ZABBIX Forums - Zabbix Help

Differences in interfaces found

RichardNL — Thu, 27 Aug 2026 09:45:24 GMT

Crucial information:
Production environment:
Host OS: ubuntu-26.04-live-server-amd64
Zabbix version: 7.4.13
Database: MySQL
Webserver: Nginx
Template used: Windows by SNMP
Template Vendor and version: Zabbix, 7.4-4

Test environment:
Host OS: Zabbix appliance (Alma Linux 8)
Zabbix version: 7.4.13
Database: MySQL
Webserver: Nginx
Template used: Windows by SNMP
Template Vendor and version: Zabbix, 7.2-2

Small introduction: In the past I had an small Zabbix setup. Overwhelmed by all the options, I choose to switch to NagiosCSP. It worked for us, easier to setup and free for 50 devices. Unfortunately, because of changes in their policy, the CSP license is revoked. With my small experience with Zabbix I choose to come back. I've made myself an test environment based on the Zabbix appliance. Added an host, with help of AI created a specific service readout with a trigger. It was quite doable for me, and it no longer felt like a raging river. By testing things at my leisure I was getting somewhere. But, for the appliance I read that it is not the best option for production purposes. So, pulling the Ubuntu ISO to our cluster, attached it to the Nagios VM and formatted the whole server. LET'S START! I felt confident as my test-enviroment did what i wanted.

Server installed etcetc. Added a host, just like my test environment. Same host, same template, same SNMP settings etc. Wait, WHAT? Where I had 135 items and 15 triggers for the host in the test environment, I now have 203 items and 90 triggers for the same host in my 'production'-environment! In my search for the difference, I found out there where more network interfaces added. In test: 1 interface, production around 7 I guess? As I'm using the same template etc, I tried to investigate where the difference is made.

With help of AI (and running around a lot in the same circles, TNX AI!) it seems that the appliance (test environment) receives the same data for the network interfaces discovery. But, in production it seems that the interfaces that would normally be filtered out by the macro's (which apparently works in test) are now still added. While comparing data it looks like the test environment for example receives the netwerk interface names as QoS, teredo etc. In production, it looks like the interface names are moved to the interface description, where a different macro is applied and therefore the interfaces aren't filtered out. But, this is a guess...

Some information from the database to show the found interfaces:
Production:

Code:

mysql> SELECT DISTINCT
    ->        SUBSTRING_INDEX(
    ->          SUBSTRING_INDEX(i.name,'(',-1),
    ->          ')',1
    ->        ) AS interface_name
    -> FROM items i
    -> JOIN hosts h ON h.hostid = i.hostid
    -> WHERE h.host = 'SVR-MAC-APP03'
    ->   AND i.flags = 4
    ->   AND i.key_ LIKE 'net.if.in[%'
    -> ORDER BY interface_name;
+------------------------------------------------------------------+
| interface_name                                                   |
+------------------------------------------------------------------+
| Ethernet0                                                        |
| Ethernet0-QoS Packet Scheduler-0000                              |
| Ethernet0-WFP 802.3 MAC Layer LightWeight Filter-0000            |
| Ethernet0-WFP Native MAC Layer LightWeight Filter-0000           |
| Local Area Connection* 1                                         |
| Local Area Connection* 2                                         |
| Local Area Connection* 3                                         |
| Local Area Connection* 4                                         |
| Local Area Connection* 5                                         |
| Local Area Connection* 6                                         |
| Local Area Connection* 7                                         |
| Local Area Connection* 7-QoS Packet Scheduler-0000               |
| Local Area Connection* 7-WFP Native MAC Layer LightWeight Filter |
| Local Area Connection* 8                                         |
| Local Area Connection* 8-QoS Packet Scheduler-0000               |
| Local Area Connection* 8-WFP Native MAC Layer LightWeight Filter |
| Local Area Connection* 9                                         |
| Local Area Connection* 9-QoS Packet Scheduler-0000               |
| Local Area Connection* 9-WFP Native MAC Layer LightWeight Filter |
| Loopback Pseudo-Interface 1                                      |
+------------------------------------------------------------------+
20 rows in set (0.00 sec)

Test:

Code:

mysql> SELECT DISTINCT
    ->        SUBSTRING_INDEX(
    ->          SUBSTRING_INDEX(i.name,'(',-1),
    ->          ')',1
    ->        ) AS interface_name
    -> FROM items i
    -> JOIN hosts h ON h.hostid = i.hostid
    -> WHERE h.host = 'SVR-MAC-APP03'
    ->   AND i.flags = 4
    ->   AND i.key_ LIKE 'net.if.in[%'
    -> ORDER BY interface_name;
+----------------+
| interface_name |
+----------------+
| Ethernet0      |
+----------------+
1 row in set (0.00 sec)

