User Tools

Site Tools


2.2:manual:config:items:itemtypes:zabbix_agent

1 Zabbix agent

Overview

These checks use the communication with Zabbix agent for data gathering.

There are passive and active agent checks. When configuring an item, you can select the required type:

  • Zabbix agent - for passive checks
  • Zabbix agent (active) - for active checks

Supported item keys

The table provides details on the item keys that you can use with Zabbix agent items.

See also:

Key
Description Return value Parameters Comments
agent.hostname
Returns agent host name. String value - Returns the actual value of the agent hostname from a configuration file.
agent.ping
Check the agent availability. Returns '1' if agent is available, nothing if unavailable. - Use function nodata() to check for host unavailability.
agent.version
Version of Zabbix agent. String - Example of returned value: 1.8.2
kernel.maxfiles
Maximum number of opened files supported by OS. Number of files. Integer.
kernel.maxproc
Maximum number of processes supported by OS. Number of processes.
Integer.
log[file,<regexp>,<encoding>,<maxlines>,<mode>,<output>]
Monitoring of log file. Log. file - full path and name of log file
regexp - regular expression describing the required pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode - possible values:
all (default), skip (skip processing of older data).
The mode parameter is supported from version 2.0.
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
If <output> is left empty - the whole line containing the matched text is returned.
Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the <output> parameter is ignored.
The output parameter is supported from version 2.2.
The item must be configured as an active check.
If file is missing or permissions do not allow access, item turns unsupported.

Examples:
log[/var/log/syslog]
log[/var/log/syslog,error]
log[/home/zabbix/logs/logfile,,,100]

See also additional information on log monitoring.
logrt[file_pattern,<regexp>,<encoding>,<maxlines>,<mode>,<output>]
Monitoring of log file with log rotation support. Log. file_pattern - absolute path to file and regexp describing the file name pattern
regexp - regular expression describing the required content pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode - possible values:
all (default), skip (skip processing of older data).
The mode parameter is supported from version 2.0.
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
If <output> is left empty - the whole line containing the matched text is returned.
Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the <output> parameter is ignored.
The output parameter is supported from version 2.2.
The item must be configured as an active check.
Log rotation is based on the last modification time of files.

Examples:
logrt["/home/zabbix/logs/^logfile[0-9]{1,3}$",,,100] - will match a file like "logfile1" (will not match ".logfile1")
logrt["/home/user/logfile_.*_[0-9]{1,3}","pattern_to_match","UTF-8",100] - will collect data from files such “logfile_abc_1” or “logfile__001”.

See also additional information on log monitoring.
net.dns[<ip>,zone,<type>,<timeout>,<count>]
Checks if DNS service is up. 0 - DNS is down (server did not respond or DNS resolution failed)
1 - DNS is up
ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows)
zone - zone to test the DNS
type - record type to be queried (default is SOA)
timeout (ignored on Windows) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows) - number of tries for the request (default is 2)
Example key:
net.dns[8.8.8.8,zabbix.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (except for Windows), HINFO, MINFO, TXT, SRV

SRV record type is supported since Zabbix agent versions 1.8.6 (Unix) and 2.0.0 (Windows).

Internationalized domain names are not supported, please use IDNA encoded names instead.

Naming before Zabbix 2.0 (still supported): net.tcp.dns
net.dns.record[<ip>,zone,<type>,<timeout>,<count>]
Performs a DNS query. On success returns a character string with the required type of information. ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows)
zone - zone to test the DNS
type - record type to be queried (default is SOA)
timeout (ignored on Windows) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows) - number of tries for the request (default is 2)
Example key:
net.dns.record[8.8.8.8,zabbix.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (except for Windows), HINFO, MINFO, TXT, SRV

SRV record type is supported since Zabbix agent versions 1.8.6 (Unix) and 2.0.0 (Windows).

Internationalized domain names are not supported, please use IDNA encoded names instead.

