Time interval for the SNMP availability trigger.

Warning threshold of ICMP packet loss in %.

Warning threshold of the average ICMP response time in seconds.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

The warning threshold of the "Physical memory: Memory utilization" item.

Used in memory discovery. Can be overridden on the host or linked template level.

Used in memory discovery. Can be overridden on the host or linked template level if you need to filter out results.

Used in memory discovery. Can be overridden on the host or linked template level.

Used in memory discovery. Can be overridden on the host or linked template level if you need to filter out results.

Critical threshold of CPU utilization expressed in %.

Link status trigger will be fired only for interfaces where the context macro equals "1".

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

Used for network interface discovery. Can be overridden on the host or linked template level.

Filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

Used for network interface discovery. Can be overridden on the host or linked template level.

Ignore notPresent(6)

Used in network interface discovery rule filters.

Ignore down(2) administrative status

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

MIB: SNMPv2-MIB

Time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Preprocessing

• Custom multiplier: 0.01

MIB: HOST-RESOURCES-MIB

The amount of time since this host was last initialized. Note that this is different from sysUpTime in the SNMPv2-MIB [RFC1907] because sysUpTime is the uptime of the network management portion of the system.

Preprocessing

• Check for not supported value: any error

  ⛔️Custom on fail: Set value to: 0

• Custom multiplier: 0.01

The item is used to collect all SNMP traps unmatched by other snmptrap items

MIB: SNMPv2-MIB

Physical location of the node (e.g., equipment room, 3rd floor). If not provided, the value is a zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

The textual identification of the contact person for this managed node, together with information on how to contact this person. If no contact information is known, the value is the zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

The vendor's authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous means for determiningwhat kind of box' is being managed. For example, if vendorFlintstones, Inc.' was assigned the subtree1.3.6.1.4.1.4242, it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its `Fred Router'.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

An administratively-assigned name for this managed node.By convention, this is the node's fully-qualified domain name. If the name is unknown, the value is the zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

A textual description of the entity. This value should

include the full name and version identification of the system's hardware type, software operating-system, and

networking software.

Preprocessing

• Discard unchanged with heartbeat: 12h

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - not available

1 - available

2 - unknown

HOST-RESOURCES-MIB::hrStorage discovery.

Preprocessing

• SNMP walk to JSON

MIB: HOST-RESOURCES-MIB

The average, over the last minute, of the percentage of time that processors was not idle.

Implementations may approximate this one minute smoothing period if necessary.

Preprocessing

• JSON Path: $..['{#CPU.UTIL}'].avg()

Discovering interfaces from IF-MIB.

Uptime is less than 10 minutes.

• Windows: No SNMP data collection

The name of the system has changed. Acknowledge to close the problem manually.

SNMP is not available for polling. Please check device connectivity and SNMP settings.

• Windows: Unavailable by ICMP ping

Last three attempts returned timeout. Please check device connectivity.

• Windows: Unavailable by ICMP ping

Average ICMP response time is too high.

• Windows: High ICMP ping loss
• Windows: Unavailable by ICMP ping

CPU utilization is too high. The system might be slow to respond.

HOST-RESOURCES-MIB::hrStorage discovery with storage filter.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

HOST-RESOURCES-MIB::hrStorage.

Intermediate data for subsequent processing.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing

• JSON Path: $.hrStorageUsed

• Custom multiplier: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main storage allocated to a buffer pool might be modified or the amount of disk space allocated to virtual storage might be modified.

Preprocessing

• JSON Path: $.hrStorageSize

• Custom multiplier: {#ALLOC_UNITS}

The space utilization expressed in % for {#FSNAME}.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The storage space usage exceeds the '{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%' limit.

The storage space usage exceeds the '{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%' limit.

• Windows: FS [{#FSNAME}]: Space is critically low

HOST-RESOURCES-MIB::hrStorage discovery with memory filter

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: HOST-RESOURCES-MIB

The amount of the storage represented by this entry that is allocated, in units of hrStorageAllocationUnits.

Preprocessing

• JSON Path: $.hrStorageUsed

• Custom multiplier: {#ALLOC_UNITS}

MIB: HOST-RESOURCES-MIB

The size of the storage represented by this entry, in units of hrStorageAllocationUnits.

This object is writable to allow remote configuration of the size of the storage area in those cases where such an operation makes sense and is possible on the underlying system.

For example, the amount of main memory allocated to a buffer pool might be modified or the amount of disk space allocated to virtual memory might be modified.

Preprocessing

• JSON Path: $.hrStorageSize

• Custom multiplier: {#ALLOC_UNITS}

Memory utilization in %.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The system is running out of free memory.

Discovering interfaces from IF-MIB.

