-

-

-

-

-

-

This macro is used in memory discovery. Can be overridden on the host or linked template level.

This macro is used in memory discovery. Can be overridden on the host or linked template level if you need to filter out results.

This macro is used in memory discovery. Can be overridden on the host or linked template level.

This macro is used in memory discovery. Can be overridden on the host or linked template level if you need to filter out results.

The warning threshold of the "Physical memory: Memory utilization" item.

-

Ignore down(2) administrative status

-

-

-

-

-

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default

-

Ignore notPresent(6)

-

-

-

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

-

-

HOST-RESOURCES-MIB::hrStorage discovery with memory filter

Filter:

- {#MEMTYPE} MATCHESREGEX {$MEMORY.TYPE.MATCHES}

- {#MEMTYPE} NOTMATCHESREGEX {$MEMORY.TYPE.NOT_MATCHES}

- {#MEMNAME} MATCHESREGEX {$MEMORY.NAME.MATCHES}

- {#MEMNAME} NOTMATCHESREGEX {$MEMORY.NAME.NOT_MATCHES}

Discovering interfaces from IF-MIB.

Filter:

- {#IFADMINSTATUS} MATCHESREGEX {$NET.IF.IFADMINSTATUS.MATCHES}

- {#IFADMINSTATUS} NOTMATCHESREGEX {$NET.IF.IFADMINSTATUS.NOT_MATCHES}

- {#IFOPERSTATUS} MATCHESREGEX {$NET.IF.IFOPERSTATUS.MATCHES}

- {#IFOPERSTATUS} NOTMATCHESREGEX {$NET.IF.IFOPERSTATUS.NOT_MATCHES}

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHESREGEX {$NET.IF.IFNAME.NOT_MATCHES}

- {#IFDESCR} MATCHESREGEX {$NET.IF.IFDESCR.MATCHES}

- {#IFDESCR} NOTMATCHESREGEX {$NET.IF.IFDESCR.NOT_MATCHES}

- {#IFALIAS} MATCHESREGEX {$NET.IF.IFALIAS.MATCHES}

- {#IFALIAS} NOTMATCHESREGEX {$NET.IF.IFALIAS.NOT_MATCHES}

- {#IFTYPE} MATCHESREGEX {$NET.IF.IFTYPE.MATCHES}

- {#IFTYPE} NOTMATCHESREGEX {$NET.IF.IFTYPE.NOT_MATCHES}

HOST-RESOURCES-MIB::hrStorage discovery with storage filter.

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

MIB: HOST-RESOURCES-MIB

The average, over the last minute, of the percentage of time that processors was not idle.

Implementations may approximate this one minute smoothing period if necessary.

Preprocessing:

- JSONPATH: $..['{#CPU.UTIL}'].avg()

The item is used to collect all SNMP traps unmatched by other snmptrap items

MIB: SNMPv2-MIB

The physical location of this node (e.g., `telephone closet, 3rd floor'). If the location is unknown, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

The textual identification of the contact person for this managed node, together with information on how to contact this person. If no contact information is known, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

The vendor's authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous means for determiningwhat kind of box' is being managed. For example, if vendorFlintstones, Inc.' was assigned the subtree1.3.6.1.4.1.4242, it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its `Fred Router'.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

An administratively-assigned name for this managed node.By convention, this is the node's fully-qualified domain name. If the name is unknown, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

A textual description of the entity. This value should

include the full name and version identification of the system's hardware type, software operating-system, and

networking software.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main memory allocated to a buffer pool might be modified or the amount of disk space allocated to virtual memory might be modified.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

Memory utilization in %.

Expression:

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

MIB: IF-MIB

The total number of octets received on the interface,including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and atother times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range ofn-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing:

- MULTIPLIER: 1000000

- DISCARDUNCHANGEDHEARTBEAT: 1h

MIB: SNMPv2-MIB

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Preprocessing:

- MULTIPLIER: 0.01

MIB: HOST-RESOURCES-MIB

The amount of time since this host was last initialized. Note that this is different from sysUpTime in the SNMPv2-MIB [RFC1907] because sysUpTime is the uptime of the network management portion of the system.

Preprocessing:

- CHECKNOTSUPPORTED

⛔️ON_FAIL: CUSTOM_VALUE -> 0

- MULTIPLIER: 0.01

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible value:

0 - not available

1 - available

2 - unknown

-

-

-

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main storage allocated to a buffer pool might be modified or the amount of disk space allocated to virtual storage might be modified.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

Space utilization in % for {#FSNAME}

Expression:

CPU utilization is too high. The system might be slow to respond.

System name has changed. Ack to close.

Manual close: YES

The system is running out of free memory.

This trigger expression works as follows:

1. Can be triggered if operations status is down.

2. {$IFCONTROL:"{#IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status was up(1) sometime before. (So, do not fire 'ethernal off' interfaces.)

WARNING: if closed manually - won't fire again on next poll, because of .diff.

Recovery expression:

Manual close: YES

The network interface utilization is close to its estimated maximum bandwidth.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

Uptime is less than 10 minutes.

Manual close: YES

Depends on:

- No SNMP data collection

SNMP is not available for polling. Please check device connectivity and SNMP settings.

Depends on:

- Unavailable by ICMP ping

Last three attempts returned timeout. Please check device connectivity.

-

Depends on:

- Unavailable by ICMP ping

-

Depends on:

- High ICMP ping loss

- Unavailable by ICMP ping

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Depends on:

- {#FSNAME}: Disk space is critically low

No data timeout for active agents. Consider to keep it relatively high.

Timeout after which agent is considered unavailable.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The critical threshold of the CPU utilization in %.

