This is the documentation page for an unsupported version of Zabbix.
Is this not what you were looking for? Switch to the current version or choose one from the drop-down menu.

1 Zabbix agent

Overview

This section provides details on the item keys that use communication with Zabbix agent for data gathering.

There are passive and active agent checks. When configuring an item, you can select the required type:

  • Zabbix agent - for passive checks
  • Zabbix agent (active) - for active checks

Note that all item keys supported by Zabbix agent on Windows are also supported by the new generation Zabbix agent 2. See the additional item keys that you can use with the agent 2 only.

Supported platforms

Except where specified differently in the item comments, the agent items (and all parameters) are supported on:

  • Linux
  • FreeBSD
  • Solaris
  • HP-UX
  • AIX
  • Tru64
  • MacOS X
  • OpenBSD
  • NetBSD

Many agent items are also supported on Windows. See the Windows agent item page for details.

Supported item keys

The item keys that you can use with Zabbix agent are listed below. The items are grouped in tables by item family.

Parameters without angle brackets are mandatory. Parameters marked with angle brackets < > are optional.

Kernel data
Item key
Description Return value Parameters Comments
kernel.maxfiles
Maximum number of opened files supported by OS. Integer Supported platforms:
Linux, FreeBSD, MacOS X, OpenBSD, NetBSD.
kernel.maxproc
Maximum number of processes supported by OS. Integer Supported platforms:
Linux 2.6 and later, FreeBSD, Solaris, MacOS X, OpenBSD, NetBSD.
kernel.openfiles
Return the number of currently open file descriptors. Integer Supported platforms:
Linux.
The item may work on other UNIX-like platforms.

This item is supported since Zabbix 6.0.
Log data

See additional information on log monitoring.

Item key
Description Return value Parameters Comments
log[file,<regexp>,<encoding>,<maxlines>,<mode>,<output>,<maxdelay>,<options>,<persistent_dir>]
Monitoring of a log file. Log file - full path and name of log file
regexp - regular expression describing the required pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode (since version 2.0)- possible values:
all (default), skip - skip processing of older data (affects only newly created items).
output (since version 2.2) - an optional output formatting template. The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends) while an \N (where N=1...9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
maxdelay (since version 3.2) - maximum delay in seconds. Type: float. Values: 0 - (default) never ignore log file lines; > 0.0 - ignore older lines in order to get the most recent lines analyzed within "maxdelay" seconds. Read the maxdelay notes before using it!
options (since version 4.4.7) - additional options:
mtime-noreread - non-unique records, reread only if the file size changes (ignore modification time change). (This parameter is deprecated since 5.0.2, because now mtime is ignored.)
persistent_dir (since versions 5.0.18, 5.4.9, only in zabbix_agentd on Unix systems; not supported in Agent2) - absolute pathname of directory where to store persistent files. See also additional notes on persistent files.
See supported platforms.

The item must be configured as an active check.
If file is missing or permissions do not allow access, item turns unsupported.

If output is left empty - the whole line containing the matched text is returned. Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the output parameter is ignored.

Content extraction using the output parameter takes place on the agent.

Examples:
=> log[/var/log/syslog]
=> log[/var/log/syslog,error]
=> log[/home/zabbix/logs/logfile,,,100]

Using output parameter for extracting a number from log record:
=> log[/app1/app.log,"task run [0-9.]+ sec, processed ([0-9]+) records, [0-9]+ errors",,,,\1] → will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send only '6080' to server. Because a numeric value is being sent, the "Type of information" for this item can be set to "Numeric (unsigned)" and the value can be used in graphs, triggers etc.

Using output parameter for rewriting log record before sending to server:
=> log[/app1/app.log,"([0-9 :-]+) task run ([0-9.]+) sec, processed ([0-9]+) records, ([0-9]+) errors",,,,"\1 RECORDS: \3, ERRORS: \4, DURATION: \2"] → will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send a modified record "2015-11-13 10:08:26 RECORDS: 6080, ERRORS: 0, DURATION: 6.08" to server.
log.count[file,<regexp>,<encoding>,<maxproclines>,<mode>,<maxdelay>,<options>,<persistent_dir>]
Count of matched lines in a monitored log file. Integer file - full path and name of log file
regexp - regular expression describing the required pattern
encoding - code page identifier
maxproclines - maximum number of new lines per second the agent will analyze (cannot exceed 10000). Default value is 10*'MaxLinesPerSecond' in zabbix_agentd.conf.
mode - possible values:
all (default), skip - skip processing of older data (affects only newly created items).
maxdelay - maximum delay in seconds. Type: float. Values: 0 - (default) never ignore log file lines; > 0.0 - ignore older lines in order to get the most recent lines analyzed within "maxdelay" seconds. Read the maxdelay notes before using it!
options (since version 4.4.7) - additional options:
mtime-noreread - non-unique records, reread only if the file size changes (ignore modification time change). (This parameter is deprecated since 5.0.2, because now mtime is ignored.)
persistent_dir (since versions 5.0.18, 5.4.9, only in zabbix_agentd on Unix systems; not supported in Agent2) - absolute pathname of directory where to store persistent files. See also additional notes on persistent files.
See supported platforms.

The item must be configured as an active check.

Matching lines are counted in the new lines since the last log check by the agent, and thus depend on the item update interval.

If the file is missing or permissions do not allow access, item turns unsupported.

Supported since Zabbix 3.2.0.
logrt[file_regexp,<regexp>,<encoding>,<maxlines>,<mode>,<output>,<maxdelay>,<options>,<persistent_dir>]
Monitoring of a log file that is rotated. Log file_regexp - absolute path to file and the file name described by a regular expression. Note that only the file name is a regular expression
regexp - regular expression describing the required content pattern
encoding - code page identifier
maxlines - maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of 'MaxLinesPerSecond' in zabbix_agentd.conf
mode (since version 2.0) - possible values:
all (default), skip - skip processing of older data (affects only newly created items).
output (since version 2.2) - an optional output formatting template. The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends) while an \N (where N=1...9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
maxdelay (since version 3.2) - maximum delay in seconds. Type: float. Values: 0 - (default) never ignore log file lines; > 0.0 - ignore older lines in order to get the most recent lines analyzed within "maxdelay" seconds. Read the maxdelay notes before using it!
options (since version 4.0; mtime-reread, mtime-noreread options since 4.4.7) - type of log file rotation and other options. Possible values:
rotate (default),
copytruncate - note that copytruncate cannot be used together with maxdelay. In this case maxdelay must be 0 or not specified; see copytruncate notes,
mtime-reread - non-unique records, reread if modification time or size changes (default),
mtime-noreread - non-unique records, reread only if the size changes (ignore modification time change).
persistent_dir (since versions 5.0.18, 5.4.9, only in zabbix_agentd on Unix systems; not supported in Agent2) - absolute pathname of directory where to store persistent files. See also additional notes on persistent files.
See supported platforms.

The item must be configured as an active check.
Log rotation is based on the last modification time of files.

Note that logrt is designed to work with one currently active log file, with several other matching inactive files rotated. If, for example, a directory has many active log files, a separate logrt item should be created for each one. Otherwise if one logrt item picks up too many files it may lead to exhausted memory and a crash of monitoring.

If output is left empty - the whole line containing the matched text is returned. Note that all global regular expression types except 'Result is TRUE' always return the whole matched line and the output parameter is ignored.

Content extraction using the output parameter takes place on the agent.

Examples:
=> logrt["/home/zabbix/logs/^logfile[0-9]{1,3}$",,,100] → will match a file like "logfile1" (will not match ".logfile1")
=> logrt["/home/user/^logfile_.*_[0-9]{1,3}$","pattern_to_match","UTF-8",100] → will collect data from files such "logfile_abc_1" or "logfile__001".

Using output parameter for extracting a number from log record:
=> logrt[/app1/^test.*log$,"task run [0-9.]+ sec, processed ([0-9]+) records, [0-9]+ errors",,,,\1] → will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send only '6080' to server. Because a numeric value is being sent, the "Type of information" for this item can be set to "Numeric (unsigned)" and the value can be used in graphs, triggers etc.

