Zabbix Documentation 3.0

2.23.04.04.2 (current)In development:4.4 (devel)Unsupported:1.82.02.43.23.4

User Tools

Site Tools


Sidebar

manual:config:items:itemtypes:zabbix_agent

This is an old revision of the document!


1 Zabbix agent

Overview

These checks use the communication with Zabbix agent for data gathering.

There are passive and active agent checks. When configuring an item, you can select the required type:

  • Zabbix agent - for passive checks
  • Zabbix agent (active) - for active checks

Supported item keys

The table provides details on the item keys that you can use with Zabbix agent items.

See also:

Mandatory and optional parameters

Parameters without angle brackets are mandatory. Parameters marked with angle brackets < > are optional.

Key
Description Return value Parameters Comments
agent.hostname
Agent host name. String Returns the actual value of the agent hostname from a configuration file.
agent.ping
Agent availability check. Nothing - unavailable

1 - available
Use the nodata() trigger function to check for host unavailability.
agent.version
Version of Zabbix agent. String Example of returned value:
1.8.2
kernel.maxfiles
Maximum number of opened files supported by OS. Integer
kernel.maxproc
Maximum number of processes supported by OS. Integer
log[file,<regexp>,<encoding>,<maxlines>,<mode>,<output>]
Log file monitoring. Log file - full path and name of log file
regexp - regular expression describing the required pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode - possible values:
all (default), skip - skip processing of older data (affects only newly created items).
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
The item must be configured as an active check.
If file is missing or permissions do not allow access, item turns unsupported.

If output is left empty - the whole line containing the matched text is returned. Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the output parameter is ignored.

Content extraction using the output parameter takes place on the agent.

Examples:
⇒ log[/var/log/syslog]
⇒ log[/var/log/syslog,error]
⇒ log[/home/zabbix/logs/logfile,,,100]

Example of using output parameter for extracting a number from log record:
log[/app1/app.log,"task run [0-9.]+ sec, processed ([0-9]+) records, [0-9]+ errors",,,,\1]→ will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send only number 6080 to server. Because a number is being sent, the "Type of information" for this log item can be changed from "Log" to "Numeric (unsigned)" and the value can be used in graphs, triggers etc.

Example of using output parameter for rewriting log record before sending to server:
log[/app1/app.log,"([0-9 :-]+) task run ([0-9.]+) sec, processed ([0-9]+) records, ([0-9]+) errors",,,,"\1 RECORDS: \3, ERRORS: \4, DURATION: \2"]→ will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors " and send a modified record "2015-11-13 10:08:26 RECORDS: 6080, ERRORS: 0, DURATION: 6.08" to server.

The output parameter is supported since Zabbix 2.2.
The mode parameter is supported since Zabbix 2.0.

See also additional information on log monitoring.
logrt[file_regexp,<regexp>,<encoding>,<maxlines>,<mode>,<output>]
Log file monitoring with log rotation support. Log file_regexp - absolute path to file and regexp describing the file name pattern
regexp - regular expression describing the required content pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode - possible values:
all (default), skip - skip processing of older data (affects only newly created items).
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
The item must be configured as an active check.
Log rotation is based on the last modification time of files.

If output is left empty - the whole line containing the matched text is returned. Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the output parameter is ignored.

Content extraction using the output parameter takes place on the agent.

Examples:
⇒ logrt["/home/zabbix/logs/^logfile[0-9]{1,3}$",,,100] → will match a file like "logfile1" (will not match ".logfile1")
⇒ logrt["/home/user/^logfile_.*_[0-9]{1,3}$","pattern_to_match","UTF-8",100] → will collect data from files such "logfile_abc_1" or "logfile__001".

Example of using output parameter for extracting a number from log record:
logrt[/app1/^test.*log$,"task run [0-9.]+ sec, processed ([0-9]+) records, [0-9]+ errors",,,,\1]→ will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send only number 6080 to server. Because a number is being sent, the "Type of information" for this log item can be changed from "Log" to "Numeric (unsigned)" and the value can be used in graphs, triggers etc.

Example of using output parameter for rewriting log record before sending to server:
logrt[/app1/^test.*log$,"([0-9 :-]+) task run ([0-9.]+) sec, processed ([0-9]+) records, ([0-9]+) errors",,,,"\1 RECORDS: \3, ERRORS: \4, DURATION: \2"]→ will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors " and send a modified record "2015-11-13 10:08:26 RECORDS: 6080, ERRORS: 0, DURATION: 6.08" to server.