Naming before Zabbix 2.0 (still supported): net.tcp.dns.query
net.if.collisions[if]
Out-of-window collision. Number of collisions.
Integer.
if - interface
net.if.discovery
List of network interfaces. Used for low-level discovery. JSON object Supported since Zabbix agent version 2.0.

On FreeBSD, OpenBSD and NetBSD supported since Zabbix agent version 2.2.
net.if.in[if,<mode>]
Incoming traffic statistics on network interface. Integer. if - network interface name
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
Multi-byte interface names on Windows are supported since Zabbix agent version 1.8.6.

Example keys:
net.if.in[eth0,errors]
net.if.in[eth0]

You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.
net.if.out[if,<mode>]
Outgoing traffic statistics on network interface. Integer. if - network interface name
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
Multi-byte interface names on Windows are supported since Zabbix agent 1.8.6 version.

Example keys:
net.if.out[eth0,errors]
net.if.out[eth0]

You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.
net.if.total[if,<mode>]
Sum of incoming and outgoing traffic statistics on network interface. Integer. if - network interface name
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
Example keys:
net.if.total[eth0,errors]
net.if.total[eth0]
You may use this key with a Delta (speed per second) store value in order to get bytes per second statistics.
Note that dropped packets are supported only if both net.if.in and net.if.out work for dropped packets on your platform.
net.tcp.listen[port]
Checks if this TCP port is in LISTEN state. 0 - it is not
1 - it is in LISTEN state
port - TCP port number Example:
net.tcp.listen[80]

On Linux supported since Zabbix agent version 1.8.4
net.tcp.port[<ip>,port]
Check, if it is possible to make TCP connection to port number port. 0 - cannot connect
1 - can connect
ip - IP address(default is 127.0.0.1)
port - port number
Example:
net.tcp.port[,80] can be used to test availability of web server running on port 80.
Old naming: check_port[*]
For simple TCP performance testing use net.tcp.service.perf[tcp,<ip>,<port>]
Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).
net.tcp.service[service,<ip>,<port>]
Checks if service is running and accepting TCP connections. 0 - service is down
1 - service is running
service - either of:
ssh, ntp, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example key:
net.tcp.service[ftp,,45] - can be used to test the availability of FTP server on TCP port 45.
Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).
Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.port for checks like these.
Checking of LDAP and HTTPS by Windows agent is currently not supported.
Note that the telnet check looks for a prompt (':' at the end).
Old naming: check_service[*]
Note that before Zabbix 1.8.3 version service.ntp should be used instead of ntp.
https and telnet services are supported since Zabbix 2.0.
net.tcp.service.perf[service,<ip>,<port>]
Checks performance of service. 0 - service is down;
seconds - the number of seconds spent while connecting to the service
service - either of:
ssh, ntp, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
Example key:
net.tcp.service.perf[ssh] - can be used to test the speed of initial response from SSH server.
Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.service.perf[tcp,<ip>,<port>] for checks like these.
Checking of LDAP and HTTPS by Windows agent is currently not supported.
Note that the telnet check looks for a prompt (':' at the end).
Old naming: check_service_perf[*]
Note that before Zabbix 1.8.3 version service.ntp should be used instead of ntp.
https and telnet services are supported since Zabbix 2.0.
net.udp.listen[port]
Checks if this UDP port is in LISTEN state. 0 - it is not
1 - it is in LISTEN state
port - UDP port number Example:
net.udp.listen[68]