Using output parameter for rewriting log record before sending to server:
=> logrt[/app1/^test.*log$,"([0-9 :-]+) task run ([0-9.]+) sec, processed ([0-9]+) records, ([0-9]+) errors",,,,"\1 RECORDS: \3, ERRORS: \4, DURATION: \2"] → will match a log record "2015-11-13 10:08:26 task run 6.08 sec, processed 6080 records, 0 errors" and send a modified record "2015-11-13 10:08:26 RECORDS: 6080, ERRORS: 0, DURATION: 6.08" to server.
logrt.count[file_regexp,<regexp>,<encoding>,<maxproclines>,<mode>,<maxdelay>,<options>,<persistent_dir>]
Count of matched lines in a monitored log file that is rotated. Integer file_regexp - absolute path to file and regular expression describing the file name pattern
regexp - regular expression describing the required content pattern
encoding - code page identifier
maxproclines - maximum number of new lines per second the agent will analyze (cannot exceed 10000). Default value is 10*'MaxLinesPerSecond' in zabbix_agentd.conf.
mode - possible values:
all (default), skip - skip processing of older data (affects only newly created items).
maxdelay - maximum delay in seconds. Type: float. Values: 0 - (default) never ignore log file lines; > 0.0 - ignore older lines in order to get the most recent lines analyzed within "maxdelay" seconds. Read the maxdelay notes before using it!
options (since version 4.0; mtime-reread, mtime-noreread options since 4.4.7) - type of log file rotation and other options. Possible values:
rotate (default),
copytruncate - note that copytruncate cannot be used together with maxdelay. In this case maxdelay must be 0 or not specified; see copytruncate notes,
mtime-reread - non-unique records, reread if modification time or size changes (default),
mtime-noreread - non-unique records, reread only if the size changes (ignore modification time change).
persistent_dir (since versions 5.0.18, 5.4.9, only in zabbix_agentd on Unix systems; not supported in Agent2) - absolute pathname of directory where to store persistent files. See also additional notes on persistent files.
See supported platforms.

The item must be configured as an active check.

Matching lines are counted in the new lines since the last log check by the agent, and thus depend on the item update interval.

Log rotation is based on the last modification time of files.

Supported since Zabbix 3.2.0.
Modbus data
Item key
Description Return value Parameters Comments
modbus.get[endpoint,<slave id>,<function>,<address>,<count>,<type>,<endianness>,<offset>]
Reads Modbus data. JSON object endpoint - endpoint defined as protocol://connection_string
slave id - slave ID
function - Modbus function
address - address of first registry, coil or input
count - number of records to read
type - type of data
endianness - endianness configuration
offset - number of registers, starting from 'address', the results of which will be discarded.

See a detailed description of parameters.
Supported platforms:
Linux.

Supported since Zabbix 5.2.0.
Network data
Item key
Description Return value Parameters Comments
net.dns[<ip>,name,<type>,<timeout>,<count>,<protocol>]
Checks if DNS service is up. 0 - DNS is down (server did not respond or DNS resolution failed)

1 - DNS is up
ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows unless using Zabbix agent 2)
name - DNS name to query
type - record type to be queried (default is SOA)
timeout (ignored on Windows unless using Zabbix agent 2) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows unless using Zabbix agent 2) - number of tries for the request (default is 2)
protocol (since version 3.0) - the protocol used to perform DNS queries: udp (default) or tcp
See supported platforms.

Example:
=> net.dns[8.8.8.8,example.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (not supported for Zabbix agent on Windows, Zabbix agent 2 on all OS), HINFO, MINFO, TXT, SRV

Internationalized domain names are not supported, please use IDNA encoded names instead.

Naming before Zabbix 2.0 (still supported): net.tcp.dns
net.dns.record[<ip>,name,<type>,<timeout>,<count>,<protocol>]
Performs a DNS query. Character string with the required type of information ip - IP address of DNS server (leave empty for the default DNS server, ignored on Windows unless using Zabbix agent 2)
name - DNS name to query
type - record type to be queried (default is SOA)
timeout (ignored on Windows unless using Zabbix agent 2) - timeout for the request in seconds (default is 1 second)
count (ignored on Windows unless using Zabbix agent 2) - number of tries for the request (default is 2)
protocol(since version 3.0) - the protocol used to perform DNS queries: udp (default) or tcp
See supported platforms.

Example:
=> net.dns.record[8.8.8.8,example.com,MX,2,1]

The possible values for type are:
ANY, A, NS, CNAME, MB, MG, MR, PTR, MD, MF, MX, SOA, NULL, WKS (not supported for Zabbix agent on Windows, Zabbix agent 2 on all OS), HINFO, MINFO, TXT, SRV

Internationalized domain names are not supported, please use IDNA encoded names instead.

Naming before Zabbix 2.0 (still supported): net.tcp.dns.query
net.if.collisions[if]
Number of out-of-window collisions. Integer if - network interface name Supported platforms:
Linux, FreeBSD, Solaris, AIX, MacOS X, OpenBSD, NetBSD. Root privileges are required on NetBSD.

net.if.discovery
List of network interfaces. Used for low-level discovery. JSON object Supported platforms:
Linux, FreeBSD, Solaris, HP-UX, AIX, OpenBSD, NetBSD.
net.if.in[if,<mode>]
Incoming traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address; or, if in braces, network interface GUID (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
overruns (fifo) - the number of FIFO buffer errors
frame - the number of packet framing errors
compressed - the number of compressed packets transmitted or received by the device driver
multicast - the number of multicast frames received by the device driver
Supported platforms:
Linux, FreeBSD, Solaris5, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.
Root privileges are required on NetBSD.

The dropped mode is supported only on Linux, FreeBSD, HP-UX, MacOS X, OpenBSD, NetBSD.
The overruns, frame, compressed, multicast modes are supported only on Linux.

On HP-UX this item does not provide details on loopback interfaces (e.g. lo0).

Examples:
=> net.if.in[eth0,errors]
=> net.if.in[eth0]

You may use this key with the Change per second preprocessing step in order to get bytes per second statistics.
net.if.out[if,<mode>]
Outgoing traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address; or, if in braces, network interface GUID (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
overruns (fifo) - the number of FIFO buffer errors
collisions (colls) - the number of collisions detected on the interface
carrier - the number of carrier losses detected by the device driver
compressed - the number of compressed packets transmitted by the device driver
Supported platforms:
Linux, FreeBSD, Solaris5, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.
Root privileges are required on NetBSD.

The dropped mode is supported only on Linux, HP-UX.
The overruns, collision, carrier, compressed modes are supported only on Linux.

On HP-UX this item does not provide details on loopback interfaces (e.g. lo0).

Examples:
=> net.if.out[eth0,errors]
=> net.if.out[eth0]

You may use this key with the Change per second preprocessing step in order to get bytes per second statistics.
net.if.total[if,<mode>]
Sum of incoming and outgoing traffic statistics on network interface. Integer if - network interface name (Unix); network interface full description or IPv4 address; or, if in braces, network interface GUID (Windows)
mode - possible values:
bytes - number of bytes (default)
packets - number of packets
errors - number of errors
dropped - number of dropped packets
overruns (fifo) - the number of FIFO buffer errors
compressed - the number of compressed packets transmitted or received by the device driver
Supported platforms:
Linux, FreeBSD, Solaris5, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.
Root privileges are required on NetBSD.

The dropped mode is supported only on Linux, HP-UX.
The overruns, collision, compressed modes are supported only on Linux.

On HP-UX this item does not provide details on loopback interfaces (e.g. lo0).

Examples:
=> net.if.total[eth0,errors]
=> net.if.total[eth0]

You may use this key with the Change per second preprocessing step in order to get bytes per second statistics.

Note that dropped packets are supported only if both net.if.in and net.if.out work for dropped packets on your platform.
net.tcp.listen[port]
Checks if this TCP port is in LISTEN state. 0 - it is not in LISTEN state

1 - it is in LISTEN state
port - TCP port number Supported platforms:
Linux, FreeBSD, Solaris, MacOS X.