The output parameter is supported since Zabbix 2.2.
The mode parameter is supported since Zabbix 2.0.

See also additional information on log monitoring.
net.dns[<ip>,name,<type>,<timeout>,<count>,<protocol>]
Checks if DNS service is up. 0 - DNS is down (server did not respond or DNS resolution failed)

1 - DNS is up
ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows)
name - DNS name to query
type - record type to be queried (default is SOA)
timeout (ignored on Windows) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows) - number of tries for the request (default is 2)
protocol - the protocol used to perform DNS queries: udp (default) or tcp
Example:
⇒ net.dns[8.8.8.8,zabbix.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (except for Windows), HINFO, MINFO, TXT, SRV

Internationalized domain names are not supported, please use IDNA encoded names instead.

The protocol parameter is supported since Zabbix 3.0.
SRV record type is supported since Zabbix agent versions 1.8.6 (Unix) and 2.0.0 (Windows).

Naming before Zabbix 2.0 (still supported): net.tcp.dns
net.dns.record[<ip>,name,<type>,<timeout>,<count>,<protocol>]
Performs a DNS query. Character string with the required type of information ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows)
name - DNS name to query
type - record type to be queried (default is SOA)
timeout (ignored on Windows) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows) - number of tries for the request (default is 2)
protocol - the protocol used to perform DNS queries: udp (default) or tcp
Example:
⇒ net.dns.record[8.8.8.8,zabbix.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (except for Windows), HINFO, MINFO, TXT, SRV

Internationalized domain names are not supported, please use IDNA encoded names instead.

The protocol parameter is supported since Zabbix 3.0.
SRV record type is supported since Zabbix agent versions 1.8.6 (Unix) and 2.0.0 (Windows).

Naming before Zabbix 2.0 (still supported): net.tcp.dns.query
net.if.collisions[if]
Number of out-of-window collisions. Integer if - network interface name
net.if.discovery
List of network interfaces. Used for low-level discovery. JSON object Supported since Zabbix agent version 2.0.

On FreeBSD, OpenBSD and NetBSD supported since Zabbix agent version 2.2.

Some Windows versions (for example, Server 2008) might require the latest updates installed to support non-ASCII characters in interface names.
net.if.in[if,<mode>]
Incoming traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.

Multi-byte interface names on Windows are supported since Zabbix agent version 1.8.6.

Examples:
⇒ net.if.in[eth0,errors]
⇒ net.if.in[eth0]

You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.

You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.
net.if.out[if,<mode>]
Outgoing traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.

Multi-byte interface names on Windows are supported since Zabbix agent 1.8.6 version.

Examples:
⇒ net.if.out[eth0,errors]
⇒ net.if.out[eth0]

You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.

You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.
net.if.total[if,<mode>]
Sum of incoming and outgoing traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.

Examples:
⇒ net.if.total[eth0,errors]
⇒ net.if.total[eth0]

You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.

You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.

Note that dropped packets are supported only if both net.if.in and net.if.out work for dropped packets on your platform.
net.tcp.listen[port]
Checks if this TCP port is in LISTEN state. 0 - it is not in LISTEN state

1 - it is in LISTEN state
port - TCP port number Example:
⇒ net.tcp.listen[80]

On Linux supported since Zabbix agent version 1.8.4

Since Zabbix 3.0.0, on Linux kernels 2.6.14 and above, information about listening TCP sockets is obtained from the kernel's NETLINK interface, if possible. Otherwise, the information is retrieved from /proc/net/tcp and /proc/net/tcp6 files.
net.tcp.port[<ip>,port]
Checks if it is possible to make TCP connection to specified port. 0 - cannot connect

1 - can connect
ip - IP address (default is 127.0.0.1)
port - port number
Example:
⇒ net.tcp.port[,80] → can be used to test availability of web server running on port 80.

For simple TCP performance testing use net.tcp.service.perf[tcp,<ip>,<port>]

Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).

Old naming: check_port[*]
net.tcp.service[service,<ip>,<port>]
Checks if service is running and accepting TCP connections. 0 - service is down

1 - service is running
service - either of:
ssh, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example:
⇒ net.tcp.service[ftp,,45] → can be used to test the availability of FTP server on TCP port 45.

Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).

Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.port for checks like these.

Checking of LDAP and HTTPS by Windows agent is currently not supported.

Note that the telnet check looks for a login prompt (':' at the end).