Preprocessing

• SNMP walk to JSON

• Discard unchanged with heartbeat: 1h

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}

MIB: IF-MIB

The total number of octets received on the interface,including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and another times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.10.{#SNMPINDEX}

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.16.{#SNMPINDEX}

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.14.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.20.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.19.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.13.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.3.{#SNMPINDEX}

• Discard unchanged with heartbeat: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n, then the speed of the interface is somewhere in the range of n-500,000 to n+499,999.

For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth.

For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.31.1.1.1.15.{#SNMPINDEX}

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

The utilization of the network interface is close to its estimated maximum bandwidth.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

No data timeout for active agents. Consider to keep it relatively high.

Timeout after which agent is considered unavailable.

The critical threshold of the CPU utilization expressed in %.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The warning threshold of the Memory util item.

The warning threshold of the minimum free swap.

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

The warning threshold of disk time utilization in percent.

Disk read average response time (in s) before the trigger fires.

Disk write average response time (in s) before the trigger fires.

Used in physical disk discovery. Can be overridden on the host or linked template level.

Used in physical disk discovery. Can be overridden on the host or linked template level.

Macro for the interface operational state for the "link down" trigger. Can be used with interface name as context.

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

Availability of active checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - unknown

1 - available

2 - not available

CPU utilization expressed in %.

The processor information % Interrupt Time counter indicates how much time the processor spends handling hardware interrupts during sample intervals. It reflects the activity of devices like the system clock, mouse, disk drivers, and network cards. A value above 20% suggests possible hardware issues.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The processor information % Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance.

The processor information % User Time counter shows the percent of time that the processor(s) is spent executing in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed.

Used memory in bytes.

Total memory expressed in bytes.

Memory utilization in %.

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes, Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Preprocessing

• JavaScript: return (100 - value)

The used space of swap volume/file in percent.

The total space of the swap volume/file expressed in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). Consequently, Event ID 2019 is recorded in the system event log.

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

The system uptime expressed in the following format: "N days, hh:mm:ss".

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

System description of the host.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of processes.

The number of threads used by all running processes.

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

Raw data of win32_networkadapter.

Preprocessing

• Discard unchanged with heartbeat: 1h

For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as a time threshold.

Active checks are considered unavailable. Agent has not sent a heartbeat for a prolonged time.

CPU utilization is too high. The system might be slow to respond.

The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%.

• Windows: High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

• Windows: High CPU utilization
• Windows: CPU interrupt time is too high

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

• Windows: High CPU utilization

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

• Windows: High memory utilization

Memory\Free System Page Table Entries has been less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may be a memory leak.

• Windows: High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

• Windows: High memory utilization

The device uptime is less than 10 minutes.

The name of the system has changed. Acknowledge to close the problem manually.

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Windows: System name has changed

Discovery of filesystems of different types.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Intermediate data of {#FSNAME} filesystem.

Preprocessing

• JSON Path: $.[?(@.fsname=='{#FSNAME}')].first()

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• Windows: FS [{#FSLABEL}({#FSNAME})]: Space is critically low

Discovery of installed physical disks.

Preprocessing

• Replace: {#INSTANCE} -> {#DEVNAME}

Rate of read operations on the disk.

Rate of write operations on the disk.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing

• JavaScript: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

The disk appears to be under heavy load.

• Windows: {#DEVNAME}: Disk read request responses are too high
• Windows: {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation.

This trigger might indicate the disk {#DEVNAME} saturation.

Discovery of installed network interfaces.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Incoming traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

Outgoing traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

The number of incoming packets dropped on the network interface.

Preprocessing

• Change per second

The number of outgoing packets dropped on the network interface.

Preprocessing

• Change per second

The number of incoming packets with errors on the network interface.

Preprocessing

• Change per second

The number of outgoing packets with errors on the network interface.

Preprocessing

• Change per second

Estimated bandwidth of the network interface if any.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].Speed.first()

  ⛔️Custom on fail: Set value to: 0

• JavaScript: return (value=='9223372036854775807' ? 0 : value)

• Discard unchanged with heartbeat: 1h

The type of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

• Discard unchanged with heartbeat: 1d

The operational status of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

• Discard unchanged with heartbeat: 1d

The utilization of the network interface is close to its estimated maximum bandwidth.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important.
No new trigger will be fired if this interface is down.
3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

Used for the discovery of Windows services of different types as defined in the template's macros.

The service has a state other than "Running" for the last three times.

Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode).

The critical threshold of the CPU utilization expressed in %.

The critical threshold of the % Interrupt Time counter.

The threshold of the % Privileged Time counter.

The threshold of the Processor Queue Length counter.

The warning threshold of the Memory util item.

The warning threshold of the minimum free swap.

The warning threshold of the Free System Page Table Entries counter.

The warning threshold of the Memory Pages/sec counter.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

The warning threshold of disk time utilization in percent.

Disk read average response time (in s) before the trigger fires.

Disk write average response time (in s) before the trigger fires.