On Linux supported since Zabbix agent version 1.8.4
proc.mem[<name>,<user>,<mode>,<cmdline>]
Memory used by process running under some user. Memory used by process (in bytes). name - process name (default is “all processes”)
user - user name (default is “all users”)
mode - possible values:
avg, max, min, sum (default)
cmdline - filter by command line (it is a regular expression)
Example keys:
proc.mem[,root] - memory used by all processes running under the “root” user
proc.mem[zabbix_server,zabbix] - memory used by all zabbix_server processes running under the zabbix user
proc.mem[,oracle,max,oracleZABBIX] - memory used by the most memory-hungry process running under oracle having oracleZABBIX in its command line
proc.num[<name>,<user>,<state>,<cmdline>]
The number of processes having certain state running under some user. Number of processes. name - process name (default is “all processes”)
user - user name (default is “all users”)
state - possible values: all (default), run, sleep, zomb
cmdline - filter by command line (it is a regular expression)
Example keys:
proc.num[,mysql] - number of processes running under the mysql user
proc.num[apache2,www-data] - number of apache2 processes running under the www-data user
proc.num[,oracle,sleep,oracleZABBIX] - number of processes in sleep state running under oracle having oracleZABBIX in its command line
On Windows, only the name and user parameters are supported.
sensor[device,sensor,<mode>]
Hardware sensor reading. device - device name
sensor - sensor name
mode - possible values:
avg, max, min (if this parameter is omitted, device and sensor are treated verbatim).
On Linux 2.4, reads /proc/sys/dev/sensors.
Example key:
sensor[w83781d-i2c-0-2d,temp1]
Prior to Zabbix 1.8.4, the sensor[temp1] format was used.

On Linux 2.6+, reads /sys/class/hwmon.

See a more detailed description of sensor item on Linux.

On OpenBSD, reads the hw.sensors MIB.
Example keys:
sensor[cpu0,temp0] - one temperature of one CPU
sensor[cpu[0-2]$,temp,avg] - average temperature of the first three CPU's
Supported on OpenBSD since Zabbix 1.8.4.
system.boottime
Timestamp of system boot. Integer. A UNIX timestamp (date and time, down to a second) returned.
system.cpu.intr
Device interrupts. Integer.
system.cpu.load[<cpu>,<mode>]
CPU load.Processor load.
Float.
cpu - possible values:
all (default), percpu (total load divided by online CPU count)
mode - possible values:
avg1 (one-minute average, default), avg5 (5-minute average), avg15 (an average within 15 minutes)
Example key:
system.cpu.load[,avg5]

Old naming: system.cpu.loadX
Parameter percpu is supported since Zabbix 2.0.0.
system.cpu.num[<type>]
Number of CPUs. Number of available processors. type - possible values:
online (default), max
Example key:
system.cpu.num
system.cpu.switches
Context switches. Switches count. Old naming: system[switches]
system.cpu.util[<cpu>,<type>,<mode>]
CPU(s) utilisation. Processor utilisation in percent. cpu - CPU number (default is all CPUs)
type - possible values:
idle, nice, user (default), system (default for Windows), iowait, interrupt, softirq, steal
mode - possible values:
avg1 (one-minute average, default), avg5 (5-minute average), avg15 (an average within 15 minutes)
Example key:
system.cpu.util[0,user,avg5]

Old naming: system.cpu.idleX, system.cpu.niceX, system.cpu.systemX, system.cpu.userX
system.hostname[<type>]
Returns host name. String value type (Windows only, must not be used on other systems) - possible values: netbios (default) or host The value is acquired by either GetComputerName() (for netbios) or gethostname() (for host) functions on Windows and by “hostname” command on other systems.
The type parameter for this item is supported since 1.8.6 version.

Examples of returned values:
on Linux:
system.hostname → linux-w7x1
system.hostname → www.zabbix.com
on Windows:
system.hostname → WIN-SERV2008-I6
system.hostname[host] → Win-Serv2008-I6LonG

See also a more detailed description.
system.hw.chassis[<info>]
Returns chassis info String value info - one of full (default), model, serial, type or vendor Example: system.hw.chassis[full]
Hewlett-Packard HP Pro 3010 Small Form Factor PC CZXXXXXXXX Desktop]

Root permissions are required because the value is acquired by reading from memory.