-

-

-

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory util item.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

The warning threshold of the minimum free swap.

The threshold for difference of system time in seconds.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

Disk read average response time (in s) before the trigger would fire.

The warning threshold of disk time utilization in percent.

Disk write average response time (in s) before the trigger would fire.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem utilization in percent.

The warning threshold of the filesystem utilization in percent.

Discovery of file systems of different types.

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

- {#FSDRIVETYPE} MATCHESREGEX {$VFS.FS.FSDRIVETYPE.MATCHES}

- {#FSDRIVETYPE} NOTMATCHES_REGEX {$VFS.FS.FSDRIVETYPE.NOT_MATCHES}

Discovery of installed network interfaces.

Preprocessing:

- JAVASCRIPT: The text is too long. Please see the template.

- DISCARDUNCHANGEDHEARTBEAT: 1h

Filter:

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHESREGEX {$NET.IF.IFNAME.NOT_MATCHES}

- {#IFDESCR} MATCHESREGEX {$NET.IF.IFDESCR.MATCHES}

- {#IFDESCR} NOTMATCHESREGEX {$NET.IF.IFDESCR.NOT_MATCHES}

- {#IFALIAS} MATCHESREGEX {$NET.IF.IFALIAS.MATCHES}

- {#IFALIAS} NOTMATCHES_REGEX {$NET.IF.IFALIAS.NOT_MATCHES}

Discovery of installed physical disks.

Preprocessing:

- STRREPLACE: {#INSTANCE} {#DEVNAME}

Filter:

- {#DEVNAME} MATCHESREGEX {$VFS.DEV.DEVNAME.MATCHES}

- {#DEVNAME} NOTMATCHESREGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

Discovery of Windows services of different types as defined in template's macros.

Filter:

- {#SERVICE.NAME} MATCHESREGEX {$SERVICE.NAME.MATCHES}

- {#SERVICE.NAME} NOTMATCHESREGEX {$SERVICE.NAME.NOT_MATCHES}

- {#SERVICE.STARTUPNAME} MATCHESREGEX {$SERVICE.STARTUPNAME.MATCHES}

- {#SERVICE.STARTUPNAME} NOTMATCHESREGEX {$SERVICE.STARTUPNAME.NOT_MATCHES}

CPU utilization in %.

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent

executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt

Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode

functions of the Windows® Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure

calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a

component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is

sustained, there may be a processor bottleneck or an application or hardware related issue that can

significantly diminish overall system performance.

The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing

in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue

and are waiting to be executed.

Used storage in Bytes

Total space in Bytes

Space utilization in % for {#FSNAME}

System local time of the host.

System host name.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

System description of the host.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

The number of processes.

The number of threads used by all running processes.

Operating system architecture of the host.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

Used memory in Bytes.

Total memory in Bytes.

Memory utilization in %.

Expression:

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes,

Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays

the last observed value only; it is not an average.

The free space of swap volume/file in bytes.

Expression:

The free space of swap volume/file in percent.

Preprocessing:

- JAVASCRIPT: return (100 - value)

The used space of swap volume/file in percent.

The total space of swap volume/file in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less

than 5,000, there may well be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages

faulted per second because only one page is faulted in each fault operation, hence this is also equal

to the number of page fault operations. This counter includes both hard faults (those that require

disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most

processors can handle large numbers of soft faults without significant consequence. However, hard faults,

which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects

that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).

A typical Event ID 2019 is recorded in the system event log.

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

Availability of active checks on the host. The value of this item corresponds to availability icons in the host list.

Possible value:

0 - unknown

1 - available

2 - not available

Incoming traffic on the network interface.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

Outgoing traffic on the network interface.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

The number of incoming packets dropped on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of outgoing packets dropped on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of incoming packets with errors on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of outgoing packets with errors on the network interface.

Preprocessing:

- CHANGEPERSECOND

Estimated bandwidth of the network interface if any.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].Speed.first()

⛔️ONFAIL: CUSTOM_VALUE -> 0

- JAVASCRIPT: return (value=='9223372036854775807' ? 0 : value)

- DISCARDUNCHANGED_HEARTBEAT: 1h

The type of the network interface.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

- DISCARDUNCHANGEDHEARTBEAT: 1d

The operational status of the network interface.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

System uptime in 'N days, hh:mm:ss' format.

The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.

Rate of read operations on the disk.

Rate of write operations on the disk.

Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing:

- JAVASCRIPT: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

Raw data of win32_networkadapter.

- DISCARDUNCHANGED_HEARTBEAT: 1h

CPU utilization is too high. The system might be slow to respond.

"The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Depends on:

- High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

Depends on:

- CPU interrupt time is too high

- High CPU utilization

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

Depends on:

- High CPU utilization

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Depends on:

- {#FSLABEL}({#FSNAME}): Disk space is critically low

The host system time is different from the Zabbix server time.

Manual close: YES

System name has changed. Ack to close.

Manual close: YES

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

Depends on:

- High memory utilization

The Memory Free System Page Table Entries is less than {$MEM.PAGETABLECRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.

Depends on:

- High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

Depends on:

- High memory utilization

Active checks are considered unavailable. Agent is not sending heartbeat for prolonged time.

The network interface utilization is close to its estimated maximum bandwidth.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:

1. Can be triggered if operations status is down.

2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important.

No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2).

WARNING: if closed manually - won't fire again on next poll, because of .diff.

Recovery expression:

Manual close: YES

The service has a state other than "Running" for the last three times.

The device uptime is less than 10 minutes.

Manual close: YES

For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as time threshold.