Example:
=> net.tcp.listen[80]

On Linux supported since Zabbix 1.8.4

Since Zabbix 3.0.0, on Linux kernels 2.6.14 and above, information about listening TCP sockets is obtained from the kernel's NETLINK interface, if possible. Otherwise, the information is retrieved from /proc/net/tcp and /proc/net/tcp6 files.
net.tcp.port[<ip>,port]
Checks if it is possible to make TCP connection to specified port. 0 - cannot connect

1 - can connect
ip - IP or DNS name (default is 127.0.0.1)
port - port number
See supported platforms.

Example:
=> net.tcp.port[,80] → can be used to test availability of web server running on port 80.

For simple TCP performance testing use net.tcp.service.perf[tcp,<ip>,<port>]

Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).
net.tcp.service[service,<ip>,<port>]
Checks if service is running and accepting TCP connections. 0 - service is down

1 - service is running
service - either of:
ssh, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
See supported platforms.

Example:
=> net.tcp.service[ftp,,45] → can be used to test the availability of FTP server on TCP port 45.

Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually).

Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.port for checks like these.

Checking of LDAP and HTTPS on Windows is only supported by Zabbix agent 2.

Note that the telnet check looks for a login prompt (':' at the end).

See also known issues of checking HTTPS service.

https and telnet services are supported since Zabbix 2.0.
net.tcp.service.perf[service,<ip>,<port>]
Checks performance of TCP service. 0 - service is down

seconds - the number of seconds spent while connecting to the service
service - either of:
ssh, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
See supported platforms.

Example:
=> net.tcp.service.perf[ssh] → can be used to test the speed of initial response from SSH server.

Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.service.perf[tcp,<ip>,<port>] for checks like these.

Note that the telnet check looks for a login prompt (':' at the end).

See also known issues of checking HTTPS service.

https and telnet services are supported since Zabbix 2.0.
net.tcp.socket.count[<laddr>,<lport>,<raddr>,<rport>,<state>]
Return the number of TCP sockets that match parameters. Integer laddr - local IPv4/6 address or CIDR subnet
lport - local port number or service name
raddr - remote IPv4/6 address or CIDR subnet
rport - remote port number or service name
state - connection state (established, syn_sent, syn_recv, fin_wait1, fin_wait2, time_wait, close, close_wait, last_ack, listen, closing)
Supported platforms:
Linux.

Example:
=> net.tcp.socket.count[,80,,,established] → check if local TCP port 80 is in "established" state

This item is supported since Zabbix 6.0.
net.udp.listen[port]
Checks if this UDP port is in LISTEN state. 0 - it is not in LISTEN state

1 - it is in LISTEN state
port - UDP port number Supported platforms:
Linux, FreeBSD, Solaris, MacOS X.

Example:
=> net.udp.listen[68]
net.udp.service[service,<ip>,<port>]
Checks if service is running and responding to UDP requests. 0 - service is down

1 - service is running
service - ntp (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
See supported platforms.

Example:
=> net.udp.service[ntp,,45] → can be used to test the availability of NTP service on UDP port 45.

This item is supported since Zabbix 3.0.0, but ntp service was available for net.tcp.service[] item in prior versions.
net.udp.service.perf[service,<ip>,<port>]
Checks performance of UDP service. 0 - service is down

seconds - the number of seconds spent waiting for response from the service
service - ntp (see details)
ip - IP address (default is 127.0.0.1)
port - port number (by default standard service port number is used)
See supported platforms.

Example:
=> net.udp.service.perf[ntp] → can be used to test response time from NTP service.

This item is supported since Zabbix 3.0.0, but ntp service was available for net.tcp.service[] item in prior versions.
net.udp.socket.count[<laddr>,<lport>,<raddr>,<rport>,<state>]
Return the number of TCP sockets that match parameters. Integer laddr - local IPv4/6 address or CIDR subnet
lport - local port number or service name
raddr - remote IPv4/6 address or CIDR subnet
rport - remote port number or service name
state - connection state (established, unconn)
Supported platforms:
Linux.

Example:
=> net.udp.socket.count[,,,,listening] → check if any UDP socket is in "listening" state

This item is supported since Zabbix 6.0.
Process data
Item key
Description Return value Parameters Comments
proc.cpu.util[<name>,<user>,<type>,<cmdline>,<mode>,<zone>]
Process CPU utilization percentage. Float name - process name (default is all processes)
user - user name (default is all users)
type - CPU utilization type:
total (default), user, system
cmdline - filter by command line (it is a regular expression)
mode - data gathering mode: avg1 (default), avg5, avg15
zone - target zone: current (default), all. This parameter is supported on Solaris only.
Supported platforms:
Linux, Solaris6.

Examples:
=> proc.cpu.util[,root] → CPU utilization of all processes running under the "root" user
=> proc.cpu.util[zabbix_server,zabbix] → CPU utilization of all zabbix_server processes running under the zabbix user

The returned value is based on single CPU core utilization percentage. For example CPU utilization of a process fully using two cores is 200%.

The process CPU utilization data is gathered by a collector which supports the maximum of 1024 unique (by name, user and command line) queries. Queries not accessed during the last 24 hours are removed from the collector.

Note that when setting the zone parameter to current (or default) in case the agent has been compiled on a Solaris without zone support, but running on a newer Solaris where zones are supported, then the agent will return NOTSUPPORTED (the agent cannot limit results to only the current zone). However, all is supported in this case.
proc.get[<name>,<user>,<cmdline>,<mode>]
List of OS processes and their parameters. Can be used for low-level discovery. JSON object name - process name (default all processes)
user - user name (default all users)
cmdline - filter by command line (it is a regular expression). This parameter is not supported for Windows; on other platforms it is not supported if mode is set to 'summary'.
mode - possible values:
process (default), thread (not supported for NetBSD), summary. See a list of process parameters returned for each mode and OS.
Supported platforms:
Linux, FreeBSD, Windows, OpenBSD, NetBSD.

If a value cannot be retrieved, for example, because of an error (process already died, lack of permissions, system call failure), -1 will be returned.

Examples:
=> proc.get[zabbix,,,process] → list of all Zabbix processes, returns one entry per PID
=> proc.get[java,,,thread] → list of all Java processes, returns one entry per thread
=> proc.get[zabbix,,,summary] → combined data for Zabbix processes of each type, returns one entry per process name.

See also:
- Notes on selecting processes with name and cmdline parameters (Linux-specific).
- List of process parameters returned for each mode and OS.
proc.mem[<name>,<user>,<mode>,<cmdline>,<memtype>]
Memory used by process in bytes. Integer - with mode as max, min, sum

Float - with mode as avg
name - process name (default is all processes)
user - user name (default is all users)
mode - possible values:
avg, max, min, sum (default)
cmdline - filter by command line (it is a regular expression)
memtype - type of memory used by process
Supported platforms:
Linux, FreeBSD, Solaris, AIX, Tru64, OpenBSD, NetBSD.

The memtype parameter is supported only on Linux, FreeBSD, Solaris6, AIX.

Examples:
=> proc.mem[,root] → memory used by all processes running under the "root" user
=> proc.mem[zabbix_server,zabbix] → memory used by all zabbix_server processes running under the zabbix user
=> proc.mem[,oracle,max,oracleZABBIX] → memory used by the most memory-hungry process running under oracle having oracleZABBIX in its command line

Note: When several processes use shared memory, the sum of memory used by processes may result in large, unrealistic values.

See notes on selecting processes with name and cmdline parameters (Linux-specific).

When this item is invoked from the command line and contains a command line parameter (e.g. using the agent test mode: zabbix_agentd -t proc.mem[,,,apache2]), one extra process will be counted, as the agent will count itself.
proc.num[<name>,<user>,<state>,<cmdline>,<zone>]
The number of processes. Integer name - process name (default is all processes)
user - user name (default is all users)
state - possible values:
all (default),
disk - uninterruptible sleep,
run - running,
sleep - interruptible sleep,
trace - stopped,
zomb - zombie
cmdline - filter by command line (it is a regular expression)
zone - target zone: current (default), all. This parameter is supported on Solaris only.
Supported platforms:
Linux, FreeBSD, Solaris6, HP-UX, AIX, Tru64, OpenBSD, NetBSD.

The disk and trace state parameters are supported only on Linux, FreeBSD, OpenBSD, NetBSD.