Supported since Zabbix agent version 2.0.
system.hw.cpu[<cpu>,<info>]
Returns CPU info String or numeric value cpu - CPU number or all (default)
info - one of full (default), curfreq, maxfreq, model or vendor
Example: system.hw.cpu[0,vendor]
AuthenticAMD

Gathers info from /proc/cpuinfo and /sys/devices/system/cpu/[cpunum]/cpufreq/cpuinfo_max_freq.
If a CPU number and curfreq or maxfreq is specified, a numeric value is returned (Hz).

Supported since Zabbix agent version 2.0.
system.hw.devices[<type>]
Lists PCI or USB devices Text value type - pci (default) or usb Example: system.hw.devices[pci]
00:00.0 Host bridge: Advanced Micro Devices [AMD] RS780 Host Bridge
[..]

Returns the output of either lspci or lsusb utility (executed without any parameters)

Supported since Zabbix agent version 2.0.
system.hw.macaddr[<interface>,<format>]
Lists MAC addresses String value interface - all (default) or a regular expression
format - full (default) or short
Example: system.hw.macaddr["eth0$",full]
[eth0] 00:11:22:33:44:55

Lists MAC adresses of the interfaces whose names match the given interface regexp (“all” lists for all interfaces).
If format is specified as short, interface names and identical MAC addresses are not listed.

Supported since Zabbix agent version 2.0.
system.localtime[<type>]
System time. Integer or string value. utc - (default) the time since the Epoch (00:00:00 UTC, January 1, 1970), measured in seconds.
local - the time in the 'yyyy-mm-dd,hh:mm:ss.nnn,+hh:mm' format
Parameters for this item supported from version 2.0.
system.run[command,<mode>]
Run specified command on the host. Text result of the command. command - command for execution
mode - one of wait (default, wait end of execution), nowait (do not wait)
Up to 512KB of data can be returned, including trailing whitespace that is truncated.
To be processed correctly, the output of the command must be text.
Example:
system.run[ls -l /] - detailed file list of root directory.
Note: To enable this functionality, agent configuration file must have EnableRemoteCommands=1 option.
system.stat[resource,<type>]
Virtual memory statistics Numeric value ent - number of processor units this partition is entitled to receive (float)
kthr,<type> - information about kernel thread states:
r - average number of runnable kernel threads (float)
b - average number of kernel threads placed in the Virtual Memory Manager wait queue (float)
memory,<type> - information about the usage of virtual and real memory:
avm - active virtual pages (integer)
fre - size of the free list (integer)
page,<type> - information about page faults and paging activity:
fi - file page-ins per second (float)
fo - file page-outs per second (float)
pi - pages paged in from paging space (float)
po - pages paged out to paging space (float)
fr - pages freed (page replacement) (float)
sr - pages scanned by page-replacement algorithm (float)
faults,<type> - trap and interrupt rate:
in - device interrupts (float)
sy - system calls (float)
cs - kernel thread context switches (float)
cpu,<type> - breakdown of percentage usage of processor time:
us - user time (float)
sy - system time (float)
id - idle time (float)
wa - idle time during which the system had outstanding disk/NFS I/O request(s) (float)
pc - number of physical processors consumed (float)
ec - the percentage of entitled capacity consumed (float)
lbusy - indicates the percentage of logical processor(s) utilization that occurred while executing at the user and system level (float)
app - indicates the available physical processors in the shared pool (float)
disk,<type> - disk statistics:
bps - indicates the amount of data transferred (read or written) to the drive in bytes per second (integer)
tps - indicates the number of transfers per second that were issued to the physical disk/tape (float)
This item is supported starting from version 1.8.1.
system.sw.arch
Returns software architecture String value Example: system.sw.arch
i686

Info is acquired from uname() function.