Manual close: YES

The disk appears to be under heavy load

Manual close: YES

Depends on:

- {#DEVNAME}: Disk read request responses are too high

- {#DEVNAME}: Disk write request responses are too high

This trigger might indicate disk {#DEVNAME} saturation.

Manual close: YES

This trigger might indicate disk {#DEVNAME} saturation.

Manual close: YES

Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode).

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The critical threshold of the CPU utilization in %.

-

-

-

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory util item.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

This macro is used in Service discovery. Can be overridden on the host or linked template level.

The warning threshold of the minimum free swap.

The threshold for difference of system time in seconds.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

This macro is used in physical disks discovery. Can be overridden on the host or linked template level.

Disk read average response time (in s) before the trigger would fire.

The warning threshold of disk time utilization in percent.

Disk write average response time (in s) before the trigger would fire.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem utilization in percent.

The warning threshold of the filesystem utilization in percent.

Discovery of file systems of different types.

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

- {#FSDRIVETYPE} MATCHESREGEX {$VFS.FS.FSDRIVETYPE.MATCHES}

- {#FSDRIVETYPE} NOTMATCHES_REGEX {$VFS.FS.FSDRIVETYPE.NOT_MATCHES}

Discovery of installed network interfaces.

Preprocessing:

- JAVASCRIPT: The text is too long. Please see the template.

- DISCARDUNCHANGEDHEARTBEAT: 1h

Filter:

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHESREGEX {$NET.IF.IFNAME.NOT_MATCHES}

- {#IFDESCR} MATCHESREGEX {$NET.IF.IFDESCR.MATCHES}

- {#IFDESCR} NOTMATCHESREGEX {$NET.IF.IFDESCR.NOT_MATCHES}

- {#IFALIAS} MATCHESREGEX {$NET.IF.IFALIAS.MATCHES}

- {#IFALIAS} NOTMATCHES_REGEX {$NET.IF.IFALIAS.NOT_MATCHES}

Discovery of installed physical disks.

Preprocessing:

- STRREPLACE: {#INSTANCE} {#DEVNAME}

Filter:

- {#DEVNAME} MATCHESREGEX {$VFS.DEV.DEVNAME.MATCHES}

- {#DEVNAME} NOTMATCHESREGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

Discovery of Windows services of different types as defined in template's macros.

Filter:

- {#SERVICE.NAME} MATCHESREGEX {$SERVICE.NAME.MATCHES}

- {#SERVICE.NAME} NOTMATCHESREGEX {$SERVICE.NAME.NOT_MATCHES}

- {#SERVICE.STARTUPNAME} MATCHESREGEX {$SERVICE.STARTUPNAME.MATCHES}

- {#SERVICE.STARTUPNAME} NOTMATCHESREGEX {$SERVICE.STARTUPNAME.NOT_MATCHES}

CPU utilization in %.

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent

executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt

Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode

functions of the Windows® Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure

calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a

component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is

sustained, there may be a processor bottleneck or an application or hardware related issue that can

significantly diminish overall system performance.

The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing

in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue

and are waiting to be executed.

Used storage in Bytes

Total space in Bytes

Space utilization in % for {#FSNAME}

System local time of the host.

System host name.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

System description of the host.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

The number of processes.

The number of threads used by all running processes.

Operating system architecture of the host.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

Used memory in Bytes.

Total memory in Bytes.

Memory utilization in %.

Expression:

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes,

Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays

the last observed value only; it is not an average.

The free space of swap volume/file in bytes.

Expression:

The free space of swap volume/file in percent.

Preprocessing:

- JAVASCRIPT: return (100 - value)

The used space of swap volume/file in percent.

The total space of swap volume/file in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less

than 5,000, there may well be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages

faulted per second because only one page is faulted in each fault operation, hence this is also equal

to the number of page fault operations. This counter includes both hard faults (those that require

disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most

processors can handle large numbers of soft faults without significant consequence. However, hard faults,

which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects

that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).

A typical Event ID 2019 is recorded in the system event log.

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.

Incoming traffic on the network interface.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

Outgoing traffic on the network interface.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

The number of incoming packets dropped on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of outgoing packets dropped on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of incoming packets with errors on the network interface.

Preprocessing:

- CHANGEPERSECOND

The number of outgoing packets with errors on the network interface.

Preprocessing:

- CHANGEPERSECOND

Estimated bandwidth of the network interface if any.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].Speed.first()

⛔️ONFAIL: CUSTOM_VALUE -> 0

- JAVASCRIPT: return (value=='9223372036854775807' ? 0 : value)

- DISCARDUNCHANGED_HEARTBEAT: 1h

The type of the network interface.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

- DISCARDUNCHANGEDHEARTBEAT: 1d

The operational status of the network interface.

Preprocessing:

- JSONPATH: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

System uptime in 'N days, hh:mm:ss' format.

Monitoring agent availability status

Rate of read operations on the disk.

Rate of write operations on the disk.

Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing:

- JAVASCRIPT: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

Raw data of win32_networkadapter.

- DISCARDUNCHANGED_HEARTBEAT: 1h

CPU utilization is too high. The system might be slow to respond.

"The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."

The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

Depends on:

- High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

Depends on:

- CPU interrupt time is too high

- High CPU utilization

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

Depends on:

- High CPU utilization

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}.

- The disk will be full in less than 24 hours.

Manual close: YES

Depends on:

- {#FSLABEL}({#FSNAME}): Disk space is critically low

The host system time is different from the Zabbix server time.

Manual close: YES

System name has changed. Ack to close.

Manual close: YES

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

Depends on:

- High memory utilization

The Memory Free System Page Table Entries is less than {$MEM.PAGETABLECRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.