Used in physical disk discovery. Can be overridden on the host or linked template level.

Used in physical disk discovery. Can be overridden on the host or linked template level.

The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping.

The upper threshold for difference of system time.

Macro for the interface operational state for the "link down" trigger. Can be used with interface name as context.

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Network interface discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Used in Service discovery. Can be overridden on the host or linked template level.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

Used for monitoring the availability status of the agent.

CPU utilization expressed in %.

The processor information % Interrupt Time counter indicates how much time the processor spends handling hardware interrupts during sample intervals. It reflects the activity of devices like the system clock, mouse, disk drivers, and network cards. A value above 20% suggests possible hardware issues.

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

The processor information % Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows Operating System.

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance.

The processor information % User Time counter shows the percent of time that the processor(s) is spent executing in User mode.

The number of logical processors available on the computer.

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed.

Used memory in bytes.

Total memory expressed in bytes.

Memory utilization in %.

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes, Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Preprocessing

• JavaScript: return (100 - value)

The used space of swap volume/file in percent.

The total space of the swap volume/file expressed in bytes.

This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may be a memory leak or you running out of memory.

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays.

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). Consequently, Event ID 2019 is recorded in the system event log.

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

The system uptime expressed in the following format: "N days, hh:mm:ss".

The local system time of the host.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

System description of the host.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of processes.

The number of threads used by all running processes.

The architecture of the operating system.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

Raw data of win32_networkadapter.

Preprocessing

• Discard unchanged with heartbeat: 1h

For passive agents only, host availability is used with {$AGENT.TIMEOUT} as a time threshold.

CPU utilization is too high. The system might be slow to respond.

The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%.

• Windows: High CPU utilization

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

• Windows: High CPU utilization
• Windows: CPU interrupt time is too high

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.

• Windows: High CPU utilization

The system is running out of free memory.

This trigger is ignored, if there is no swap configured

• Windows: High memory utilization

Memory\Free System Page Table Entries has been less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may be a memory leak.

• Windows: High memory utilization

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

• Windows: High memory utilization

The device uptime is less than 10 minutes.

The host's system time is different from Zabbix server time.

The name of the system has changed. Acknowledge to close the problem manually.

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Windows: System name has changed

Discovery of filesystems of different types.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Intermediate data of {#FSNAME} filesystem.

Preprocessing

• JSON Path: $.[?(@.fsname=='{#FSNAME}')].first()

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• Windows: FS [{#FSLABEL}({#FSNAME})]: Space is critically low

Discovery of installed physical disks.

Preprocessing

• Replace: {#INSTANCE} -> {#DEVNAME}

Rate of read operations on the disk.

Rate of write operations on the disk.

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

Preprocessing

• JavaScript: return (100 - value)

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

The disk appears to be under heavy load.

• Windows: {#DEVNAME}: Disk read request responses are too high
• Windows: {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation.

This trigger might indicate the disk {#DEVNAME} saturation.

Discovery of installed network interfaces.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Incoming traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

Outgoing traffic on the network interface.

Preprocessing

• Change per second

• Custom multiplier: 8

The number of incoming packets dropped on the network interface.

Preprocessing

• Change per second

The number of outgoing packets dropped on the network interface.

Preprocessing

• Change per second

The number of incoming packets with errors on the network interface.

Preprocessing

• Change per second

The number of outgoing packets with errors on the network interface.

Preprocessing

• Change per second

Estimated bandwidth of the network interface if any.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].Speed.first()

  ⛔️Custom on fail: Set value to: 0

• JavaScript: return (value=='9223372036854775807' ? 0 : value)

• Discard unchanged with heartbeat: 1h

The type of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()

• Discard unchanged with heartbeat: 1d

The operational status of the network interface.

Preprocessing

• JSON Path: $[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()

• Discard unchanged with heartbeat: 1d

The utilization of the network interface is close to its estimated maximum bandwidth.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Windows: Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important.
No new trigger will be fired if this interface is down.
3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for the 'eternal off' interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

Used for the discovery of Windows services of different types as defined in the template's macros.

The service has a state other than "Running" for the last three times.

Timeout after which the agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (in passive mode).

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem metadata utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

May be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

The number of processes in a running state.

The total number of processes in any state.

Number of interrupts processed.

Preprocessing

• Change per second

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

The combined rate at which all processors on the computer are switched from one thread to another.

Preprocessing

• Change per second

Time the CPU has spent doing nothing.

Time the CPU has been waiting for the I/O to complete.

Time the CPU has spent running the kernel and its processes.

Time the CPU has spent running users' processes that are not niced.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

The local system time of the host.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Total space of the swap volume/file expressed in bytes.

Information as normally returned by uname -a.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of users who are currently logged in.

Preprocessing

• Discard unchanged with heartbeat: 1h

Defined as free + cached + buffers.