Supported since Zabbix agent version 2.0.
system.sw.os[<info>]
Returns OS info String value info - one of full (default), short or name Example: system.sw.os[short]
Ubuntu 2.6.35-28.50-generic 2.6.35.11

Info is acquired from (note that not all files are present in all distributions):
[full] - /proc/version
[short] - /proc/version_signature
[name] - /etc/issue.net

Supported since Zabbix agent version 2.0.
system.sw.packages[<package>,<manager>,<format>]
Lists installed packages Text value package - all (default) or a regular expression
manager - all (default) or a package manager
format - full (default) or short
Example: system.sw.packages[mini,dpkg,short]
python-minimal, python2.6-minimal, ubuntu-minimal

Lists (alphabetically) installed packages whose names match the given package regexp (“all” lists them all).

Supported packages managers:
manager (executed command)
dpkg (dpkg --get-selections)
pkgtool (ls /var/log/packages)
rpm (rpm -qa)
pacman (pacman -Q)

If format is specified as full, packages are grouped by package managers (each manager on a seperate line beginning with it's name in square brackets).
If format is specified as short, packages are not grouped and are listed on a single line.

Supported since Zabbix agent version 2.0.
system.swap.in[<device>,<type>]
Swap in (from device into memory) statistics. Numeric value device - device used for swapping (default is all)
type - possible values:
count (number of swapins), sectors (sectors swapped in), pages (pages swapped in). See supported by platform for details on defaults.
Example key:
system.swap.in[,pages]

The source of this information is:
Linux 2.4:
/proc/swaps, /proc/partitions, /proc/stat
Linux 2.6:
/proc/swaps, /proc/diskstats, /proc/vmstat
system.swap.out[<device>,<type>]
Swap out (from memory onto device) statistics. Numeric value device - device used for swapping (default is all)
type - possible values:
count (number of swapouts), sectors (sectors swapped out), pages (pages swapped out). See supported by platform for details on defaults.
Example key:
system.swap.out[,pages]

The source of this information is:
Linux 2.4:
/proc/swaps, /proc/partitions, /proc/stat
Linux 2.6:
/proc/swaps, /proc/diskstats, /proc/vmstat
system.swap.size[<device>,<type>]
Swap space size. Number of bytes or percentage. device - device used for swapping (default is all)
type - possible values:
free (free swap space, default), pfree (free swap space, in percent), pused (used swap space, in percent), total (total swap space), used (used swap space)
Example key:
system.swap.size[,pfree] - free swap space percentage

Old naming: system.swap.free, system.swap.total
system.uname
Returns detailed host information. String value Example of returned value:
FreeBSD localhost 4.2-RELEASE FreeBSD 4.2-RELEASE #0: Mon Nov i386

Since Zabbix 2.2.0, the value for this item is obtained by using the uname() system call, whereas previously it was obtained by invoking “uname -a” on Unix systems. Hence, the value of this item might differ from the output of “uname -a” and does not include additional information that “uname -a” prints based on other sources.
system.uptime
System uptime in seconds. Number of seconds. In item configuration, use s or uptime units to get readable values.
system.users.num
Number of users logged in. Number of users. who command is used on the agent side to obtain the value.
vfs.dev.read[<device>,<type>,<mode>]
Disk read statistics. Integer if type is in: sectors, operations, bytes

Float if type is in: sps, ops, bps
device - disk device (default is “all”1)
type - possible values:
sectors, operations, bytes, sps, ops, bps (must be specified, since defaults differ under various OSes).
sps, ops, bps stand for: sectors, operations, bytes per second, respectively
mode - possible values:
avg1 (one-minute average, default), avg5 (five-minute average), avg15 (15-minute average).
Note: The third parameter is supported only if the type is in: sps, ops, bps.
Default values of 'type' parameter for different OSes:
FreeBSD - bps
Linux - sps
OpenBSD - operations
Solaris - bytes

Example key: vfs.dev.read[,operations]
Old naming: io[*]

Usage of the type parameters ops, bps and sps on supported platforms used to be limited to 8 devices (7 individual devices and one “all”). Starting with Zabbix 2.0.1 this limit has been increased to 1024 (1023 individual devices and one for “all”).

