This is the documentation page for an unsupported version of Zabbix.
Is this not what you were looking for? Switch to the current version or choose one from the drop-down menu.

Configuring a network discovery rule


To configure a network discovery rule used by Zabbix to discover hosts and services:

  • Go to Configuration → Discovery
  • Click on Create rule (or on the rule name to edit an existing one)
  • Edit the discovery rule attributes

Rule attributes

Parameter Description
Name Unique name of the rule. For example, "Local network".
Discovery by proxy What performs discovery:
no proxy - Zabbix server is doing discovery
<proxy name> - this proxy performs discovery
IP range The range of IP addresses for discovery. It may have the following formats:
Single IP:
Range of IP addresses:
IP mask:
supported IP masks:
/16 - /30 for IPv4 addresses
/112 - /128 for IPv6 addresses
Note: Each IP address should be included only once; having multiple rules for a single IP address can have unexpected behavior such as having deadlocks and/or duplicate hosts in the database. The same could happen if two hosts having the same DNS name are included in separate discovery rules.
Delay (seconds) This parameter defines how often Zabbix will execute the rule.
Delay is measured after the execution of previous discovery instance ends so there is no overlap.
Checks Zabbix will use this list of checks for discovery.
Supported checks: SSH, LDAP, SMTP, FTP, HTTP, POP, NNTP, IMAP, TCP, Zabbix agent, SNMPv1 agent, SNMPv2 agent, SNMPv3 agent, ICMP ping.
A protocol-based discovery uses the net.tcp.service[] functionality to test each host, except for SNMP which queries an SNMP OID. Zabbix agent is tested by querying an item. Please see agent items for more details.
The 'Ports' parameter may be one of following:
Single port: 22
Range of ports: 22-45
List: 22-45,55,60-70
Device uniqueness criteria Uniqueness criteria may be:
IP address - no processing of multiple single-IP devices. If a device with the same IP already exists it will be considered already discovered and a new host will not be added.
Type of discovery check - either SNMP or Zabbix agent check.
Status Active - the rule is active and will be executed by Zabbix server
Disabled - the rule is not active. It won't be executed.

A real life scenario

In this example we would like to set up network discovery for the local network having an IP range of

In our scenario we want to:

  • discover those hosts that have Zabbix agent running
  • run discovery every 10 minutes
  • add a host to monitoring if the host uptime is more than 1 hour
  • remove hosts if the host downtime is more than 24 hours
  • add Linux hosts to the "Linux servers" group
  • add Windows hosts to the "Windows servers" group
  • use Template_Linux for Linux hosts
  • use Template_Windows for Windows hosts
Step 1

Defining a network discovery rule for our IP range.

Zabbix will try to discover hosts in the IP range of by connecting to Zabbix agents and getting the value from system.uname key. The value received from the agent can be used to apply different actions for different operating systems. For example, link Windows servers to Template_Windows, Linux servers to Template_Linux.

The rule will be executed every 10 minutes (600 seconds).

With this rule is added, Zabbix will automatically start the discovery and generating discovery-based events for further processing.

Step 2

Defining an action for adding the discovered Linux servers to the respective group/template.

The action will be activated if:

  • the "Zabbix agent" service is "up"
  • the value of system.uname (the Zabbix agent key we used in rule definition) contains "Linux"
  • Uptime is more than 1 hour (3600 seconds)

The action will execute the following operations:

  • add the discovered host to the "Linux servers" group (and also add host if it wasn't added previously)
  • link host to the "Template_Linux" template. Zabbix will automatically start monitoring the host using items and triggers from "Template_Linux".
Step 3

Defining an action for adding the discovered Windows servers to the respective group/template.

Step 4

Defining an action for removing lost servers.

A server will be removed if "Zabbix agent" service is 'down' for more than 24 hours (86400 seconds).