Turn off monitoring of "High CPU utilization "

[[email protected]]

We have 3x OpenSUSE Leap boxes running network scans on our servers internally and externally. They are basic boxes but running hard a lot of the time when they are running scheduled scans almost 24 / 7. In our Zabbix monitor we get a lot of alerts for these boxes of the nature "High CPU utilization (over 90% for 5m)". This is perfectly normal behaviour for these boxes a lot of each day. We are aware of it and do not require the alerts for this. How can we keep monitoring the boxes for everything el

[tim.mooney]

You've provided almost no information about your environment, which makes answering your question more work. The general answer would be "adjust your trigger so that it isn't so sensitive" or perhaps just "delete that specific trigger" if you don't care about being alerted about that data.

If you are using one of the official Zabbix templates (are you? You didn't say), then the data collection (the item) and the threshold for deciding if there is a problem (the trigger) are no doubt part of a template. Many of the official templates are configurable via macros, so you might be able to adjust the utilization setting or the duration it has to be continuously above the utilization setting before a problem is triggered. You could look at the templates you're using and figure out if there are macros that allow you to change that.

I would probably just delete that trigger from the hosts you don't want it to be applied to, but there are some things to consider when the configuration comes from a template. You should probably read the documentation on triggers, and templates, to get a better handle on how it works.

[[email protected]]

Thank you for the swift reply. Sorry the original post was so vague. I am new on the Zabbix front and not the system administrator for it. I will try and find out if a template is used on these boxes and see about the trigger for this item. I do not think adjusting the threshold is an option as these run around 100% during scans so that would still trigger an alert a lot but I will see if we can remove with compromising the template (if one is in use).

[[email protected]]

It turns out we were using the "Linux by Zabbix Agent" template. I have created a new template for the three servers in question as a test removing the high CPU warning macro and will see how this works out for us.

[tim.mooney]

It turns out we were using the "Linux by Zabbix Agent" template. I have created a new template for the three servers in question as a test removing the high CPU warning macro and will see how this works out for us.

Well done. I think that will likely address your issue.

The pre-defined templates that come with Zabbix are a very good starting point and they make excellent use of macros so they can be tailored for different threshholds needed in different environments. They aren't perfect for every host, though.

Doing a full clone of an official template and renaming it (something like "<Your Organization> Custom Linux by Zabbix Agent") can be a good place to start if you need to "pare down" some items or triggers. It sounds like that's probably what you've already done, so I think you're in good shape.

"Pro tip": when you full clone and then start altering what's part of your template, it can be useful to use the template's "Description" field to say what Zabbix version the template started with and some brief notes about what you removed, what you added, what you changed, etc. It's possible to export templates and use text difference tools like "diff" to figure out what's changed, but just keeping notes in the Description might be really handy for your coworkers.

[[email protected]]

Thank you for the follow up on that. This is all really good ideas and very helpful as I try to look at another tweak to the templates we use on the servers.