Depends on:

- High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

Depends on:

- High memory utilization

The network interface utilization is close to its estimated maximum bandwidth.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:

1. Can be triggered if operations status is down.

2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important.

No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2).

WARNING: if closed manually - won't fire again on next poll, because of .diff.

Recovery expression:

Manual close: YES

The service has a state other than "Running" for the last three times.

The device uptime is less than 10 minutes.

Manual close: YES

For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold.

Manual close: YES

The disk appears to be under heavy load

Manual close: YES

Depends on:

- {#DEVNAME}: Disk read request responses are too high

- {#DEVNAME}: Disk write request responses are too high

This trigger might indicate disk {#DEVNAME} saturation.

Manual close: YES

This trigger might indicate disk {#DEVNAME} saturation.

Manual close: YES

The timeout after which the agent is considered unavailable. It works only for the agents reachable from Zabbix server/proxy (in passive mode).

Discovery of different types of file systems as defined in the global regular expression "File systems for discovery".

Filter:

- {#FSTYPE} MATCHESREGEX @File systems for discovery

Overrides:

Skip metadata collection for dynamic FS
- {#FSTYPE} MATCHESREGEX `^(btrfs

The discovery of network interfaces as defined in the global regular expression "Network interfaces for discovery".

Filter:

- {#IFNAME} MATCHES_REGEX @Network interfaces for discovery

It could be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

The number of processes in a running state.

The total number of processes in any state.

-

-

Preprocessing:

- CHANGEPERSECOND

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

-

Preprocessing:

- CHANGEPERSECOND

The time the CPU has spent doing nothing.

The amount of time the CPU has been waiting for the I/O to complete.

The time the CPU has spent running the kernel and its processes.

The time the CPU has spent running users' processes that are not niced.

A host name of the system.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

-

-

-

The information as normally returned by the 'uname -a'.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

The number of users who are currently logged in.

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1h

The available memory is defined as free+cached+buffers memory.

-

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

Monitoring agent availability status

The agent always returns 1 for this item. It could be used in combination with nodata() for the availability check.

-

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

-

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

-

-

-

-

-

-

-

-

-

The OS spends significant time waiting for the I/O (input/output) operations. It could be an indicator of performance issues with the storage system.

-

It probably means that the systems requires more physical memory.

-

-

-

-

For passive checks only the availability of the agents and a host is used with {$AGENT.TIMEOUT} as the time threshold.

Manual close: YES

-

-

The timeout after which the agent is considered unavailable. It works only for the agents reachable from Zabbix server/proxy (in passive mode).

Discovery of different types of file systems as defined in the global regular expression "File systems for discovery".

Filter:

- {#FSTYPE} MATCHESREGEX @File systems for discovery

Overrides:

Skip metadata collection for dynamic FS
- {#FSTYPE} MATCHESREGEX `^(btrfs

The discovery of network interfaces as defined in the global regular expression "Network interfaces for discovery".

Filter:

- {#IFNAME} MATCHES_REGEX @Network interfaces for discovery

-

Preprocessing:

- CHANGEPERSECOND: ``

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

-

Preprocessing:

- CHANGEPERSECOND: ``

The time the CPU has spent doing nothing.

The amount of time the CPU has been servicing hardware interrupts.

The time the CPU has spent running users' processes that have been niced.

The time the CPU has spent running the kernel and its processes.

The time the CPU has spent running users' processes that are not niced.

-

-

-

-

-

-

A host name of the system.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

The information as normally returned by the 'uname -a'.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

-

-

-

The available memory is defined as free+cached+buffers memory.

-

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

The agent always returns 1 for this item. It could be used in combination with nodata() for the availability check.

-

Preprocessing:

- CHANGEPERSECOND: `</p><p>- MULTIPLIER:8`

-

Preprocessing:

- CHANGEPERSECOND: `</p><p>- MULTIPLIER:8`

It could be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

It could be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

The number of users who are currently logged in.

The number of processes in a running state.

The total number of processes in any state.

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1h

Monitoring the availability status of the agent.

-

-

-

-

-

-

It probably means that the systems requires more physical memory.

-

-

-

-

-

-

For passive checks only the availability of the agents and a host is used with {$AGENT.TIMEOUT} as the time threshold.

Manual close: YES

The timeout after which the agent is considered unavailable. It works only for the agents reachable from Zabbix server/proxy (in passive mode).

Discovery of different types of file systems as defined in the global regular expression "File systems for discovery".

Filter:

- {#FSTYPE} MATCHESREGEX @File systems for discovery

Overrides:

Skip metadata collection for dynamic FS
- {#FSTYPE} MATCHESREGEX `^(btrfs

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

-

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

-

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

-

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

The processor load is calculated as the system CPU load divided by the number of CPU cores.

A host name of the system.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

The information as normally returned by the 'uname -a'.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

The number of users who are currently logged in.

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1h

The available memory is defined as free+cached+buffers memory.

-

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

The agent always returns 1 for this item. It could be used in combination with nodata() for the availability check.

-

-

-

-

-

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

Monitoring the availability status of the agent.

-

-

-

-

-

-

-

-

-

-

For passive checks only the availability of the agents and a host is used with {$AGENT.TIMEOUT} as the time threshold.

Manual close: YES

-

-

-

-

-

-

Load per CPU considered sustainable. Tune if needed.