Examples:
=> proc.num[,mysql] → number of processes running under the mysql user
=> proc.num[apache2,www-data] → number of apache2 processes running under the www-data user
=> proc.num[,oracle,sleep,oracleZABBIX] → number of processes in sleep state running under oracle having oracleZABBIX in its command line

See notes on selecting processes with name and cmdline parameters (Linux-specific).

When this item is invoked from the command line and contains a command line parameter (e.g. using the agent test mode: zabbix_agentd -t proc.num[,,,apache2]), one extra process will be counted, as the agent will count itself.

Note that when setting the zone parameter to current (or default) in case the agent has been compiled on a Solaris without zone support, but running on a newer Solaris where zones are supported, then the agent will return NOTSUPPORTED (the agent cannot limit results to only the current zone). However, all is supported in this case.
Sensor data
Item key
Description Return value Parameters Comments
sensor[device,sensor,<mode>]
Hardware sensor reading. Float device - device name
sensor - sensor name
mode - possible values:
avg, max, min (if this parameter is omitted, device and sensor are treated verbatim).
Supported platforms:
Linux, OpenBSD.

Reads /proc/sys/dev/sensors on Linux 2.4.

Example:
=> sensor[w83781d-i2c-0-2d,temp1]

Prior to Zabbix 1.8.4, the sensor[temp1] format was used.
Reads /sys/class/hwmon on Linux 2.6+.

See a more detailed description of sensor item on Linux.
Reads the hw.sensors MIB on OpenBSD.

Examples:
=> sensor[cpu0,temp0] → temperature of one CPU
=> sensor["cpu[0-2]$",temp,avg] → average temperature of the first three CPU's

Supported on OpenBSD since Zabbix 1.8.4.
System data
Item key
Description Return value Parameters Comments
system.boottime
System boot time. Integer (Unix timestamp) Supported platforms:
Linux, FreeBSD, Solaris, MacOS X, OpenBSD, NetBSD.

system.cpu.discovery
List of detected CPUs/CPU cores. Used for low-level discovery. JSON object See supported platforms.
system.cpu.intr
Device interrupts. Integer Supported platforms:
Linux, FreeBSD, Solaris, AIX, OpenBSD, NetBSD.

system.cpu.load[<cpu>,<mode>]
CPU load. Float cpu - possible values:
all (default), percpu (total load divided by online CPU count)
mode - possible values:
avg1 (one-minute average, default), avg5, avg15
See supported platforms.

The percpu parameter is not supported on Tru64.

Example:
=> system.cpu.load[,avg5].
system.cpu.num[<type>]
Number of CPUs. Integer type - possible values:
online (default), max
Supported platforms:
Linux, FreeBSD, Solaris, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.

The max type parameter is supported only on Linux, FreeBSD, Solaris, MacOS X.

Example:
=> system.cpu.num
system.cpu.switches
Count of context switches. Integer Supported platforms:
Linux, FreeBSD, Solaris, AIX, OpenBSD, NetBSD.

system.cpu.util[<cpu>,<type>,<mode>,<logical_or_physical>]
CPU utilization percentage. Float cpu - <CPU number> or all (default)
type - possible values:
user (default), idle, nice, system, iowait, interrupt, softirq, steal, guest (on Linux kernels 2.6.24 and above), guest_nice (on Linux kernels 2.6.33 and above).
mode - possible values:
avg1 (one-minute average, default), avg5, avg15
logical_or_physical - possible values: logical (default), physical. This parameter is supported on AIX only.
Supported platforms:
Linux, FreeBSD, Solaris, HP-UX, AIX, Tru64, OpenBSD, NetBSD.

The nice type parameter is supported only on Linux, FreeBSD, HP-UX, Tru64, OpenBSD, NetBSD.
The iowait type parameter is supported only on Linux 2.6 and later, Solaris, AIX.
The interrupt type parameter is supported only on Linux 2.6 and later, FreeBSD, OpenBSD.
The softirq, steal, guest, guest_nice type parameters are supported only on Linux 2.6 and later.
The avg5 and avg15 mode parameters are supported on Linux, FreeBSD, Solaris, HP-UX, AIX, OpenBSD, NetBSD.

Example:
=> system.cpu.util[0,user,avg5]

Old naming: system.cpu.idleX, system.cpu.niceX, system.cpu.systemX, system.cpu.userX
system.hostname[<type>, <transform>]
System host name. String type (before version 5.4.7 supported on Windows only) - possible values: netbios (default on Windows), host (default on Linux), shorthost (since version 5.4.7; returns part of the hostname before the first dot, a full string for names without dots).
transform (since version 5.4.7) - possible values:
none (default), lower (convert to lowercase)
See supported platforms.

The value is acquired by taking nodename from the uname() system API output.

Examples of returned values:
=> system.hostname → linux-w7x1
=> system.hostname → example.com
=> system.hostname[shorthost] → example
system.hw.chassis[<info>]
Chassis information. String info - one of full (default), model, serial, type or vendor Supported platforms:
Linux.

Example: system.hw.chassis[full]
Hewlett-Packard HP Pro 3010 Small Form Factor PC CZXXXXXXXX Desktop]

This key depends on the availability of the SMBIOS table.
Will try to read the DMI table from sysfs, if sysfs access fails then try reading directly from memory.

Root permissions are required because the value is acquired by reading from sysfs or memory.

Supported since Zabbix 2.0.
system.hw.cpu[<cpu>,<info>]
CPU information. String or integer cpu - <CPU number> or all (default)
info - possible values:
full (default), curfreq, maxfreq, model or vendor
Supported platforms:
Linux.

Example:
=> system.hw.cpu[0,vendor] → AuthenticAMD

Gathers info from /proc/cpuinfo and /sys/devices/system/cpu/[cpunum]/cpufreq/cpuinfo_max_freq.

If a CPU number and curfreq or maxfreq is specified, a numeric value is returned (Hz).

Supported since Zabbix 2.0.
system.hw.devices[<type>]
Listing of PCI or USB devices. Text type (since version 2.0) - pci (default) or usb Supported platforms:
Linux.

Example:
=> system.hw.devices[pci] → 00:00.0 Host bridge: Advanced Micro Devices [AMD] RS780 Host Bridge
[..]

Returns the output of either lspci or lsusb utility (executed without any parameters).
system.hw.macaddr[<interface>,<format>]
Listing of MAC addresses. String interface - all (default) or a regular expression
format - full (default) or short
Supported platforms:
Linux.

Lists MAC addresses of the interfaces whose name matches the given interface regular expression (all lists for all interfaces).

Example:
=> system.hw.macaddr["eth0$",full] → [eth0] 00:11:22:33:44:55

If format is specified as short, interface names and identical MAC addresses are not listed.

Supported since Zabbix 2.0.
system.localtime[<type>]
System time. Integer - with type as utc

String - with type as local
type - possible values:
utc - (default) the time since the Epoch (00:00:00 UTC, January 1, 1970), measured in seconds.
local - the time in the 'yyyy-mm-dd,hh:mm:ss.nnn,+hh:mm' format
See supported platforms.

Must be used as a passive check only.

Example:
=> system.localtime[local] → create an item using this key and then use it to display host time in the Clock dashboard widget.
system.run[command,<mode>]
Run specified command on the host. Text result of the command

1 - with mode as nowait (regardless of command result)
command - command for execution
mode - possible values:
wait - wait end of execution (default),
nowait - do not wait
See supported platforms.

Up to 512KB of data can be returned, including trailing whitespace that is truncated.
To be processed correctly, the output of the command must be text.

Example:
=> system.run[ls -l /] → detailed file list of root directory.

Note: system.run items are disabled by default. Learn how to enable them.

The return value of the item is standard output together with standard error produced by command. The exit code is not checked.