Total memory expressed in bytes.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

Used for monitoring agent availability status

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

Extended OS wait times for I/O operations may signal potential performance issues with the storage system.

It probably means that the systems requires more physical memory.

For passive checks only; the availability of the agent(s) and a host is used with {$AGENT.TIMEOUT} as the time threshold.

Used for the discovery of network interfaces.

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

• Custom multiplier: 8

The discovery of mounted filesystems with different types.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Intermediate data of {#FSNAME} filesystem.

Preprocessing

• JSON Path: $.[?(@.fsname=='{#FSNAME}')].first()

The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher.

Preprocessing

• JSON Path: $.options

  ⛔️Custom on fail: Discard value

• Regular expression: `(?:^

Free metadata space expressed in %.

Preprocessing

• JSON Path: $.inodes.pfree

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

Deprecated metric.

Space availability expressed as a percentage, calculated using the current and maximum available spaces.

Preprocessing

• JSON Path: $.bytes.pfree

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

• Solaris: FS [{#FSNAME}]: Running out of free inodes

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• Solaris: FS [{#FSNAME}]: Space is critically low

Timeout after which the agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (in passive mode).

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem metadata utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

May be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

May be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

The number of processes in a running state.

The total number of processes in any state.

Number of interrupts processed.

Preprocessing

• Change per second:

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

The combined rate at which all processors on the computer are switched from one thread to another.

Preprocessing

• Change per second:

Time the CPU has spent doing nothing.

Time the CPU has spent servicing hardware interrupts.

Time the CPU has spent running users' processes that have been niced.

Time the CPU has spent running the kernel and its processes.

Time the CPU has spent running users' processes that are not niced.

Time the CPU has spent spinning on a lock.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

The local system time of the host.

The free space of the swap volume/file expressed in bytes.

The free space of the swap volume/file expressed in %.

Total space of the swap volume/file expressed in bytes.

Information as normally returned by uname -a.

Preprocessing

• Discard unchanged with heartbeat: 1d

The number of users who are currently logged in.

Preprocessing

• Discard unchanged with heartbeat: 1h

Defined as free + cached + buffers.

Total memory expressed in bytes.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

Used for monitoring the availability status of the agent.

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

It probably means that the systems requires more physical memory.

For passive checks only; the availability of the agent(s) and a host is used with {$AGENT.TIMEOUT} as the time threshold.

Used for the discovery of network interfaces.

Preprocessing

• Change per second:

• Custom multiplier: 8

Preprocessing

• Change per second:

• Custom multiplier: 8

The discovery of mounted filesystems with different types.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Intermediate data of {#FSNAME} filesystem.

Preprocessing

• JSON Path: $.[?(@.fsname=='{#FSNAME}')].first()

The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher.

Preprocessing

• JSON Path: $.options

  ⛔️Custom on fail: Discard value

• Regular expression: `(?:^

Free metadata space expressed in %.

Preprocessing

• JSON Path: $.inodes.pfree

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

Deprecated metric.

Space availability expressed as a percentage, calculated using the current and maximum available spaces.

Preprocessing

• JSON Path: $.bytes.pfree

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

• OpenBSD: FS [{#FSNAME}]: Running out of free inodes

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• OpenBSD: FS [{#FSNAME}]: Space is critically low

Timeout after which the agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (in passive mode).

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

Used for filesystem discovery. Can be overridden on the host or linked template level.

The critical threshold of the filesystem metadata utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem utilization.

May be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

May be increased by using the sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Change per second

• Custom multiplier: 8

Preprocessing

• Change per second

• Custom multiplier: 8

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

Calculated as the system CPU load divided by the number of CPU cores.

The host name of the system.

Preprocessing

• Discard unchanged with heartbeat: 1d

The local system time of the host.

Information as normally returned by uname -a.

Preprocessing

• Discard unchanged with heartbeat: 1d

The system uptime expressed in the following format: "N days, hh:mm:ss".

The number of users who are currently logged in.

Preprocessing

• Discard unchanged with heartbeat: 1h

Defined as free + cached + buffers.

Total memory expressed in bytes.

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Discard unchanged with heartbeat: 1d

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

Used for monitoring the availability status of the agent.

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

For passive checks only; the availability of the agent(s) and a host is used with {$AGENT.TIMEOUT} as the time threshold.

The discovery of mounted filesystems with different types. Note that the option to exclude dmg software images from discovery is available only with Zabbix agents 6.4 and higher.

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

Intermediate data of {#FSNAME} filesystem.

Preprocessing

• JSON Path: $.[?(@.fsname=='{#FSNAME}')].first()

Free metadata space expressed in %.

Preprocessing

• JSON Path: $.inodes.pfree

Available storage space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.free

Deprecated metric.

Space availability expressed as a percentage, calculated using the current and maximum available spaces.

Preprocessing

• JSON Path: $.bytes.pfree

Calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JSON Path: $.bytes.pused

Total space expressed in bytes.