-

-

Ignore notPresent(6)

Ignore down(2) administrative status

-

-

-

-

-

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default

-

Ignore notPresent(6)

-

-

-

-

This macro is used in block devices discovery. Can be overridden on the host or linked template level

This macro is used in block devices discovery. Can be overridden on the host or linked template level

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

This macro is used in filesystems discovery. Can be overridden on the host or linked template level

-

-

-

-

Block devices are discovered from UCD-DISKIO-MIB::diskIOTable (http://net-snmp.sourceforge.net/docs/mibs/ucdDiskIOMIB.html#diskIOTable)

Filter:

- {#DEVNAME} MATCHESREGEX {$VFS.DEV.DEVNAME.MATCHES}

- {#DEVNAME} NOTMATCHES_REGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

This discovery will create set of per core CPU metrics from UCD-SNMP-MIB, using {#CPU.COUNT} in preprocessing. That's the only reason why LLD is used.

Preprocessing:

- JAVASCRIPT: The text is too long. Please see the template.

Discovering interfaces from IF-MIB and EtherLike-MIB. Interfaces with up(1) Operational Status are discovered.

Preprocessing:

- JAVASCRIPT: The text is too long. Please see the template.

Filter:

- {#IFOPERSTATUS} MATCHESREGEX 1

- {#SNMPVALUE} MATCHESREGEX `(2

HOST-RESOURCES-MIB::hrStorage discovery with storage filter

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

Discovering interfaces from IF-MIB.

Filter:

- {#IFADMINSTATUS} MATCHESREGEX {$NET.IF.IFADMINSTATUS.MATCHES}

- {#IFADMINSTATUS} NOTMATCHESREGEX {$NET.IF.IFADMINSTATUS.NOT_MATCHES}

- {#IFOPERSTATUS} MATCHESREGEX {$NET.IF.IFOPERSTATUS.MATCHES}

- {#IFOPERSTATUS} NOTMATCHESREGEX {$NET.IF.IFOPERSTATUS.NOT_MATCHES}

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHESREGEX {$NET.IF.IFNAME.NOT_MATCHES}

- {#IFDESCR} MATCHESREGEX {$NET.IF.IFDESCR.MATCHES}

- {#IFDESCR} NOTMATCHESREGEX {$NET.IF.IFDESCR.NOT_MATCHES}

- {#IFALIAS} MATCHESREGEX {$NET.IF.IFALIAS.MATCHES}

- {#IFALIAS} NOTMATCHESREGEX {$NET.IF.IFALIAS.NOT_MATCHES}

- {#IFTYPE} MATCHESREGEX {$NET.IF.IFTYPE.MATCHES}

- {#IFTYPE} NOTMATCHESREGEX {$NET.IF.IFTYPE.NOT_MATCHES}

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: HOST-RESOURCES-MIB

Count the number of CPU cores by counting number of cores discovered in hrProcessorTable using LLD

Preprocessing:

- JAVASCRIPT: //count the number of cores return JSON.parse(value).length;

-

Preprocessing:

- CHANGEPERSECOND

-

Preprocessing:

- CHANGEPERSECOND

MIB: UCD-SNMP-MIB

The time the CPU has spent doing nothing.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The time the CPU has spent running the kernel and its processes.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The time the CPU has spent running users' processes that are not niced.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The amount of 'stolen' CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The amount of time the CPU has been servicing software interrupts.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The time the CPU has spent running users' processes that have been niced.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The amount of time the CPU has been waiting for I/O to complete.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The amount of time the CPU has been servicing hardware interrupts.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

Guest time - the time spent on running a virtual CPU for a guest operating system.

Preprocessing:

- CHANGEPERSECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

MIB: UCD-SNMP-MIB

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

- CHANGEPER_SECOND

- JAVASCRIPT: //to get utilization in %, divide by N, where N is number of cores. return value/{#CPU.COUNT}

The CPU utilization expressed in %.

Preprocessing:

- JAVASCRIPT: //Calculate utilization return (100 - value)

The item is used to collect all SNMP traps unmatched by other snmptrap items

MIB: SNMPv2-MIB

The physical location of this node (e.g., `telephone closet, 3rd floor'). If the location is unknown, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

The textual identification of the contact person for this managed node, together with information on how to contact this person. If no contact information is known, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

The vendor's authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous means for determiningwhat kind of box' is being managed. For example, if vendorFlintstones, Inc.' was assigned the subtree1.3.6.1.4.1.4242, it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its `Fred Router'.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

An administratively-assigned name for this managed node.By convention, this is the node's fully-qualified domain name. If the name is unknown, the value is the zero-length string.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

MIB: SNMPv2-MIB

A textual description of the entity. This value should

include the full name and version identification of the system's hardware type, software operating-system, and

networking software.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 12h

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

Expression:

MIB: UCD-SNMP-MIB

Preprocessing:

- MULTIPLIER: 1024

MIB: UCD-SNMP-MIB

Memory used by kernel buffers (Buffers in /proc/meminfo).

Preprocessing:

- MULTIPLIER: 1024

MIB: UCD-SNMP-MIB

Memory used by the page cache and slabs (Cached and Slab in /proc/meminfo).

Preprocessing:

- MULTIPLIER: 1024

MIB: UCD-SNMP-MIB

The total memory expressed in Bytes.

Preprocessing:

- MULTIPLIER: 1024

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

Expression:

MIB: UCD-SNMP-MIB

The total amount of swap space configured for this host.

Preprocessing:

- MULTIPLIER: 1024

MIB: UCD-SNMP-MIB

The amount of swap space currently unused or available.

Preprocessing:

- MULTIPLIER: 1024

The free space of the swap volume/file expressed in %.

Expression:

MIB: EtherLike-MIB

The current mode of operation of the MAC

entity. 'unknown' indicates that the current

duplex mode could not be determined.