When running an SNMP walk to the same host, there are also differences to see: On the production server the response is in HEX, on the testserver i receive a response in text. A small part of the output:
Production:

Code:

snmpwalk -v2c -c thisissecret:) hostip 1.3.6.1.2.1.2.2.1.2
iso.3.6.1.2.1.2.2.1.2.1 = Hex-STRING: 53 6F 66 74 77 61 72 65 20 4C 6F 6F 70 62 61 63
6B 20 49 6E 74 65 72 66 61 63 65 20 31 00
iso.3.6.1.2.1.2.2.1.2.2 = Hex-STRING: 57 41 4E 20 4D 69 6E 69 70 6F 72 74 20 28 4E 65
74 77 6F 72 6B 20 4D 6F 6E 69 74 6F 72 29 00

Test:

Code:

snmpwalk -v2c -c thisissecret:) hostip 1.3.6.1.2.1.2.2.1.2
IF-MIB::ifDescr.1 = STRING: Software Loopback Interface 1.
IF-MIB::ifDescr.2 = STRING: WAN Miniport (Network Monitor).

Can someone give me a helping hand in achieving the same results in both enviroments?

Question on deletion of hosts and retention of historical data

MrMasterPatcher — Tue, 25 Aug 2026 21:02:37 GMT

We are currently being audited by a software vendor, and they have asked us to demonstrate that our monitoring system does not contain any data related to a specific software application. That requirement seems unusual, but I need to verify what data may still exist in Zabbix.

If I deleted hosts from Zabbix in May, does Zabbix immediately remove all historical data associated with those hosts, or is that data retained and cleaned up later by the Housekeeper process?
I understand that Housekeeper manages historical data retention, but I'm unclear whether it only applies to currently configured hosts or if it also retains data from hosts that have already been deleted. For example, if my history retention period is 760 days, could historical data from deleted hosts still exist in the database?

If historical data is retained after host deletion, is there a supported way to purge that data for specific deleted hosts without affecting the historical data of other hosts that I still want to keep?

Web Scenarios & Notifications

DepstR — Mon, 24 Aug 2026 11:46:53 GMT

Hi all,

I'd like to monitor a lot of our private websites on the local network. I've read that this can be achieved via Web Scenarios. For context, I'm used to traditional web monitoring solutions (status pages etc.).

We have about 10 servers on the network, each hosting a couple of sites on different FQDNs. So for each site I want to monitor, I've created a web scenario.

But that alone does not give me alerts/notifications. As far as I've dug and looked... it isn't native? By my understanding I'd need a trigger to generate a problem, and based on that I can get a notification/alert.

I figured I'd create a generic template that would give me a generic trigger like "Web: example.com is unhealthy / not OK" but for that I need the scenario name. As far as I've read, I can't achieve some type of Discovery to create these triggers automatically either.

I'm new to Zabbix and a bit lost in the UI. The fact that this is a long-term production setup with a lot of old/legacy templates and dashboards doesn't help either.

Zabbix version. 7.0.28

Am I missing something?
Any help or point in the right directions would be very welcomed.
Thanks.

API calls can't connect to DB but frontend is working

argibbs — Sat, 22 Aug 2026 12:44:11 GMT

This post has been deleted as the issue was simply being on the wrong Zabbix server.

Super Admin role required for API requests

frogstarr78 — Sat, 22 Aug 2026 01:57:45 GMT

Is it expected behavior that the Super Admin role is required for a user to use an API Token?

I have a separate user than myself. API responses come back empty(ish)

{"jsonrpc":"2.0","result":[],"id":1}

If I use my own account, which is a Super admin, without an API Token: https://www.zabbix.com/documentation...authentication the same payload returns a result.

If I convert the user in question, to a Super Admin role, then they can make api requests, both using their username/password and the api token. In fact, after I change their role, they can use the token returned from the user.login method prior to the change even, which seems like a bit of a security issue as well . As soon as I change their role back to Admin role, requests return nothing. They do not fail authentication either, so that's good. I don't see any relevant errors for the requests in the logs. Although, I may not have the necessary log level to see any.

With the user set to the Admin role, the "Access to API" permission IS enabled.

This is for Zabbix 7.4.13 and jsonrpc 2.0.running on Ubuntu 24.04

Any suggestions? Is this known/expected behavior?

Can zabbix-proxy use the system dns cache?

Atroskelis — Fri, 21 Aug 2026 10:06:01 GMT

I've researched a bit about this, but i only find people complaining about zabbix agent ~ zabbix server repeated dns requests.