Supports LVM since Zabbix 1.8.6.

Until Zabbix 1.8.6, only relative device names may be used (for example, sda), since 1.8.6 an optional /dev/ prefix may be used (for example, /dev/sda)
vfs.dev.write[<device>,<type>,<mode>]
Disk write statistics. Integer if type is in: sectors, operations, bytes

Float if type is in: sps, ops, bps
device - disk device (default is “all”1)
type - one of sectors, operations, bytes, sps, ops, bps (must specify exactly which parameter to use, since defaults are different under various OSes).
sps, ops, bps means: sectors, operations, bytes per second respectively
mode - one of avg1 (default),avg5 (average within 5 minutes), avg15.
Note: The third parameter is supported only if the type is in: sps, ops, bps.
Default values of 'type' parameter for different OSes:
FreeBSD - bps
Linux - sps
OpenBSD - operations
Solaris - bytes

Example: vfs.dev.write[,operations] Old naming: io[*]

The type parameters ops, bps and sps on supported platforms used to be limited to 8 devices (7 individual devices and one “all”). Starting with Zabbix 2.0.1 this limit has been increased to 1024 (1023 individual devices and one for “all”).

Supports LVM since Zabbix 1.8.6.

Until Zabbix 1.8.6, only relative device names may be used (for example, sda), since 1.8.6 optional /dev/ prefix may be used (for example, /dev/sda)
vfs.file.cksum[file]
Calculate file checksum File checksum, calculated by algorithm used by UNIX cksum. file - full path to file Example of returned value:
1938292000

Example:
vfs.file.cksum[/etc/passwd]

Old naming: cksum

The file size limit depends on large file support.
vfs.file.contents[file,<encoding>]
Get file contents Contents of a file or empty string if it is empty or it contains only LF/CR characters. file - full path to file Example:
vfs.file.contents[/etc/passwd]

This item is limited to files no larger than 64 Kbytes.

Supported since Zabbix agent version 2.0.
vfs.file.exists[file]
Check if file exists 1 - regular file or a link (symbolic or hard) to regular file exists.

0 - otherwise
file - full path to file Example: vfs.file.exists[/tmp/application.pid]

The return value depends on what S_ISREG POSIX macro returns.

The file size limit depends on large file support.
vfs.file.md5sum[file]
File's MD5 checksum MD5 hash of the file. file - full path to file Example of returned value:
b5052decb577e0fffd622d6ddc017e82

Example:
vfs.file.md5sum[/usr/local/etc/zabbix_agentd.conf]

The file size limit (64 MB) for this item was removed in version 1.8.6.

The file size limit depends on large file support.
vfs.file.regexp[file,regexp,<encoding>,<start line>,<end line>,<output>]
Find string in a file. The line containing the matched string, or as specified by the optional <output> parameter.
An empty string if no line matched the expression.
file - full path to file
regexp - GNU regular expression
encoding - Code Page identifier
start line - the number of first line to search. Defaults to the first line of file.
end line - the number of last line to search. Defaults to the last line of file.
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
If <output> is left empty - the whole line containing the matched text is returned.
The start line, end line and output parameters are supported from version 2.2.
Only the first matching line is returned.
Examples:
vfs.file.regexp[/etc/passwd,zabbix]
vfs.file.regexp[/path/to/some/file,”([0-9]+)$”,,3,5,\1]
vfs.file.regexp[/etc/passwd,^zabbix:.:([0-9]+),,,,\1] - getting the ID of user zabbix
vfs.file.regmatch[file,regexp,<encoding>,<start line>,<end line>]
Find string in a file 0 - expression not found
1 - found
file - full path to file
regexp - GNU regular expression
encoding - Code Page identifier
start line - the number of first line to search. Defaults to the first line of file.
end line - the number of last line to search. Defaults to the last line of file.
The start line and end line parameters are supported from version 2.2.
Example: vfs.file.regmatch[/var/log/app.log,error]
vfs.file.size[file]
File size Size in bytes. file - full path to file File must have read permissions for user zabbix