Management control of the duplex mode is

accomplished through the MAU MIB. When

an interface does not support autonegotiation,

or when autonegotiation is not enabled, the

duplex mode is controlled using

ifMauDefaultType. When autonegotiation is

supported and enabled, duplex mode is controlled

using ifMauAutoNegAdvertisedBits. In either

case, the currently operating duplex mode is

reflected both in this object and in ifMauType.

Note that this object provides redundant

information with ifMauType. Normally, redundant

objects are discouraged. However, in this

instance, it allows a management application to

determine the duplex status of an interface

without having to know every possible value of

ifMauType. This was felt to be sufficiently

valuable to justify the redundancy.

Reference: [IEEE 802.3 Std.], 30.3.1.1.32,aDuplexStatus.

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

MIB: IF-MIB

The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

- MULTIPLIER: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing:

- CHANGEPERSECOND

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n' then the speed of the interface is somewhere in the range ofn-500,000' to`n+499,999'. For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth. For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing:

- MULTIPLIER: 1000000

- DISCARDUNCHANGEDHEARTBEAT: 1h

MIB: SNMPv2-MIB

The time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Preprocessing:

- MULTIPLIER: 0.01

MIB: HOST-RESOURCES-MIB

The amount of time since this host was last initialized. Note that this is different from sysUpTime in the SNMPv2-MIB [RFC1907] because sysUpTime is the uptime of the network management portion of the system.

Preprocessing:

- CHECKNOTSUPPORTED

⛔️ON_FAIL: CUSTOM_VALUE -> 0

- MULTIPLIER: 0.01

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible value:

0 - not available

1 - available

2 - unknown

-

-

-

MIB: UCD-DISKIO-MIB

The number of read accesses from this device since boot.

Preprocessing:

- CHANGEPERSECOND

MIB: UCD-DISKIO-MIB

The number of write accesses from this device since boot.

Preprocessing:

- CHANGEPERSECOND

MIB: UCD-DISKIO-MIB

The 1 minute average load of disk (%)

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main storage allocated to a buffer pool might be modified or the amount of disk space allocated to virtual storage might be modified.

Preprocessing:

- MULTIPLIER: {#ALLOC_UNITS}

The space utilization expressed in % for {#FSNAME}.

Expression:

MIB: UCD-SNMP-MIB

If having problems collecting this item make sure access to UCD-SNMP-MIB is allowed.

Preprocessing:

- JAVASCRIPT: return (100-value);

The load average per CPU is too high. The system may be slow to respond.

The CPU utilization is too high. The system might be slow to respond.

The name of the system has changed. Ack to close the problem manually.

Manual close: YES

The system is running out of free memory.

Depends on:

- Lack of available memory

-

If there is no swap configured, this trigger is ignored.

Depends on:

- High memory utilization

- Lack of available memory

Please check autonegotiation settings and cabling

Manual close: YES

This trigger expression works as follows:

1. It can be triggered if the operations status is down.

2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'ethernal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

Recovery expression:

Manual close: YES

The utilization of the network interface is close to its estimated maximum bandwidth.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge (Ack) to close the problem manually.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

Uptime is less than 10 minutes.

Manual close: YES

Depends on:

- No SNMP data collection

SNMP is not available for polling. Please check device connectivity and SNMP settings.

Depends on:

- Unavailable by ICMP ping

Last three attempts returned timeout. Please check device connectivity.

-

Depends on:

- Unavailable by ICMP ping

-

Depends on:

- High ICMP ping loss

- Unavailable by ICMP ping

Two conditions should match:

1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

2. The second condition should be one of the following:

- the disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"};

- the disk will be full in less than 24 hours.

Manual close: YES

Two conditions should match:

1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

2. The second condition should be one of the following:

- the disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"};

- the disk will be full in less than 24 hours.

Manual close: YES

Depends on:

- {#FSNAME}: Disk space is critically low

It may become impossible to write to a disk if there are no index nodes left.

Following error messages may be returned as symptoms, even though the free space is available:

- 'No space left on device';

- 'Disk is full'.

It may become impossible to write to a disk if there are no index nodes left.

Following error messages may be returned as symptoms, even though the free space is available:

- 'No space left on device';

- 'Disk is full'.

Depends on:

- {#FSNAME}: Running out of free inodes

-

-

-

-

-

Load per CPU considered sustainable. Tune if needed.

-

-

-

-

-

Filter out loopbacks, nulls, docker veth links and docker0 bridge by default.

-

Ignore notPresent(7).

TCP Port node_exporter is listening on.

-

-

This macro is used in block devices discovery. Can be overridden on the host or linked template level.

This macro is used in block devices discovery. Can be overridden on the host or linked template level.

Disk read average response time (in ms) before the trigger would fire.

Disk write average response time (in ms) before the trigger would fire.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

-

-

-

-

-

- PROMETHEUSTOJSON: node_disk_io_now{device=~".+"}

Filter:

- {#DEVNAME} MATCHESREGEX {$VFS.DEV.DEVNAME.MATCHES}

- {#DEVNAME} NOTMATCHESREGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

Discovery of file systems of different types.

- PROMETHEUSTOJSON: {__name__=~"^node_filesystem_size(?:_bytes)?$", mountpoint=~".+"}

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSDEVICE.MATCHES}

- {#FSDEVICE} NOTMATCHESREGEX {$VFS.FS.FSDEVICE.NOT_MATCHES}

Discovery of network interfaces. Requires node_exporter v0.18 and up.