Im curious about Zabbix Proxy ~ hosts added by fqdn, if it can use the local systemctl-resolve or any dns caching on the system the proxy itself is using.

I know about https://support.zabbix.com/browse/ZBXNEXT-1002 but it seems to apply to only the zabbix agent?

Any info would be valuable.

Thanks!

No auth token found, please login before making Zabbix requests

armbl — Thu, 20 Aug 2026 19:58:30 GMT

Hello;

I am currently having an issue with hosts that are using Zabbix sender embedded inside a Kubernetes pod to send data to the server, which is running on Zabbix version 7.4. Despite apparently succeeding in logging into the server, there is an authorization error after the login succeeds mentioning a missing auth token - note that as of currently, I have not set any requirement for an auth token in the system, and the hosts running on Zabbix Agent are connecting properly and functioning as intended despite having no auth token set up. It may be worth mentioning that these hosts were originally directed towards a separate Zabbix server running on version 4.4, and that I am in the process of redirecting them to the new server rather than making them as part of a fresh installation.

The following is a condensed version of the error that occurs every 5 minutes, with all potentially sensitive information for names of pods and templates removed:

Code:

2026-08-20T18:55:34.620+00:00 INF [pod]:  Logging into Zabbix
2026-08-20T18:55:34.701+00:00 INF [pod]:  Zabbix login successful
2026-08-20T18:55:34.701+00:00 INF [pod]:  Getting Zabbix template ID for "x"
2026-08-20T18:55:34.701+00:00 ERR [pod]:  Failed Zabbix upload/host creation with error: No auth token found, please login before making Zabbix requests

Note that despite claiming that logging in was successful, there are no records on the side of the Zabbix server showing that there was a connection from this IP address.

Any help would be appreciated, and I thank you for your time.

Trigger Description - Can I use item values?

tcweb — Thu, 20 Aug 2026 13:13:19 GMT

I have a template I created that I link to the base Linux/windows templates. I've added some items and dependent items, etc.
I'd like to be able to use item values in a trigger description. The documentation says that macros are valid in trigger descriptions.

I'm trying this: (I cloned the default trigger for high PCU, and modified the description.

Windows: High CPU utilization (over 90% for 5m) {?last(//top.cpu.pname)} : {?last(//top.cpu.pct)}%

I end up with *UNKNOWN* after the macros expand:

Windows: High CPU utilization (over 90% for 5m) *UNKNOWN* : *UNKNOWN*%

Here are all of the relevent items from the host perspective, so they are all available and populated:

I've tried several variations, but I'm starting to wonder if the fact that these templates are linked is the issue? In order for this to work, do I need all of the item values to be in the SAME template?

Thanks,

-Tom

Forcing Zabbix Agent 2 Active Items to Send Values Immediately

Marcin_k — Wed, 19 Aug 2026 18:40:37 GMT

With Zabbix Agent (version 1) using active checks, restarting the zabbix-agent service forced all items to collect and send their values to the Zabbix server immediately.

I am now configuring Zabbix Agent 2 in Docker, but restarting the container does not appear to force active items to collect or send values. If an item's update interval is set to one hour, I seem to have to wait an hour for its initial value to be collected and sent to the server after the item is created.

Is there a way to force Zabbix Agent 2 to immediately collect and send values for active items. This is particularly inconvenient when testing new items.

ZABBIX AGENT2 - Erro Unknown metric pgsql.oldest.xid

voltere.silva — Wed, 19 Aug 2026 18:06:41 GMT

I am setting up PostgreSQL monitoring in Zabbix using Zabbix Agent 2 and the PostgreSQL plugin, but there is an error in the monitoring data. "Unknown metric pgsql.oldest.xid." Zabbix server version 7.0.29 and plugin PostGreSQL version 7.0.29. I have already checked the agent and module configuration files, but I cannot find where the configuration error lies.

Zabbix 7.0: Direct Inbound Integration from Dynatrace via Webhook (JSON-RPC 2.0)

fernando.moreira — Tue, 18 Aug 2026 14:53:54 GMT

Hi everyone,

I'm implementing an inbound integration from Dynatrace Managed to Zabbix 7.0. The goal is to have Dynatrace push its Problems directly into Zabbix without an intermediate middleware script.

Current Setup:

Dynatrace is using a "Custom Integration" Webhook pointing to /zabbix/api_jsonrpc.php.
Zabbix responds with HTTP 200, but since the Dynatrace payload is a flat JSON, Zabbix returns an internal error : {"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid params."},"id":1}.
Zabbix API expects a strict JSON-RPC 2.0 structure (method, params, auth).