Preprocessing

• JSON Path: $.bytes.total

Used storage expressed in bytes.

Preprocessing

• JSON Path: $.bytes.used

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

• macOS: FS [{#FSNAME}]: Running out of free inodes

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• macOS: FS [{#FSNAME}]: Space is critically low

Used as a threshold in the memory utilization trigger.

Used as a threshold in the available memory trigger.

The warning threshold of the minimum free swap.

Used in block device discovery. Can be overridden on the host or linked template level.

Used in block device discovery. Can be overridden on the host or linked template level.

Critical threshold of CPU utilization expressed in %.

Load per CPU considered sustainable. Tune if needed.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem metadata utilization.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Time interval for the SNMP availability trigger.

Warning threshold of ICMP packet loss in %.

Warning threshold of the average ICMP response time in seconds.

Link status trigger will be fired only for interfaces where the context macro equals "1".

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

Used for network interface discovery. Can be overridden on the host or linked template level.

Filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

Used for network interface discovery. Can be overridden on the host or linked template level.

Ignore notPresent(6)

Used in network interface discovery rule filters.

Ignore down(2) administrative status

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

MIB: UCD-SNMP-MIB

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

Memory used by kernel buffers (Buffers in /proc/meminfo).

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

Memory used by the page cache and slabs (Cached and Slab in /proc/meminfo).

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

Total memory expressed in bytes.

Preprocessing

• Custom multiplier: 1024

Please note that memory utilization is a rough estimate, since memory available is calculated as free+buffers+cached, which is not 100% accurate, but the best we can get using SNMP.

MIB: UCD-SNMP-MIB

The total amount of swap space configured for this host.

Preprocessing

• Custom multiplier: 1024

MIB: UCD-SNMP-MIB

The amount of swap space currently unused or available.

Preprocessing

• Custom multiplier: 1024

The free space of the swap volume/file expressed in %.

Block devices are discovered from UCD-DISKIO-MIB::diskIOTable (http://net-snmp.sourceforge.net/docs/mibs/ucdDiskIOMIB.html#diskIOTable).

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: UCD-SNMP-MIB

MIB: HOST-RESOURCES-MIB

Discovering system CPUs.

Count the number of CPU cores by counting number of cores discovered in hrProcessorTable using LLD.

Preprocessing

• SNMP walk to JSON

• JavaScript: The text is too long. Please see the template.

Number of interrupts processed.

Preprocessing

• Change per second

The combined rate at which all processors on the computer are switched from one thread to another.

Preprocessing

• Change per second

MIB: UCD-SNMP-MIB

Snmp walk through dskEntry table. Collected data used in filesystem lld and dependent item prototypes.

Preprocessing

• SNMP walk to JSON

MIB: SNMPv2-MIB

Time (in hundredths of a second) since the network management portion of the system was last re-initialized.

Preprocessing

• Custom multiplier: 0.01

MIB: HOST-RESOURCES-MIB

The amount of time since this host was last initialized. Note that this is different from sysUpTime in the SNMPv2-MIB [RFC1907] because sysUpTime is the uptime of the network management portion of the system.

Preprocessing

• Check for not supported value: any error

  ⛔️Custom on fail: Set value to: 0

• Custom multiplier: 0.01

The item is used to collect all SNMP traps unmatched by other snmptrap items

MIB: SNMPv2-MIB

Physical location of the node (e.g., equipment room, 3rd floor). If not provided, the value is a zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

The textual identification of the contact person for this managed node, together with information on how to contact this person. If no contact information is known, the value is the zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

The vendor's authoritative identification of the network management subsystem contained in the entity. This value is allocated within the SMI enterprises subtree (1.3.6.1.4.1) and provides an easy and unambiguous means for determiningwhat kind of box' is being managed. For example, if vendorFlintstones, Inc.' was assigned the subtree1.3.6.1.4.1.4242, it could assign the identifier 1.3.6.1.4.1.4242.1.1 to its `Fred Router'.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

An administratively-assigned name for this managed node.By convention, this is the node's fully-qualified domain name. If the name is unknown, the value is the zero-length string.

Preprocessing

• Discard unchanged with heartbeat: 12h

MIB: SNMPv2-MIB

A textual description of the entity. This value should

include the full name and version identification of the system's hardware type, software operating-system, and

networking software.

Preprocessing

• Discard unchanged with heartbeat: 12h

Availability of SNMP checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - not available

1 - available

2 - unknown

Discovering interfaces from IF-MIB.

Discovering interfaces from IF-MIB and EtherLike-MIB. Interfaces with up(1) Operational Status are discovered.

The system is running out of free memory.

• Linux: Lack of available memory

The system is running out of memory.

If there is no swap configured, this trigger is ignored.

• Linux: Lack of available memory
• Linux: High memory utilization

The load average per CPU is too high. The system may be slow to respond.