- PROMETHEUSTOJSON: {__name__=~"^node_network_info$"}

Filter:

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHESREGEX {$NET.IF.IFNAME.NOT_MATCHES}

- {#IFALIAS} MATCHESREGEX {$NET.IF.IFALIAS.MATCHES}

- {#IFALIAS} NOTMATCHESREGEX {$NET.IF.IFALIAS.NOT_MATCHES}

- {#IFOPERSTATUS} MATCHESREGEX {$NET.IF.IFOPERSTATUS.MATCHES}

- {#IFOPERSTATUS} NOTMATCHESREGEX {$NET.IF.IFOPERSTATUS.NOT_MATCHES}

-

- PROMETHEUSPATTERN: node_load1

-

- PROMETHEUSPATTERN: node_load5

-

- PROMETHEUSPATTERN: node_load15

-

- PROMETHEUSTO_JSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="idle"}

- JAVASCRIPT: //count the number of cores return JSON.parse(value).length

The CPU utilization expressed in %.

Preprocessing:

- JAVASCRIPT: //Calculate utilization return (100 - value)

The time the CPU has spent doing nothing.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="idle"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The time the CPU has spent running the kernel and its processes.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="system"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The time the CPU has spent running users' processes that are not niced.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="user"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The amount of 'stolen' CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="steal"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The amount of time the CPU has been servicing software interrupts.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="softirq"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The time the CPU has spent running users' processes that have been niced.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="nice"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The amount of time the CPU has been waiting for I/O to complete.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="iowait"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

The amount of time the CPU has been servicing hardware interrupts.

- PROMETHEUSTOJSON: {__name__=~"^node_cpu(?:_seconds_total)?$",cpu=~".+",mode="irq"}

- JAVASCRIPT: The text is too long. Please see the template.

- CHANGEPER_SECOND

- MULTIPLIER: 100

Guest time - the time spent on running a virtual CPU for a guest operating system.

- PROMETHEUSTOJSON: `{name=~"^nodecpu(?:guestseconds_total)?$",cpu=~".+",mode=~"^(?:user

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing:

- PROMETHEUSTOJSON: `{name=~"^nodecpu(?:guestsecondstotal)?$",cpu=~".+",mode=~"^(?:nice

-

- PROMETHEUSPATTERN: {__name__=~"node_intr"}

- CHANGEPERSECOND

-

- PROMETHEUSPATTERN: {__name__=~"node_context_switches"}

- CHANGEPERSECOND

-

- PROMETHEUSPATTERN: {__name__=~"^node_boot_time(?:_seconds)?$"}

The local system time of the host.

- PROMETHEUSPATTERN: {__name__=~"^node_time(?:_seconds)?$"}

The host name of the system.

- PROMETHEUSPATTERN: node_uname_info: label: nodename

- DISCARDUNCHANGEDHEARTBEAT: 1d

Labeled system information as provided by the uname system call.

- PROMETHEUSTOJSON: node_uname_info

- JAVASCRIPT: The text is too long. Please see the template.

- DISCARDUNCHANGED_HEARTBEAT: 1d

It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

- PROMETHEUSPATTERN: node_filefd_maximum

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

- PROMETHEUSPATTERN: node_filefd_allocated

-

- DISCARDUNCHANGED_HEARTBEAT: 1d

The architecture of the host's operating system.

- PROMETHEUSPATTERN: node_uname_info: label: machine

- DISCARDUNCHANGEDHEARTBEAT: 1d

Memory used percentage is calculated as (total-available)/total*100.

Expression:

The total memory expressed in Bytes.

- PROMETHEUSPATTERN: {__name__=~"node_memory_MemTotal"}

The available memory:

- in Linux - available = free + buffers + cache;

- on other platforms calculation may vary.

See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

- PROMETHEUSPATTERN: {__name__=~"node_memory_MemAvailable"}

The total space of the swap volume/file expressed in bytes.

- PROMETHEUSPATTERN: {__name__=~"node_memory_SwapTotal"}

The free space of the swap volume/file expressed in bytes.

- PROMETHEUSPATTERN: {__name__=~"node_memory_SwapFree"}

The free space of the swap volume/file expressed in %.

Expression:

-

- PROMETHEUSPATTERN: node_exporter_build_info: label: version

- DISCARDUNCHANGEDHEARTBEAT: 1d

-

- PROMETHEUSPATTERN: node_network_receive_bytes_total{device="{#IFNAME}"}

- CHANGEPERSECOND

- MULTIPLIER: 8

-

- PROMETHEUSPATTERN: node_network_transmit_bytes_total{device="{#IFNAME}"}

- CHANGEPERSECOND

- MULTIPLIER: 8

-

- PROMETHEUSPATTERN: node_network_transmit_errs_total{device="{#IFNAME}"}

- CHANGEPERSECOND

-

- PROMETHEUSPATTERN: node_network_receive_errs_total{device="{#IFNAME}"}

- CHANGEPERSECOND

-

- PROMETHEUSPATTERN: node_network_receive_drop_total{device="{#IFNAME}"}

- CHANGEPERSECOND

-

- PROMETHEUSPATTERN: node_network_transmit_drop_total{device="{#IFNAME}"}

- CHANGEPERSECOND

Sets value to 0 if metric is missing in node_exporter output.

- PROMETHEUSPATTERN: node_network_speed_bytes{device="{#IFNAME}"}

⛔️ON_FAIL: CUSTOM_VALUE -> 0

- MULTIPLIER: 8

nodenetworkprotocoltype protocoltype value of /sys/class/net/.

- PROMETHEUSPATTERN: node_network_protocol_type{device="{#IFNAME}"}

Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt

- PROMETHEUSPATTERN: node_network_info{device="{#IFNAME}"}: label: operstate

- JAVASCRIPT: The text is too long. Please see the template.

The system uptime expressed in the following format:'N days, hh:mm:ss'.

