.

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

Preprocessing

• Change per second

Preprocessing

• Change per second

Preprocessing

• Change per second

Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt

Preprocessing

• JavaScript: The text is too long. Please see the template.

It indicates the interface protocol type as a decimal value.

See include/uapi/linux/if_arp.h for all possible values.

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net

Preprocessing

• Discard unchanged with heartbeat: 1d

It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec.

This attribute is only valid for the interfaces that implement the ethtool get_link_ksettings method (mostly Ethernet).

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net

Preprocessing

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}: Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}: Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}: Link down

The system uptime expressed in the following format: "N days, hh:mm:ss".

Preprocessing

• Discard unchanged with heartbeat: 1h

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 12h

The information as normally returned by uname -a.

Preprocessing

• Discard unchanged with heartbeat: 12h

The number of users who are currently logged in.

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Discard unchanged with heartbeat: 1d

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1h

Preprocessing

• Discard unchanged with heartbeat: 1d

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The host uptime is less than 10 minutes.

The name of the system has changed. Acknowledge to close the problem manually.

• Linux: Getting closer to process limit

• Linux: System name has changed
• Linux: Operating system description has changed

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Linux: System name has changed

The CPU load per core is considered sustainable. If necessary, it can be tuned.

Preprocessing

• Discard unchanged with heartbeat: 1d

The CPU utilization expressed in %.

Preprocessing

• JavaScript: //Calculate utilization<br>return (100 - value)

The time the CPU has spent doing nothing.

The time the CPU has spent running the kernel and its processes.

The time the CPU has spent running users' processes that are not niced.

The time the CPU has spent running users' processes that have been niced.

The amount of time the CPU has been waiting for I/O to complete.

The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

The amount of time the CPU has been servicing hardware interrupts.

The amount of time the CPU has been servicing software interrupts.

Guest time - the time spent on running a virtual CPU for a guest operating system.

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing

• Change per second

Preprocessing

• Change per second

The load average per CPU is too high. The system may be slow to respond.

The CPU utilization is too high. The system might be slow to respond.

• Linux: Load average is too high

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

The critical threshold of the filesystem metadata utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

The discovery of mounted filesystems with different types.

Used storage in bytes

Total space in bytes

The space utilization expressed in % for {#FSNAME}.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} limit.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} limit.

• {#FSNAME}: Disk space is critically low

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

It may become impossible to write to a disk if there are no index nodes left.
The following error messages may be returned as symptoms, even though the free space is available:
- 'No space left on device';
- 'Disk is full'.

• {#FSNAME}: Running out of free inodes

This macro is used as a threshold in the memory utilization trigger.

This macro is used as a threshold in the memory available trigger.

The percentage of used memory is calculated as 100-pavailable.

Preprocessing

• JavaScript: return (100-value);

The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

The total memory expressed in bytes.

The available memory:

- in Linux - available = free + buffers + cache;

- on other platforms calculation may vary.

See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

The total space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

The system is running out of free memory.

• Linux: Lack of available memory

If there is no swap configured, this trigger is ignored.

• Linux: Lack of available memory
• Linux: High memory utilization

The average response time (in ms) of disk read before the trigger would fire.

The average response time (in ms) of disk write before the trigger would fire.

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

The contents of get /sys/block/{#DEVNAME}/stat to get the disk statistics.

Preprocessing

• JavaScript: return JSON.stringify(value.trim().split(/ +/));

r/s (read operations per second) - the number (after merges) of read requests completed per second for the device.

Preprocessing

• JSON Path: $[0]

• Change per second

w/s (write operations per second) - the number (after merges) of write requests completed per second for the device.

Preprocessing

• JSON Path: $[4]

• Change per second

The rate of total read time counter; used in r_await calculation.

Preprocessing

• JSON Path: $[3]

• Change per second

• Custom multiplier: 0.001

The rate of total write time counter; used in w_await calculation.

Preprocessing

• JSON Path: $[7]

• Change per second

• Custom multiplier: 0.001

This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.

This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

Preprocessing

• JSON Path: $[10]

• Change per second

• Custom multiplier: 0.001

This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests.

Preprocessing

• JSON Path: $[9]

• Change per second

• Custom multiplier: 0.1

This trigger might indicate the disk {#DEVNAME} saturation.

It filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

This macro is used as a threshold in the interface utilization trigger.

The discovery of network interfaces.

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

Preprocessing

• Change per second

Preprocessing

• Change per second

Preprocessing

• Change per second

Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt

Preprocessing

• JavaScript: The text is too long. Please see the template.

It indicates the interface protocol type as a decimal value.

See include/uapi/linux/if_arp.h for all possible values.

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net

Preprocessing

• Discard unchanged with heartbeat: 1d

It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec.

This attribute is only valid for the interfaces that implement the ethtool get_link_ksettings method (mostly Ethernet).

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net

Preprocessing

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}: Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}: Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}: Link down

The upper threshold for difference of system time.

The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping.

The system uptime expressed in the following format: "N days, hh:mm:ss".

Preprocessing

• Discard unchanged with heartbeat: 1h

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 12h

The information as normally returned by uname -a.

Preprocessing

• Discard unchanged with heartbeat: 12h

The number of users who are currently logged in.

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Discard unchanged with heartbeat: 1d

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1h

Preprocessing

• Discard unchanged with heartbeat: 1d

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The host uptime is less than 10 minutes.

The host's system time is different from Zabbix server time.

The name of the system has changed. Acknowledge to close the problem manually.

• Linux: Getting closer to process limit

• Linux: System name has changed
• Linux: Operating system description has changed

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Linux: System name has changed

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default

Ignore notPresent(6)

Ignore down(2) administrative status

Discovering interfaces from IF-MIB.

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

MIB: IF-MIB

The total number of octets received on the interface,including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and another times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing

• Discard unchanged with heartbeat: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range ofn-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}({#IFALIAS}): Link down

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default

Ignore notPresent(6)

Ignore down(2) administrative status

Discovering interfaces from IF-MIB.

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

MIB: IF-MIB

The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• Change per second

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing

• Discard unchanged with heartbeat: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range ofn-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.
3. {TEMPLATE_NAME:METRIC.diff()}=1 - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

The utilization of the network interface is close to its estimated maximum bandwidth.

• Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Interface {#IFNAME}({#IFALIAS}): Link down

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default

Ignore notPresent(6)

Ignore down(2) administrative status

Discovering interfaces from IF-MIB.

Preprocessing

• Discard unchanged with heartbeat: 4h