Uptime is less than 10 minutes.

• Linux: No SNMP data collection

The name of the system has changed. Acknowledge to close the problem manually.

SNMP is not available for polling. Please check device connectivity and SNMP settings.

• Linux: Unavailable by ICMP ping

Last three attempts returned timeout. Please check device connectivity.

• Linux: Unavailable by ICMP ping

Average ICMP response time is too high.

• Linux: High ICMP ping loss
• Linux: Unavailable by ICMP ping

Block devices are discovered from UCD-DISKIO-MIB::diskIOTable (http://net-snmp.sourceforge.net/docs/mibs/ucdDiskIOMIB.html#diskIOTable)

Preprocessing

• SNMP walk to JSON

• Discard unchanged with heartbeat: 1h

MIB: UCD-DISKIO-MIB

The number of read accesses from this device since boot.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.13.15.1.1.5.{#SNMPINDEX}

• Change per second

MIB: UCD-DISKIO-MIB

The number of write accesses from this device since boot.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.13.15.1.1.6.{#SNMPINDEX}

• Change per second

MIB: UCD-DISKIO-MIB

The 1 minute average load of disk (%)

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.13.15.1.1.9.{#SNMPINDEX}

This discovery will create set of per core CPU metrics from UCD-SNMP-MIB, using {#CPU.COUNT} in preprocessing. That's the only reason why LLD is used.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has spent doing nothing.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.53.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has spent running the kernel and its processes.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.52.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has spent running users' processes that are not niced.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.50.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.64.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has been servicing software interrupts.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.61.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has spent running users' processes that have been niced.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.51.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has been waiting for I/O to complete.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.54.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time the CPU has spent servicing hardware interrupts.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.56.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time spent on running a virtual CPU for a guest operating system.

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.65.0

• Change per second

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing

• SNMP walk value: 1.3.6.1.4.1.2021.11.66.0

• Change per second

• JavaScript: The text is too long. Please see the template.

CPU utilization expressed in %.

Preprocessing

• JavaScript: //Calculate utilization<br>return (100 - value)

CPU utilization is too high. The system might be slow to respond.

UCD-SNMP-MIB::dskEntry table discovery with storage filter

Preprocessing

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1h

MIB: UCD-SNMP-MIB

Intermediate data for subsequent processing.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Used storage is calculated from two portions:

dskUsedHigh

dskUsedLow

Together they compose 64-bit number.

Reserved space is not counted in.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Total storage is calculated from two portions:

dskTotalHigh

dskTotalLow

Together they compose 64-bit number.

Preprocessing

• JavaScript: The text is too long. Please see the template.

UCD-SNMP-MIB::dskEntry

Available storage space is calculated from two portions:

dskAvailHigh

dskAvailLow

Together they compose 64-bit number.

Preprocessing

• JavaScript: The text is too long. Please see the template.

UCD-SNMP-MIB::dskEntry

Space utilization is calculated as the percentage of currently used space compared to the maximum available space.

Preprocessing

• JavaScript: The text is too long. Please see the template.

MIB: UCD-SNMP-MIB

Free metadata space expressed as percentage.

Preprocessing

• JavaScript: The text is too long. Please see the template.

The volume's space usage exceeds the '{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%' limit;
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

The volume's space usage exceeds the '{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%' limit;
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

• Linux: FS [{#FSNAME}]: Space is critically low

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.

• Linux: FS [{#FSNAME}]: Running out of free inodes

Discovering interfaces from IF-MIB.

Preprocessing

• SNMP walk to JSON

• Discard unchanged with heartbeat: 1h

MIB: IF-MIB

The current operational state of the interface.

- The testing(3) state indicates that no operational packet scan be passed

- If ifAdminStatus is down(2) then ifOperStatus should be down(2)

- If ifAdminStatus is changed to up(1) then ifOperStatus should change to up(1) if the interface is ready to transmit and receive network traffic

- It should change todormant(5) if the interface is waiting for external actions (such as a serial line waiting for an incoming connection)

- It should remain in the down(2) state if and only if there is a fault that prevents it from going to the up(1) state

- It should remain in the notPresent(6) state if the interface has missing(typically, hardware) components.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.8.{#SNMPINDEX}

MIB: IF-MIB

The total number of octets received on the interface, including framing characters. This object is a 64-bit version of ifInOctets. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.31.1.1.1.6.{#SNMPINDEX}

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

The total number of octets transmitted out of the interface, including framing characters. This object is a 64-bit version of ifOutOctets.Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.31.1.1.1.10.{#SNMPINDEX}

• Change per second

• Custom multiplier: 8

MIB: IF-MIB

For packet-oriented interfaces, the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of inbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.14.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

For packet-oriented interfaces, the number of outbound packets that contained errors preventing them from being deliverable to a higher-layer protocol. For character-oriented or fixed-length interfaces, the number of outbound transmission units that contained errors preventing them from being deliverable to a higher-layer protocol. Discontinuities in the value of this counter can occur at re-initialization of the management system, and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.20.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The number of outbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.19.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The number of inbound packets which were chosen to be discarded

even though no errors had been detected to prevent their being deliverable to a higher-layer protocol.