What I've verified:

Connectivity: ActiveGates reach the Zabbix server successfully.
Zabbix Trapped: Works manually via zabbix_sender on the server, but Dynatrace speaks HTTP, not the binary protocol.
API: I can get a token and query items via curl.

My Questions:

Is there a native way in Zabbix 7.0 to create an HTTP Listener or a Media Type that can catch a plain JSON POST and translate it into a Zabbix Problem?
Can I use the HTTP Agent or a Script item to act as an endpoint for external webhooks?
Has anyone successfully implemented a Zabbix-side "JavaScript bridge" within a Media Type to handle these incoming JSON-RPC calls?

Thanks for any help or templates!
Fernando Moreira

Synology Template Overhaul: SNMP issue tracking disks as LLD hosts

killom — Tue, 18 Aug 2026 10:43:47 GMT

Hello,

I am currently trying to track all the disks of several Synology NAS systems in Zabbix.

The goal is to keep the NAS as the main host, while creating the individual disks as separate hosts through low-level discovery. This would allow us to track SMART values and attach disk-specific triggers and inventory information to each drive, and keep each information

The disk information is spread across several SNMP tables. Depending on the Synology model, I can receive:

Serial numbers
Model names

Code:

/dev/sdX

Code:

sataX

device names
SMART attribute names and raw values

The table positions cannot be used for matching, so the entries have to be correlated by their identity. For example:

Code:

/dev/sda = sda = Drive 1

This part is working reasonably well.

The problem is that the parent NAS host and the discovered disk hosts all use the same SNMPv3 interface and target IP. This unpleasantly leads to errors:

Code:

SNMP engineId is not unique

It appears that simply adjusting the check intervals is not a reliable solution. The conflict is related to the same SNMP source being monitored through multiple Zabbix hosts.

I mean, it is working ... somehow. The engineID will always collide somewhere else, so all metrics will finally arrive at some point. But I wouldn't call it "reliable"

Has anyone implemented a similar parent/child design, or can recommend the cleanest approach for this in Zabbix? I dont want to loose the individual tracking for the discs, because this way it is easier to view and monitor such assets.

How do you go about alerting via MS Teams?

mickeyMoose — Tue, 18 Aug 2026 06:36:17 GMT

Hi there,
I'm configuring Zabbix notifications using an MS Teams Workflow media type and I'm trying to understand how others handle the user/media relationship.

Scenario:
- Media type "MS Teams - Alerts" is configured to sends notifications to Teams chat.
- Above media type is used in Trigger Action which is set to send anything that is a Warning (or above) to "Cloud Team" (user group) via "MS Teams - Alerts" (media type)
- At least one user in "Cloud Team" needs to have a media type "MS Teams - Alerts" configured in their User Settings
* However, if more than one user has it configured, the notification is sent more than once
* Also, the fact that notifications are sent is dependent on one user (what if this account is deleted etc.?)

How do you handle this?
Do you create a dedicated account for alerts and attach all media types to it? If so, does the account need any specific permissions?
Also, I've noticed that there's a way to set media type during user provisioning based on SAML attribute, but that seems to cover email only (or not?)

Am I missing something here?

Zabbix Trigger Logic

SamuelD — Mon, 17 Aug 2026 16:20:32 GMT

I would like to implement this structure to the way my triggers occur. I have tried many options but it never seems to work.

Trigger name:
FMS Master is Down

Expression:
last(/LINUX FMS/system.run[pgrep -x fmshelper | wc -l])=0
and
last(/LINUX FMS/system.uptime)>60m

Trigger name:
Scripting Engine is Down

Expression:
last(/LINUX FMS/system.run[pgrep -x fmsased | wc -l])=0
and
last(/LINUX FMS/system.uptime)>60m
and
last(/LINUX FMS/system.run[pgrep -x fmshelper | wc -l])=1

I tried to make it that it gives it an hour before it says something but it still sends all the messages to the users when the server is restarted. We don't want it to send us these triggers unless the system hasn't been restarted, because its already implied these processes are down. If FMS Helper Service goes down, all FMS sub-processes go down with it. Nginx does not, but we do not want Nginx to only alert us if it down, not if the system restarted, causing it to be down with it. If anyone could please help, that would be very lovely!

Here is my current infrastructure.

SAML JIT and Admin account

ZabbixSeeker — Mon, 17 Aug 2026 13:00:01 GMT

Am I reading this right? From Zabbix DOC:
"If SAML authentication is enabled, users will be able to choose between logging in locally or via SAML single sign-on. If JIT provisioning is used, then only single sign-on is possible.".

So, if I enable JIT which kind of is reasonable, then the local Admin account cannot be used (unless it's in the AD). So if AD or the internet connection goes down, you lock out the Admin account?

Question: what is the point of locking out the Admin acount?