Empty result is allowed starting with Zabbix 2.4.0.
See also: Command execution.
system.stat[resource,<type>]
System statistics. Integer or float ent - number of processor units this partition is entitled to receive (float)
kthr,<type> - information about kernel thread states:
r - average number of runnable kernel threads (float)
b - average number of kernel threads placed in the Virtual Memory Manager wait queue (float)
memory,<type> - information about the usage of virtual and real memory:
avm - active virtual pages (integer)
fre - size of the free list (integer)
page,<type> - information about page faults and paging activity:
fi - file page-ins per second (float)
fo - file page-outs per second (float)
pi - pages paged in from paging space (float)
po - pages paged out to paging space (float)
fr - pages freed (page replacement) (float)
sr - pages scanned by page-replacement algorithm (float)
faults,<type> - trap and interrupt rate:
in - device interrupts (float)
sy - system calls (float)
cs - kernel thread context switches (float)
cpu,<type> - breakdown of percentage usage of processor time:
us - user time (float)
sy - system time (float)
id - idle time (float)
wa - idle time during which the system had outstanding disk/NFS I/O request(s) (float)
pc - number of physical processors consumed (float)
ec - the percentage of entitled capacity consumed (float)
lbusy - indicates the percentage of logical processor(s) utilization that occurred while executing at the user and system level (float)
app - indicates the available physical processors in the shared pool (float)
disk,<type> - disk statistics:
bps - indicates the amount of data transferred (read or written) to the drive in bytes per second (integer)
tps - indicates the number of transfers per second that were issued to the physical disk/tape (float)
system.sw.arch
Software architecture information. String See supported platforms.

Example:
=> system.sw.arch → i686

Info is acquired from uname() function.

Supported since Zabbix 2.0.
system.sw.os[<info>]
Operating system information. String info - possible values:
full (default), short or name
Supported platforms:
Linux.

Example:
=> system.sw.os[short]→ Ubuntu 2.6.35-28.50-generic 2.6.35.11

Info is acquired from (note that not all files and options are present in all distributions):
/proc/version (full)
/proc/version_signature (short)
PRETTY_NAME parameter from /etc/os-release on systems supporting it, or /etc/issue.net (name)

Supported since Zabbix 2.0.
system.sw.packages[<regexp>,<manager>,<format>]
Listing of installed packages. Text regexp - all (default) or a regular expression
manager - all (default) or a package manager
format - full (default) or short
Supported platforms:
Linux.

Lists (alphabetically) installed packages whose name matches the given package regular expression (all lists them all).

Example:
=> system.sw.packages[mini,dpkg,short] → python-minimal, python2.6-minimal, ubuntu-minimal

Supported package managers (executed command):
dpkg (dpkg --get-selections)
pkgtool (ls /var/log/packages)
rpm (rpm -qa)
pacman (pacman -Q)

If format is specified as full, packages are grouped by package managers (each manager on a separate line beginning with its name in square brackets).
If format is specified as short, packages are not grouped and are listed on a single line.

Supported since Zabbix 2.0.
system.swap.in[<device>,<type>]
Swap in (from device into memory) statistics. Integer device - specify device used for swapping (Linux only) or all (default)
type - possible values:
count (number of swapins, default on non-Linux platforms), sectors (sectors swapped in), pages (pages swapped in, default on Linux).
Note that pages will only work if device was not specified.
Supported platforms:
Linux, FreeBSD, OpenBSD.

The sectors type parameter is supported only on Linux.

Example:
=> system.swap.in[,pages]

The source of this information is:
/proc/swaps, /proc/partitions, /proc/stat (Linux 2.4)
/proc/swaps, /proc/diskstats, /proc/vmstat (Linux 2.6)
system.swap.out[<device>,<type>]
Swap out (from memory onto device) statistics. Integer device - specify device used for swapping (Linux only) or all (default)
type - possible values:
count (number of swapouts, default on non-Linux platforms), sectors (sectors swapped out), pages (pages swapped out, default on Linux).
Note that pages will only work if device was not specified.
Supported platforms:
Linux, FreeBSD, OpenBSD.

The sectors type parameter is supported only on Linux.

Example:
=> system.swap.out[,pages]

The source of this information is:
/proc/swaps, /proc/partitions, /proc/stat (Linux 2.4)
/proc/swaps, /proc/diskstats, /proc/vmstat (Linux 2.6)
system.swap.size[<device>,<type>]
Swap space size in bytes or in percentage from total. Integer - for bytes

Float - for percentage
device - specify device used for swapping (FreeBSD only) or all (default)
type - possible values:
free (free swap space, default), pfree (free swap space, in percent), pused (used swap space, in percent), total (total swap space), used (used swap space)
Note that pfree, pused are not supported on Windows if swap size is 0.
Supported platforms:
Linux, FreeBSD, Solaris, AIX, Tru64, OpenBSD.

Example:
=> system.swap.size[,pfree] → free swap space percentage

If device is not specified Zabbix agent will only take into account swap devices (files), physical memory will be ignored. For example, on Solaris systems swap -s command includes a portion of physical memory and swap devices (unlike swap -l).
system.uname
Identification of the system. String See supported platforms.

Example of returned value (Unix):
FreeBSD localhost 4.2-RELEASE FreeBSD 4.2-RELEASE #0: Mon Nov i386

On Unix since Zabbix 2.2.0 the value for this item is obtained with uname() system call. Previously it was obtained by invoking "uname -a". The value of this item might differ from the output of "uname -a" and does not include additional information that "uname -a" prints based on other sources.

Note that on Windows the item returns OS architecture, whereas on Unix it returns CPU architecture.
system.uptime
System uptime in seconds. Integer Supported platforms:
Linux, FreeBSD, Solaris, AIX, MacOS X, OpenBSD, NetBSD.
Support on Tru64 is unknown.

In item configuration, use s or uptime units to get readable values.
system.users.num
Number of users logged in. Integer See supported platforms.

who command is used on the agent side to obtain the value.
Virtual file system data
Item key
Description Return value Parameters Comments
vfs.dev.discovery
List of block devices and their type. Used for low-level discovery. JSON object Supported platforms:
Linux.

Supported since Zabbix 4.4.0.
vfs.dev.read[<device>,<type>,<mode>]
Disk read statistics. Integer - with type in sectors, operations, bytes

Float - with type in sps, ops, bps

Note: if using an update interval of three hours or more2, will always return '0'
device - disk device (default is all 3)
type - possible values: sectors, operations, bytes, sps, ops, bps
Note that 'type' parameter support and defaults depend on the platform.
sps, ops, bps stand for: sectors, operations, bytes per second, respectively.
mode - possible values: avg1 (one-minute average, default), avg5, avg15.
This parameter is supported only with type in: sps, ops, bps.
Supported platforms:
Linux, FreeBSD, Solaris, AIX, OpenBSD.

The sectors and sps type parameters are supported only on Linux.
The ops type parameter is supported only on Linux, FreeBSD.
The bps type parameter is supported only on FreeBSD.
The bytes type parameter is supported only on FreeBSD, Solaris, AIX, OpenBSD.
The mode parameter is supported only on Linux, FreeBSD.

You may use relative device names (for example, sda) as well as an optional /dev/ prefix (for example, /dev/sda).

LVM logical volumes are supported.

Default values of 'type' parameter for different OSes:
AIX - operations
FreeBSD - bps
Linux - sps
OpenBSD - operations
Solaris - bytes

Example:
=> vfs.dev.read[,operations]

sps, ops and bps on supported platforms is limited to 1024 devices (1023 individual and one for all).
vfs.dev.write[<device>,<type>,<mode>]
Disk write statistics. Integer - with type in sectors, operations, bytes

Float - with type in sps, ops, bps

Note: if using an update interval of three hours or more2, will always return '0'
device - disk device (default is all 3)
type - possible values: sectors, operations, bytes, sps, ops, bps
Note that 'type' parameter support and defaults depend on the platform.
sps, ops, bps stand for: sectors, operations, bytes per second, respectively.
mode - possible values: avg1 (one-minute average, default), avg5, avg15.
This parameter is supported only with type in: sps, ops, bps.
Supported platforms:
Linux, FreeBSD, Solaris, AIX, OpenBSD.

The sectors and sps type parameters are supported only on Linux.
The ops type parameter is supported only on Linux, FreeBSD.
The bps type parameter is supported only on FreeBSD.
The bytes type parameter is supported only on FreeBSD, Solaris, AIX, OpenBSD.
The mode parameter is supported only on Linux, FreeBSD.