One possible reason for discarding such a packet could be to free up buffer space.

Discontinuities in the value of this counter can occur at re-initialization of the management system,

and at other times as indicated by the value of ifCounterDiscontinuityTime.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.13.{#SNMPINDEX}

• Change per second

• Discard unchanged with heartbeat: 3m

MIB: IF-MIB

The type of interface.

Additional values for ifType are assigned by the Internet Assigned Numbers Authority (IANA),

through updating the syntax of the IANAifType textual convention.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.2.2.1.3.{#SNMPINDEX}

• Discard unchanged with heartbeat: 1d

MIB: IF-MIB

An estimate of the interface's current bandwidth in units of 1,000,000 bits per second. If this object reports a value of n, then the speed of the interface is somewhere in the range of n-500,000 to n+499,999.

For interfaces which do not vary in bandwidth or for those where no accurate estimation can be made, this object should contain the nominal bandwidth.

For a sub-layer which has no concept of bandwidth, this object should be zero.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.31.1.1.1.15.{#SNMPINDEX}

• Custom multiplier: 1000000

• Discard unchanged with heartbeat: 1h

This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

The utilization of the network interface is close to its estimated maximum bandwidth.

• Linux: Interface {#IFNAME}({#IFALIAS}): Link down

It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold.

• Linux: Interface {#IFNAME}({#IFALIAS}): Link down

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.

• Linux: Interface {#IFNAME}({#IFALIAS}): Link down

Discovering interfaces from IF-MIB and EtherLike-MIB. Interfaces with up(1) Operational Status are discovered.

Preprocessing

• SNMP walk to JSON

• Discard unchanged with heartbeat: 1h

MIB: EtherLike-MIB

The current mode of operation of the MAC entity. unknown indicates that the current duplex mode could not be determined.

Management control of the duplex mode is accomplished through the MAU MIB. When an interface does not support autonegotiation or when autonegotiation is not enabled, the duplex mode is controlled using ifMauDefaultType. When autonegotiation is supported and enabled, duplex mode is controlled using ifMauAutoNegAdvertisedBits. In either case, the currently operating duplex mode in reflected both in this object and in ifMauType.

Note that this object provides redundant information with ifMauType. Normally, redundant objects are discouraged. However, in this instance, it allows a management application to determine the duplex status of an interface without having to know every possible value of ifMauType. This was felt to be sufficiently valuable to justify the redundancy.

Reference: [IEEE 802.3 Std.], 30.3.1.1.32,aDuplexStatus.

Preprocessing

• SNMP walk value: 1.3.6.1.2.1.10.7.2.1.19.{#SNMPINDEX}

Please check autonegotiation settings and cabling.

Critical threshold of CPU utilization expressed in %.

Load per CPU considered sustainable. Tune if needed.

Used as a threshold in the memory utilization trigger.

Used as a threshold in the memory available trigger.

Warning threshold of the minimum free swap.

Link status trigger will be fired only for interfaces where the context macro equals "1".

Used as a threshold in the interface utilization trigger.

Warning threshold of error packet rate. Can be used with interface name as context.

The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping.

The upper threshold for difference of system time.

The hostname or IP address of the node_exporter host.

TCP Port node_exporter is listening on.

Disk read average response time (in ms) before the trigger fires.

Disk write average response time (in ms) before the trigger fires.

The warning threshold of the filesystem utilization.

The critical threshold of the filesystem utilization.

The warning threshold of the filesystem metadata utilization.

The critical threshold of the filesystem metadata utilization.

Used in block device discovery. Can be overridden on the host or linked template level.

Used in block device discovery. Can be overridden on the host or linked template level.

Used for network interface discovery. Can be overridden on the host or linked template level.

Filters out loopbacks, nulls, docker veth links and docker0 bridge by default.

Used in network interface discovery rule filters.

Ignore notpresent(1).

Used in network interface discovery rule filters.

Used in network interface discovery rule filters.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Used in filesystem discovery. Can be overridden on the host or linked template level.

Preprocessing

• Prometheus pattern: node_exporter_build_info label version

• Discard unchanged with heartbeat: 1d

Preprocessing

• Prometheus pattern: VALUE({__name__=~"^node_boot_time(?:_seconds)?$"})

The local system time of the host.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"^node_time(?:_seconds)?$"})

The host name of the system.

Preprocessing

• Prometheus pattern: node_uname_info label nodename

• Discard unchanged with heartbeat: 1d

Labeled system information as provided by the uname system call.