Example: vfs.file.size[/var/log/syslog]

The file size limit depends on large file support.
vfs.file.time[file,<mode>]
File time information. Unix timestamp. file - full path to the file
mode - one of modify (default, modification time), access - last access time, change - last change time
Example: vfs.file.time[/etc/passwd,modify]

The file size limit depends on large file support.
vfs.fs.discovery
List of mounted filesystems. Used for low-level discovery. JSON object Supported since Zabbix agent version 2.0.
vfs.fs.inode[fs,<mode>]
Number of inodes Numeric value fs - filesystem
mode - one of total (default), free, used, pfree (free, percentage), pused (used, percentage)
Example: vfs.fs.inode[/,pfree] Old naming: vfs.fs.inode.free[*], vfs.fs.inode.pfree[*], vfs.fs.inode.total[*]
vfs.fs.size[fs,<mode>]
Disk space Disk space in bytes fs - filesystem
mode - one of total (default), free, used, pfree (free, percentage), pused (used, percentage)
In case of a mounted volume, disk space for local file system is returned. Example: vfs.fs.size[/tmp,free] Old naming: vfs.fs.free[*], vfs.fs.total[*], vfs.fs.used[*], vfs.fs.pfree[*], vfs.fs.pused[*]
vm.memory.size[<mode>]
Memory size Memory size in bytes or in percentage from total mode - one of total (default), active, anon, buffers, cached, exec, file, free, inactive, pinned, shared, wired, used, pused, available, pavailable Old naming: vm.memory.buffers, vm.memory.cached, vm.memory.free, vm.memory.shared, vm.memory.total

Item vm.memory.size[] accepts three categories of parameters.

First category consists of total - total amount of memory.

Second category contains platform-specific memory types: active, anon, buffers, cached, exec, file, free, inactive, pinned, shared, wired.

Third category are user-level estimates on how much memory is used and available: used, pused, available, pavailable.

See a more detailed description of vm.memory.size parameters.
web.page.get[host,<path>,<port>]
Get content of web page Web page source as text host - hostname
path - path to HTML document (default is /)
port - port number (default is 80)
Returns empty string on fail. Example:
web.page.get[www.zabbix.com,index.php,80]
web.page.perf[host,<path>,<port>]
Get timing of loading full web page Time in seconds host - hostname
path - path to HTML document (default is /)
port - port number (default is 80)
Returns 0 on fail. Example:
web.page.perf[www.zabbix.com,index.php,80]
web.page.regexp[host,<path>,<port>,<regexp>,<length>,<output>]
Find string on a web page. The matched string, or as specified by the optional <output> parameter.
An empty string if no match was found.
host - hostname
path - path to HTML document (default is /)
port - port number (default is 80)
regexp - GNU regular expression
length - maximum number of characters to return
output - an optional output formatting template. The \0 escape sequence is replaced with the matched text while an \N (where N=1…9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
If <output> is left empty - the whole line containing the matched text is returned.
The output parameter is supported from version 2.2.
Returns empty string on fail (no match). Example:
web.page.regexp[www.zabbix.com,index.php,80,OK,2]

[1] If default “all” is used for the first parameter of vfs.dev.* keys then the keys will return summary statistics, including: all block devices like sda, sbd and their partitions sda1, sda2, sdb3 … and multiple devices (MD raid) based on those block devices/partitions and logical volumes (LVM) based on those block devices/partitions.
In such cases returned values should be considered only as relative value (dynamic in time) but not as absolute values.

A Linux-specific note. Zabbix agent must have read-only access to filesystem /proc. Kernel patches from www.grsecurity.org limit access rights of non-privileged users.