You may use relative device names (for example, sda) as well as an optional /dev/ prefix (for example, /dev/sda).

LVM logical volumes are supported.

Default values of 'type' parameter for different OSes:
AIX - operations
FreeBSD - bps
Linux - sps
OpenBSD - operations
Solaris - bytes

Example:
=> vfs.dev.write[,operations]

sps, ops and bps on supported platforms is limited to 1024 devices (1023 individual and one for all).
vfs.dir.count[dir,<regex_incl>,<regex_excl>,<types_incl>,<types_excl>,<max_depth>,<min_size>,<max_size>,<min_age>,<max_age>,<regex_excl_dir>]
Directory entry count. Integer dir - absolute path to directory
regex_incl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to include; include all if empty (default value)
regex_excl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to exclude; don't exclude any if empty (default value)
types_incl - directory entry types to count, possible values:
file - regular file, dir - subdirectory, sym - symbolic link, sock - socket, bdev - block device, cdev - character device, fifo - FIFO, dev - synonymous with "bdev,cdev", all - all types (default), i.e. "file,dir,sym,sock,bdev,cdev,fifo". Multiple types must be separated with comma and quoted.
types_excl - directory entry types (see <types_incl>) to NOT count. If some entry type is in both <types_incl> and <types_excl>, directory entries of this type are NOT counted.
max_depth - maximum depth of subdirectories to traverse. -1 (default) - unlimited, 0 - no descending into subdirectories.
min_size - minimum size (in bytes) for file to be counted. Smaller files will not be counted. Memory suffixes can be used.
max_size - maximum size (in bytes) for file to be counted. Larger files will not be counted. Memory suffixes can be used.
min_age - minimum age (in seconds) of directory entry to be counted. More recent entries will not be counted. Time suffixes can be used.
max_age - maximum age (in seconds) of directory entry to be counted. Entries so old and older will not be counted (modification time). Time suffixes can be used.
regex_excl_dir - regular expression describing the name pattern of the directory to exclude. All content of the directory will be excluded (in contrast to regex_excl)
See supported platforms.

Environment variables, e.g. %APP_HOME%, $HOME and %TEMP% are not supported.

Pseudo-directories "." and ".." are never counted.

Symbolic links are never followed for directory traversal.

Both regex_incl and regex_excl are being applied to files and directories when calculating entry size, but are ignored when picking subdirectories to traverse (if regex_incl is “(?i)^.+\.zip$” and max_depth is not set, then all subdirectories will be traversed, but only files of type zip will be counted).

Execution time is limited by the default timeout value in agent configuration (3 sec). Since large directory traversal may take longer than that, no data will be returned and the item will turn unsupported. Partial count will not be returned.

When filtering by size, only regular files have meaningful sizes. Under Linux and BSD, directories also have non-zero sizes (a few Kb typically). Devices have zero sizes, e.g. the size of /dev/sda1 does not reflect the respective partition size. Therefore, when using <min_size> and <max_size>, it is advisable to specify <types_incl> as "file", to avoid surprises.

Examples:
⇒ vfs.dir.count[/dev] - monitors number of devices in /dev (Linux)
Supported since Zabbix 4.0.0.
vfs.dir.get[dir,<regex_incl>,<regex_excl>,<types_incl>,<types_excl>,<max_depth>,<min_size>,<max_size>,<min_age>,<max_age>,<regex_excl_dir>]
Directory entry list. JSON dir - absolute path to directory
regex_incl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to include; include all if empty (default value)
regex_excl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to exclude; don't exclude any if empty (default value)
types_incl - directory entry types to list, possible values:
file - regular file, dir - subdirectory, sym - symbolic link, sock - socket, bdev - block device, cdev - character device, fifo - FIFO, dev - synonymous with "bdev,cdev", all - all types (default), i.e. "file,dir,sym,sock,bdev,cdev,fifo". Multiple types must be separated with comma and quoted.
types_excl - directory entry types (see <types_incl>) to NOT list. If some entry type is in both <types_incl> and <types_excl>, directory entries of this type are NOT listed.
max_depth - maximum depth of subdirectories to traverse. -1 (default) - unlimited, 0 - no descending into subdirectories.
min_size - minimum size (in bytes) for file to be listed. Smaller files will not be listed. Memory suffixes can be used.
max_size - maximum size (in bytes) for file to be listed. Larger files will not be counted. Memory suffixes can be used.
min_age - minimum age (in seconds) of directory entry to be listed. More recent entries will not be listed. Time suffixes can be used.
max_age - maximum age (in seconds) of directory entry to be listed. Entries so old and older will not be listed (modification time). Time suffixes can be used.
regex_excl_dir - regular expression describing the name pattern of the directory to exclude. All content of the directory will be excluded (in contrast to regex_excl)
See supported platforms.

Environment variables, e.g. %APP_HOME%, $HOME and %TEMP% are not supported.

Pseudo-directories "." and ".." are never listed.

Symbolic links are never followed for directory traversal.

Both regex_incl and regex_excl are being applied to files and directories when calculating entry size, but are ignored when picking subdirectories to traverse (if regex_incl is “(?i)^.+\.zip$” and max_depth is not set, then all subdirectories will be traversed, but only files of type zip will be listed).

Execution time is limited by the default timeout value in agent configuration (3 sec). Since large directory traversal may take longer than that, no data will be returned and the item will turn unsupported. Partial list will not be returned.

When filtering by size, only regular files have meaningful sizes. Under Linux and BSD, directories also have non-zero sizes (a few Kb typically). Devices have zero sizes, e.g. the size of /dev/sda1 does not reflect the respective partition size. Therefore, when using <min_size> and <max_size>, it is advisable to specify <types_incl> as "file", to avoid surprises.

Examples:
⇒ vfs.dir.get[/dev] - retrieves device list in /dev (Linux)
Supported since Zabbix 6.0.0.
vfs.dir.size[dir,<regex_incl>,<regex_excl>,<mode>,<max_depth>,<regex_excl_dir>]
Directory size (in bytes). Integer dir - absolute path to directory
regex_incl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to include; include all if empty (default value)
regex_excl - regular expression describing the name pattern of the entity (file, directory, symbolic link) to exclude; don't exclude any if empty (default value)
mode - possible values:
apparent (default) - gets apparent file sizes rather than disk usage (acts as du -sb dir), disk - gets disk usage (acts as du -s -B1 dir). Unlike du command, vfs.dir.size item takes hidden files in account when calculating directory size (acts as du -sb .[^.]* * within dir).
max_depth - maximum depth of subdirectories to traverse. -1 (default) - unlimited, 0 - no descending into subdirectories.
regex_excl_dir - regular expression describing the name pattern of the directory to exclude. All content of the directory will be excluded (in contrast to regex_excl)
Supported platforms:
Linux.
The item may work on other UNIX-like platforms.

Only directories with at least read permission for zabbix user are calculated.

With large directories or slow drives this item may time out due to the Timeout setting in agent and server/proxy configuration files. Increase the timeout values as necessary.

Examples:
⇒ vfs.dir.size[/tmp,log] - calculates size of all files in /tmp which contain 'log'
⇒ vfs.dir.size[/tmp,log,^.+\.old$] - calculates size of all files in /tmp which contain 'log', excluding files containing '.old'

The file size limit depends on large file support.

Supported since Zabbix 3.4.0.
vfs.file.cksum[file,<mode>]
File checksum, calculated by the UNIX cksum algorithm. Integer - with mode as crc32

String - with mode as md5, sha256
file - full path to file
mode - crc32 (default), md5, sha256
See #supported platforms.

Example:
=> vfs.file.cksum[/etc/passwd]

Example of returned values (crc32/md5/sha256 respectively):
675436101
9845acf68b73991eb7fd7ee0ded23c44
ae67546e4aac995e5c921042d0cf0f1f7147703aa42bfbfb65404b30f238f2dc

The file size limit depends on large file support.

The mode parameter is supported since Zabbix 6.0.
vfs.file.contents[file,<encoding>]
Retrieving contents of a file. Text file - full path to file
encoding - code page identifier
See supported platforms.

Returns an empty string if the file is empty or contains LF/CR characters only.

