shortest update interval

[js1]

What's the shortest update interval that's reasonable for an external script item check?

[nelsonab]

This is a *very* subjective question. :-)

It depends on what you are wanting to monitor. 30 seconds tends to be the smallest usable resolution. Any smaller and you start to increase the load on the database and server and increase the possibility of false positives. This effect is multiplied if you're doing this across many hosts. Where the data is coming from can also have an impact on the usability of shorter intervals. For instance if your item is SNMP you may find that a resolution for 30 seconds does not work well if you're trying to query 200 items from the device.

I can see some situations where a smaller resolution might be benifitial such as link status between core switches, but you also have another factor to consider, network latency and possible congestion between the Zabbix server and the device. Let's say you're monitoring the link status between your core routers and you're looking at it every 5 seconds (overkill in most cases, but not all). Let's also say that you have a trigger set to go off if the link is down for 10 seconds. If you have a 10 second glitch in communication between the Zabbix server and device (which is possible) then you'll have a trigger fire off and a false positive.

At one place I was at we would monitor our Power MTA queues. The script which would dump the queue data was CPU intensive and we didn't want to take away from CPU as this would mean fewer emails would be delivered (at the time they delivered about 12 billion email messages a year). We wrote a wrapper script that would dump the data and store it in a data file. If the data file was less than 2 minutes old it would return the information in the data file. Older than two minutes and it would redump the file. The associated Zabbix items were only set to query once every 5 minutes.

Hopefully this makes sense and helps. :-)


Wooo hooo 500th post! :-D

[js1]

Thanks for the thoughtful response. I was able to use some confidence interval calculators to determine a 20 second between checks should more than sufficient for what I'm trying to do.

[nelsonab]

One other thing to consider which I did not dive into very much is the way items are queried. Most of them are queried in a serial manner which means each item requires an individual connection for that one item. If you have 100 items each queried every 20 seconds that means every 20 seconds 100 individual connections are made. I know there is work being made on making more queries work in a batch manner, and I think the current protocol supports this capability, but I do not know if it uses it. I believe however that active checks will send results back to the Zabbix server in a batch manner.