See also known issues of checking HTTPS service.

https and telnet services are supported since Zabbix 2.0.

Old naming: check_service[*]
net.tcp.service.perf[service,<ip>,<port>]
Checks performance of TCP service. 0 - service is down

seconds - the number of seconds spent while connecting to the service
service - either of:
ssh, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example:
⇒ net.tcp.service.perf[ssh] → can be used to test the speed of initial response from SSH server.

Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.service.perf[tcp,<ip>,<port>] for checks like these.

Checking of LDAP and HTTPS by Windows agent is currently not supported.

Note that the telnet check looks for a login prompt (':' at the end).

See also known issues of checking HTTPS service.

https and telnet services are supported since Zabbix 2.0.

Old naming: check_service_perf[*]
net.udp.listen[port]
Checks if this UDP port is in LISTEN state. 0 - it is not in LISTEN state

1 - it is in LISTEN state
port - UDP port number Example:
⇒ net.udp.listen[68]

On Linux supported since Zabbix agent version 1.8.4
net.udp.service[service,<ip>,<port>]
Checks if service is running and responding to UDP requests. 0 - service is down

1 - service is running
service - ntp (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example:
⇒ net.udp.service[ntp,,45] → can be used to test the availability of NTP service on UDP port 45.

This item is supported since Zabbix 3.0.0, but ntp service was available for net.tcp.service[] item in prior versions.
net.udp.service.perf[service,<ip>,<port>]
Checks performance of UDP service. 0 - service is down

seconds - the number of seconds spent waiting for response from the service
service - ntp (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example:
⇒ net.udp.service.perf[ntp] → can be used to test response time from NTP service.

This item is supported since Zabbix 3.0.0, but ntp service was available for net.tcp.service[] item in prior versions.
proc.cpu.util[<name>,<user>,<type>,<cmdline>,<mode>,<zone>]
Process CPU utilisation percentage. Float name - process name (default is all processes)
user - user name (default is all users)
type - CPU utilisation type:
total (default), user, system
cmdline - filter by command line (it is a regular expression)
mode - data gathering mode: avg1 (default), avg5, avg15
zone - target zone: current (default), all. This parameter is supported only on Solaris platform.
Examples:
⇒ proc.cpu.util[,root] → CPU utilisation of all processes running under the “root” user
⇒ proc.cpu.util[zabbix_server,zabbix] → CPU utilisation of all zabbix_server processes running under the zabbix user

The returned value is based on single CPU core utilisation percentage. For example CPU utilisation of a process fully using two cores is 200%.

The process CPU utilisation data is gathered by a collector which supports the maximum of 1024 unique (by name, user and command line) queries. Queries not accessed during the last 24 hours are removed from the collector.

Note that when setting the zone parameter to current (or default) in case the agent has been compiled on a Solaris without zone support, but running on a newer Solaris where zones are supported, then the agent since Zabbix 3.0.3 will return NOTSUPPORTED (the agent cannot limit results to only the current zone). However, all is supported in this case.

This key is supported since Zabbix 3.0.0 and is available on several platforms (see Items supported by platform).
proc.mem[<name>,<user>,<mode>,<cmdline>,<memtype>]
Memory used by process in bytes. Integer name - process name (default is all processes)
user - user name (default is all users)
mode - possible values:
avg, max, min, sum (default)
cmdline - filter by command line (it is a regular expression)
memtype - type of memory used by process
Examples:
⇒ proc.mem[,root] → memory used by all processes running under the “root” user
⇒ proc.mem[zabbix_server,zabbix] → memory used by all zabbix_server processes running under the zabbix user
⇒ proc.mem[,oracle,max,oracleZABBIX] → memory used by the most memory-hungry process running under oracle having oracleZABBIX in its command line

Note: When several processes use shared memory, the sum of memory used by processes may result in large, unrealistic values.

See notes on selecting processes with name and cmdline parameters (Linux-specific).

When this item is invoked from the command line and contains a command line parameter (e.g. using the agent test mode: zabbix_agentd -t proc.num[,,,apache2]), one extra process will be counted, as the agent will count itself.

The memtype parameter is supported on several platforms since Zabbix 3.0.0.
proc.num[<name>,<user>,<state>,<cmdline>,<zone>]
The number of processes. Integer name - process name (default is all processes)
user - user name (default is all users)
state - possible values: all (default), run, sleep, zomb
cmdline - filter by command line (it is a regular expression)
zone - target zone: current (default), all. This parameter is supported on Solaris only.