Byte order mark (BOM) is excluded from the output.

Example:
=> vfs.file.contents[/etc/passwd]

This item is limited to files no larger than 64 Kbytes.

Supported since Zabbix 2.0.
vfs.file.exists[file,<types_incl>,<types_excl>]
Checks if file exists. 0 - not found

1 - file of the specified type exists
file - full path to file
types_incl - list of file types to include, possible values: file (regular file, default (if types_excl is not set)), dir (directory), sym (symbolic link), sock (socket), bdev (block device), cdev (character device), fifo (FIFO), dev (synonymous with "bdev,cdev"), all (all mentioned types, default if types_excl is set).
types_excl - list of file types to exclude, see types_incl for possible values (by default no types are excluded)
See supported platforms.

Multiple types must be separated with a comma and the entire set enclosed in quotes "".
If the same type is in both <types_incl> and <types_excl>, files of this type are excluded.

Examples:
=> vfs.file.exists[/tmp/application.pid]
=> vfs.file.exists[/tmp/application.pid,"file,dir,sym"]
=> vfs.file.exists[/tmp/application_dir,dir]

The file size limit depends on large file support.
vfs.file.get[file]
Return information about a file. JSON object file - full path to file See supported platforms.

Supported file types on UNIX-like systems: regular file, directory, symbolic link, socket, block device, character device, FIFO

Example:
=> vfs.file.get[/etc/passwd] → return a JSON with information about the /etc/passwd file (type, user, permissions, SID, uid etc)

Supported since Zabbix 6.0.
vfs.file.md5sum[file]
MD5 checksum of file. Character string (MD5 hash of the file) file - full path to file See supported platforms.

Example:
=> vfs.file.md5sum[/usr/local/etc/zabbix_agentd.conf]

Example of returned value:
b5052decb577e0fffd622d6ddc017e82

The file size limit (64 MB) for this item was removed in version 1.8.6.

The file size limit depends on large file support.
vfs.file.owner[file,<ownertype>,<resulttype>]
Retrieve owner of a file. Character string file - full path to file
ownertype - user (default) or group (Unix only)
resulttype - name (default) or id; for id - return uid/gid on Unix, SID on Windows
See supported platforms.

Example:
=> vfs.file.owner[/tmp/zabbix_server.log] → return file owner of /tmp/zabbix_server.log
=> vfs.file.owner[/tmp/zabbix_server.log,,id] → return file owner ID of /tmp/zabbix_server.log

Supported since Zabbix 6.0.
vfs.file.permissions[file]
Return a 4-digit string containing the octal number with Unix permissions. String file - full path to the file Supported platforms:
Linux. The item may work on other UNIX-like platforms.

Example:
=> vfs.file.permissions[/etc/passwd] → return permissions of /etc/passwd, for example, '0644'

Supported since Zabbix 6.0.
vfs.file.regexp[file,regexp,<encoding>,<start line>,<end line>,<output>]
Find string in a file. The line containing the matched string, or as specified by the optional output parameter file - full path to file
regexp - regular expression describing the required pattern
encoding - code page identifier
start line - the number of first line to search (first line of file by default).
end line - the number of last line to search (last line of file by default).
output - an optional output formatting template. The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends) while an \N (where N=1...9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
See supported platforms.

Only the first matching line is returned.
An empty string is returned if no line matched the expression.

Byte order mark (BOM) is excluded from the output.

Content extraction using the output parameter takes place on the agent.

The start line, end line and output parameters are supported from version 2.2.

Examples:
=> vfs.file.regexp[/etc/passwd,zabbix]
=> vfs.file.regexp[/path/to/some/file,"([0-9]+)$",,3,5,\1]
=> vfs.file.regexp[/etc/passwd,"^zabbix:.:([0-9]+)",,,,\1] → getting the ID of user zabbix
vfs.file.regmatch[file,regexp,<encoding>,<start line>,<end line>]
Find string in a file. 0 - match not found

1 - found
file - full path to file
regexp - regular expression describing the required pattern
encoding - code page identifier
start line - the number of first line to search (first line of file by default).
end line - the number of last line to search (last line of file by default).
See supported platforms.

Byte order mark (BOM) is ignored.

The start line and end line parameters are supported from version 2.2.

Example:
=> vfs.file.regmatch[/var/log/app.log,error]
vfs.file.size[file,<mode>]
File size (in bytes). Integer file - full path to file
mode - possible values:
bytes (default) or lines (empty lines are counted, too)
See supported platforms.

The file must have read permissions for user zabbix.

Example:
=> vfs.file.size[/var/log/syslog]

The file size limit depends on large file support.

The mode parameter is supported since Zabbix 6.0.
vfs.file.time[file,<mode>]
File time information. Integer (Unix timestamp) file - full path to the file
mode - possible values:
modify (default) - last time of modifying file content,
access - last time of reading file,
change - last time of changing file properties
See supported platforms.

Example:
=> vfs.file.time[/etc/passwd,modify]

The file size limit depends on large file support.
vfs.fs.discovery
List of mounted filesystems and their types. Used for low-level discovery. JSON object Supported platforms:
Linux, FreeBSD, Solaris, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.
vfs.fs.get
List of mounted filesystems, their types, disk space and inode statistics. Can be used for low-level discovery. JSON object Supported platforms:
Linux, FreeBSD, Solaris, HP-UX, AIX, MacOS X, OpenBSD, NetBSD.

Since Zabbix 6.2.5, this item is capable of reporting file systems with the inode count equal to zero, which can be the case for file systems with dynamic inodes (e.g. btrfs).
vfs.fs.inode[fs,<mode>]
Number or percentage of inodes. Integer - for number

Float - for percentage
fs - filesystem
mode - possible values:
total (default), free, used, pfree (free, percentage), pused (used, percentage)
See supported platforms.

Since Zabbix 6.2.5, this item will not become unsupported in pfree/pused modes if the inode count equals to zero, which can be the case for file systems with dynamic inodes (e.g. btrfs). Instead the pfree/pused values for such file systems will be reported as "100" and "0" respectively.

Example:
=> vfs.fs.inode[/,pfree]
vfs.fs.size[fs,<mode>]
Disk space in bytes or in percentage from total. Integer - for bytes

Float - for percentage
fs - filesystem
mode - possible values:
total (default), free, used, pfree (free, percentage), pused (used, percentage)
See supported platforms.

In case of a mounted volume, disk space for local file system is returned.

Example:
=> vfs.fs.size[/tmp,free]

Reserved space of a file system is taken into account and not included when using the free mode.
Virtual memory data
Item key
Description Return value Parameters Comments
vm.memory.size[<mode>]
Memory size in bytes or in percentage from total. Integer - for bytes

Float - for percentage
mode - possible values:
total (default), active, anon, buffers, cached, exec, file, free, inactive, pinned, shared, slab, wired, used, pused (used, percentage), available, pavailable (available, percentage)
The mode parameter support is platform-specific (see item comments).
See also additional details for this parameter.
See supported platforms.

The active mode parameter is supported only on FreeBSD, HP-UX, MacOS X, OpenBSD, NetBSD.
The anon, exec, file mode parameters are supported only on NetBSD.
The buffers mode parameter is supported only on Linux, FreeBSD, OpenBSD, NetBSD.
The cached mode parameter is supported only on Linux, FreeBSD, AIX, OpenBSD, NetBSD.
The inactive, wired mode parameters are supported only on FreeBSD, MacOS X, OpenBSD, NetBSD.
The pinned mode parameter is supported only on AIX.
The shared mode parameter is supported only on Linux 2.4, FreeBSD, OpenBSD, NetBSD.

This item accepts three categories of parameters:

1) total - total amount of memory;
2) platform-specific memory types: active, anon, buffers, cached, exec, file, free, inactive, pinned, shared, slab, wired;
3) user-level estimates on how much memory is used and available: used, pused, available, pavailable.
Web monitoring data
Item key
Description Return value Parameters Comments
web.page.get[host,<path>,<port>]
Get content of web page. Web page source as text (including headers) host - hostname or URL (as scheme://host:port/path, where only host is mandatory).
Allowed URL schemes: http, https4. Missing scheme will be treated as http. If URL is specified path and port must be empty. Specifying user name/password when connecting to servers that require authentication, for example: http://user:[email protected] is only possible with cURL support 4.
Punycode is supported in hostnames.
path - path to HTML document (default is /)
port - port number (default is 80 for HTTP)
See supported platforms.