Preprocessing

• Prometheus to JSON: node_uname_info

• JavaScript: The text is too long. Please see the template.

• Discard unchanged with heartbeat: 1d

May be increased by using sysctl utility or modifying the file /etc/sysctl.conf.

Preprocessing

• Prometheus pattern: VALUE(node_filefd_maximum)

• Discard unchanged with heartbeat: 1d

Preprocessing

• Prometheus pattern: VALUE(node_filefd_allocated)

Preprocessing

• Discard unchanged with heartbeat: 1d

Preprocessing

• Prometheus pattern: node_uname_info label machine

• Discard unchanged with heartbeat: 1d

The system uptime expressed in the following format: "N days, hh:mm:ss".

Preprocessing

• Prometheus pattern: VALUE({__name__=~"^node_boot_time(?:_seconds)?$"})

• JavaScript: The text is too long. Please see the template.

Calculated as the system CPU load divided by the number of CPU cores.

Preprocessing

• Prometheus pattern: VALUE(node_load1)

Calculated as the system CPU load divided by the number of CPU cores.

Preprocessing

• Prometheus pattern: VALUE(node_load5)

Calculated as the system CPU load divided by the number of CPU cores.

Preprocessing

• Prometheus pattern: VALUE(node_load15)

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

Time the CPU has spent doing nothing.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

CPU utilization expressed in %.

Preprocessing

• JavaScript: //Calculate utilization<br>return (100 - value)

Time the CPU has spent running the kernel and its processes.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time the CPU has spent running users' processes that are not niced.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time the CPU has spent servicing software interrupts.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time the CPU has spent running users' processes that have been niced.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time the CPU has been waiting for I/O to complete.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time the CPU has spent servicing hardware interrupts.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Time spent on running a virtual CPU for a guest operating system.

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).

Preprocessing

• Prometheus to JSON: The text is too long. Please see the template.

• JavaScript: The text is too long. Please see the template.

• Change per second

• Custom multiplier: 100

Number of interrupts processed.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_intr"})

• Change per second

The combined rate at which all processors on the computer are switched from one thread to another.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_context_switches"})

• Change per second

Percentage calculated as (total-available)/total*100.

Total memory expressed in bytes.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_memory_MemTotal"})

The available memory:

- in Linux - available = free + buffers + cache;

- on other platforms calculation may vary.

See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_memory_MemAvailable"})

Total space of the swap volume/file expressed in bytes.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_memory_SwapTotal"})

The free space of the swap volume/file expressed in bytes.

Preprocessing

• Prometheus pattern: VALUE({__name__=~"node_memory_SwapFree"})

The free space of the swap volume/file expressed in %.

Failed to fetch system metrics from node_exporter in time.

The host's system time is different from Zabbix server time.

The name of the system has changed. Acknowledge to close the problem manually.

• Linux: Running out of file descriptors

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.

• Linux: System name has changed

The device uptime is less than 10 minutes.

The load average per CPU is too high. The system may be slow to respond.

The CPU utilization is too high. The system might be slow to respond.

• Linux: Load average is too high

The system is running out of free memory.

• Linux: Lack of available memory

If there is no swap configured, this trigger is ignored.

• Linux: Lack of available memory
• Linux: High memory utilization

Discovery of network interfaces. Requires node_exporter v0.18 and up.

Preprocessing

• Prometheus to JSON: {__name__=~"^node_network_info$"}

Preprocessing

• Prometheus pattern: VALUE(node_network_receive_bytes_total{device="{#IFNAME}"})

• Change per second

• Custom multiplier: 8

Preprocessing

• Prometheus pattern: VALUE(node_network_transmit_bytes_total{device="{#IFNAME}"})

• Change per second

• Custom multiplier: 8

Preprocessing

• Prometheus pattern: VALUE(node_network_transmit_errs_total{device="{#IFNAME}"})

• Change per second

Preprocessing

• Prometheus pattern: VALUE(node_network_receive_errs_total{device="{#IFNAME}"})

• Change per second

Preprocessing

• Prometheus pattern: VALUE(node_network_receive_drop_total{device="{#IFNAME}"})

• Change per second

Preprocessing

• Prometheus pattern: VALUE(node_network_transmit_drop_total{device="{#IFNAME}"})

• Change per second

Sets value to "0" if metric is missing in node_exporter output.

Preprocessing

• Prometheus pattern: VALUE(node_network_speed_bytes{device="{#IFNAME}"})

  ⛔️Custom on fail: Set value to: 0

• Custom multiplier: 8

nodenetworkprotocoltype protocoltype value of /sys/class/net/.

Preprocessing

• Prometheus pattern: VALUE(node_network_protocol_type{device="{#IFNAME}"})

Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt

Preprocessing

• Prometheus pattern: node_network_info{device="{#IFNAME}"} label operstate

• JavaScript: The text is too long. Please see the template.