- PROMETHEUSPATTERN: {__name__=~"^node_boot_time(?:_seconds)?$"}

- JAVASCRIPT: //use boottime to calculate uptime return (Math.floor(Date.now()/1000)-Number(value));

-

- PROMETHEUSPATTERN: {__name__=~"^node_filesystem_avail(?:_bytes)?$", mountpoint="{#FSNAME}"}

The total space expressed in Bytes.

- PROMETHEUSPATTERN: {__name__=~"^node_filesystem_size(?:_bytes)?$", mountpoint="{#FSNAME}"}

Used storage expressed in Bytes

Expression:

The space utilization expressed in % for {#FSNAME}.

Expression:

-

- PROMETHEUSTO_JSON: {__name__=~"node_filesystem_files.*",mountpoint="{#FSNAME}"}

- JAVASCRIPT: The text is too long. Please see the template.

r/s. The number (after merges) of read requests completed per second for the device.

- PROMETHEUSPATTERN: node_disk_reads_completed_total{device="{#DEVNAME}"}

- CHANGEPERSECOND

w/s. The number (after merges) of write requests completed per second for the device.

- PROMETHEUSPATTERN: node_disk_writes_completed_total{device="{#DEVNAME}"}

- CHANGEPERSECOND

This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception.

Expression:

This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception.

Expression:

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

Preprocessing:

- PROMETHEUSPATTERN: node_disk_io_time_weighted_seconds_total{device="{#DEVNAME}"}

- CHANGEPER_SECOND

This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests.

- PROMETHEUSPATTERN: node_disk_io_time_seconds_total{device="{#DEVNAME}"}

- CHANGEPERSECOND

- MULTIPLIER: 100

-

Rate of total read time counter. Used in r_await calculation.

- PROMETHEUSPATTERN: node_disk_read_time_seconds_total{device="{#DEVNAME}"}

- CHANGEPERSECOND

Rate of total write time counter. Used in w_await calculation.

- PROMETHEUSPATTERN: node_disk_write_time_seconds_total{device="{#DEVNAME}"}

- CHANGEPERSECOND

The load average per CPU is too high. The system may be slow to respond.

The CPU utilization is too high. The system might be slow to respond.

Depends on:

- Load average is too high

The host's system time is different from Zabbix server time.

Manual close: YES

The name of the system has changed. Ack to close the problem manually.

Manual close: YES

-

Depends on:

- Running out of file descriptors

-

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Ack to close the problem manually.

Manual close: YES

Depends on:

- System name has changed

The system is running out of free memory.

Depends on:

- Lack of available memory

-

If there is no swap configured, this trigger is ignored.

Depends on:

- High memory utilization

- Lack of available memory

The utilization of the network interface is close to its estimated maximum bandwidth.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge (Ack) to close the problem manually.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge (Ack) to close the problem manually.

Recovery expression:

Manual close: YES

Depends on:

- Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:

1. It can be triggered if the operations status is down.

2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'ethernal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

Recovery expression:

Manual close: YES

The device uptime is less than 10 minutes.

Manual close: YES

Two conditions should match:

1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

2. The second condition should be one of the following:

- the disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"};

- the disk will be full in less than 24 hours.

Manual close: YES

Two conditions should match:

1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.

2. The second condition should be one of the following:

- the disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"};

- the disk will be full in less than 24 hours.

Manual close: YES

Depends on:

- {#FSNAME}: Disk space is critically low

It may become impossible to write to a disk if there are no index nodes left.

Following error messages may be returned as symptoms, even though the free space is available:

- 'No space left on device';

- 'Disk is full'.

It may become impossible to write to a disk if there are no index nodes left.

Following error messages may be returned as symptoms, even though the free space is available:

- 'No space left on device';

- 'Disk is full'.

Depends on:

- {#FSNAME}: Running out of free inodes

This trigger might indicate the disk {#DEVNAME} saturation.

Manual close: YES

Failed to fetch system metrics from node_exporter in time.

Manual close: YES

No data timeout for active agents. Consider to keep it relatively high.

Timeout after which agent is considered unavailable.

-

-

This macro is used as a threshold in the interface utilization trigger.

-

-

-

CPU load per core is considered sustainable. If necessary, it can be tuned.

This macro is used as a threshold in the memory available trigger.

This macro is used as a threshold in the memory utilization trigger.

-

It filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

-

-

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level.

The average response time (in ms) of disk read before the trigger would fire.

The average response time (in ms) of disk write before the trigger would fire.

The critical threshold for utilization of the filesystem.

The critical threshold for utilization of the filesystem.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level.

-

-

-

-

-

Preprocessing:

- DISCARDUNCHANGEDHEARTBEAT: 1h

Filter:

- {#DEVTYPE} MATCHESREGEX disk

- {#DEVNAME} MATCHESREGEX {$VFS.DEV.DEVNAME.MATCHES}

- {#DEVNAME} NOTMATCHESREGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

Discovery of file systems of different types.

Filter:

- {#FSTYPE} MATCHESREGEX {$VFS.FS.FSTYPE.MATCHES}

- {#FSTYPE} NOTMATCHESREGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- {#FSNAME} MATCHESREGEX {$VFS.FS.FSNAME.MATCHES}

- {#FSNAME} NOTMATCHESREGEX {$VFS.FS.FSNAME.NOT_MATCHES}

Overrides:

Skip metadata collection for dynamic FS
- {#FSTYPE} MATCHES_REGEX `^(btrfs

The discovery of network interfaces.

Filter:

- {#IFNAME} MATCHESREGEX {$NET.IF.IFNAME.MATCHES}

- {#IFNAME} NOTMATCHES_REGEX {$NET.IF.IFNAME.NOT_MATCHES}