This item turns unsupported if the resource specified in host does not exist or is unavailable.

host can be hostname, domain name, IPv4 or IPv6 address. But for IPv6 address Zabbix agent must be compiled with IPv6 support enabled.

Example:
=> web.page.get[www.example.com,index.php,80]
=> web.page.get[https://www.example.com]
=> web.page.get[https://blog.example.com/?s=zabbix]
=> web.page.get[localhost:80]
=> web.page.get["[::1]/server-status"]
web.page.perf[host,<path>,<port>]
Loading time of full web page (in seconds). Float host - hostname or URL (as scheme://host:port/path, where only host is mandatory).
Allowed URL schemes: http, https4. Missing scheme will be treated as http. If URL is specified path and port must be empty. Specifying user name/password when connecting to servers that require authentication, for example: http://user:[email protected] is only possible with cURL support 4.
Punycode is supported in hostnames.
path - path to HTML document (default is /)
port - port number (default is 80 for HTTP)
See supported platforms.

This item turns unsupported if the resource specified in host does not exist or is unavailable.

host can be hostname, domain name, IPv4 or IPv6 address. But for IPv6 address Zabbix agent must be compiled with IPv6 support enabled.

Example:
=> web.page.perf[www.example.com,index.php,80]
=> web.page.perf[https://www.example.com]
web.page.regexp[host,<path>,<port>,regexp,<length>,<output>]
Find string on a web page. The matched string, or as specified by the optional output parameter host - hostname or URL (as scheme://host:port/path, where only host is mandatory).
Allowed URL schemes: http, https4. Missing scheme will be treated as http. If URL is specified path and port must be empty. Specifying user name/password when connecting to servers that require authentication, for example: http://user:[email protected] is only possible with cURL support 4.
Punycode is supported in hostnames.
path - path to HTML document (default is /)
port - port number (default is 80 for HTTP)
regexp - regular expression describing the required pattern
length - maximum number of characters to return
output - an optional output formatting template. The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends) while an \N (where N=1...9) escape sequence is replaced with Nth matched group (or an empty string if the N exceeds the number of captured groups).
See supported platforms.

This item turns unsupported if the resource specified in host does not exist or is unavailable.

host can be hostname, domain name, IPv4 or IPv6 address. But for IPv6 address Zabbix agent must be compiled with IPv6 support enabled.

Content extraction using the output parameter takes place on the agent.

The output parameter is supported from version 2.2.

Example:
=> web.page.regexp[www.example.com,index.php,80,OK,2]
=> web.page.regexp[https://www.example.com,,,OK,2]
Zabbix metrics
Item key
Description Return value Parameters Comments
agent.hostmetadata
Agent host metadata. String See supported platforms.

Returns the value of HostMetadata or HostMetadataItem parameters, or empty string if none are defined.

Supported since Zabbix 6.0.
agent.hostname
Agent host name. String See supported platforms.

Returns:
As passive check - the name of the first host listed in the Hostname parameter of the agent configuration file;
As active check - the name of the current hostname.
agent.ping
Agent availability check. Nothing - unavailable

1 - available
See supported platforms.

Use the nodata() trigger function to check for host unavailability.
agent.variant
Variant of Zabbix agent (Zabbix agent or Zabbix agent 2). Integer See supported platforms.

Example of returned value:
1 - Zabbix agent
2 - Zabbix agent 2
agent.version
Version of Zabbix agent. String See supported platforms.

Example of returned value:
6.0.3
zabbix.stats[<ip>,<port>]
Return a set of Zabbix server or proxy internal metrics remotely. JSON object ip - IP/DNS/network mask list of servers/proxies to be remotely queried (default is 127.0.0.1)
port - port of server/proxy to be remotely queried (default is 10051)
See supported platforms.

Note that the stats request will only be accepted from the addresses listed in the 'StatsAllowedIP' server/proxy parameter on the target instance.

A selected set of internal metrics is returned by this item. For details, see Remote monitoring of Zabbix stats.
zabbix.stats[<ip>,<port>,queue,<from>,<to>]
Return number of monitored items in the queue which are delayed on Zabbix server or proxy remotely. JSON object ip - IP/DNS/network mask list of servers/proxies to be remotely queried (default is 127.0.0.1)
port - port of server/proxy to be remotely queried (default is 10051)
queue - constant (to be used as is)
from - delayed by at least (default is 6 seconds)
to - delayed by at most (default is infinity)
See supported platforms.

Note that the stats request will only be accepted from the addresses listed in the 'StatsAllowedIP' server/proxy parameter on the target instance.
Footnotes

1A Linux-specific note. Zabbix agent must have read-only access to filesystem /proc. Kernel patches from www.grsecurity.org limit access rights of non-privileged users.

2 vfs.dev.read[], vfs.dev.write[]: Zabbix agent will terminate "stale" device connections if the item values are not accessed for more than 3 hours. This may happen if a system has devices with dynamically changing paths or if a device gets manually removed. Note also that these items, if using an update interval of 3 hours or more, will always return '0'.

3 vfs.dev.read[], vfs.dev.write[]: If default all is used for the first parameter then the key will return summary statistics, including all block devices like sda, sbd and their partitions (sda1, sda2, sdb3...) and multiple devices (MD raid) based on those block devices/partitions and logical volumes (LVM) based on those block devices/partitions. In such cases returned values should be considered only as relative value (dynamic in time) but not as absolute values.

4 SSL (HTTPS) is supported only if agent is compiled with cURL support. Otherwise the item will turn unsupported.

5 The bytes and errors values are not supported for loopback interfaces on Solaris systems up to and including Solaris 10 6/06 as byte, error and utilization statistics are not stored and/or reported by the kernel. However, if you're monitoring a Solaris system via net-snmp, values may be returned as net-snmp carries legacy code from the cmu-snmp dated as old as 1997 that, upon failing to read byte values from the interface statistics returns the packet counter (which does exist on loopback interfaces) multiplied by an arbitrary value of 308. This makes the assumption that the average length of a packet is 308 octets, which is a very rough estimation as the MTU limit on Solaris systems for loopback interfaces is 8892 bytes. These values should not be assumed to be correct or even closely accurate. They are guestimates. The Zabbix agent does not do any guess work, but net-snmp will return a value for these fields.

6 The command line on Solaris, obtained from /proc/pid/psinfo, is limited to 80 bytes and contains the command line as it was when the process was started.

Usage with command-line utilities

Note that when testing or using item keys with zabbix_agentd or zabbix_get from the command line you should consider shell syntax too.

For example, if a certain parameter of the key has to be enclosed in double quotes you have to explicitly escape double quotes, otherwise they will be trimmed by the shell as special characters and will not be passed to the Zabbix utility.

Examples:

$ zabbix_agentd -t 'vfs.dir.count[/var/log,,,"file,dir",,0]'
       
       $ zabbix_agentd -t vfs.dir.count[/var/log,,,\"file,dir\",,0]

Encoding settings

To make sure that the acquired data are not corrupted you may specify the correct encoding for processing the check (e.g. 'vfs.file.contents') in the encoding parameter. The list of supported encodings (code page identifiers) may be found in documentation for libiconv (GNU Project) or in Microsoft Windows SDK documentation for "Code Page Identifiers".

If no encoding is specified in the encoding parameter the following resolution strategies are applied:

  • If encoding is not specified (or is an empty string) it is assumed to be UTF-8, the data is processed "as-is";
  • BOM analysis - applicable for items 'vfs.file.contents', 'vfs.file.regexp', 'vfs.file.regmatch'. An attempt is made to determine the correct encoding by using the byte order mark (BOM) at the beginning of the file. If BOM is not present - standard resolution (see above) is applied instead.

Troubleshooting agent items

  • If used with the passive agent, Timeout value in server configuration may need to be higher than Timeout in the agent configuration file. Otherwise the item may not get any value because the server request to agent timed out first.