How to get IP address as parameter in key?

[Chazz]

I am trying to monitor network traffic on Windows workstations.

I have agent installed on the machines and the hosts are registered in Zabbix by Hostname.

The network usage items like "net.if.total[if]" require us to specify an interface. As far as I know, this could be done by specifying the IP address of the interface, but how do I get it there if I don't know it beforehand?

I managed to get the current IP of a workstation by creating external script "getip.sh":

dig +short $1

and doing external check "getip.sh[{HOST.HOST}]".

Now I have the IP address as a separate item, but it doesn't seem to work for specifying interface in another item key:

Invalid key "net.if.total[{getip.sh[{HOST.HOST}].last(0)}]" for item "Network - total" on "Windows PC": incorrect syntax near ".last(0)}]".

What should I do? Can I somehow assign the item value to a user macro?

P.S. To be explicit - "net.if.total[{HOST.IP}]" does not work as the connection is specified by hostname only.

[Quimby]

Why aren't you using network interface discovery? It detects all your adapters and you can create item prototype for "net.if.total".

https://www.zabbix.com/documentation/3.0/manual/discovery/low_level_discovery

[Chazz]

First of all, there is quite a lot of interfaces on some of the machines. I am only interested in the actual used interface - the one through which the connection to machine currently works.

Secondly, I would like the stats to have the same name for all the machines so they'd be in the same column in the overview.

I have no idea how to get from discovery to three items - net.if.in, net.if.out and net.if.total.

[Chazz]

To continue the discussion. Here is a discovery example:

net.if.discovery                              [s|{"data":[
  {"{#IFNAME}":"WAN Miniport (IPv6)"},
  {"{#IFNAME}":"WAN Miniport (Network Monitor)"},
  {"{#IFNAME}":"Realtek PCIe GBE Family Controller-QoS Packet Scheduler-0000"},
  {"{#IFNAME}":"Realtek PCIe GBE Family Controller-WFP LightWeight Filter-0000"},
  {"{#IFNAME}":"WAN Miniport (IP)"},
  {"{#IFNAME}":"WAN Miniport (Network Monitor)-QoS Packet Scheduler-0000"},
  {"{#IFNAME}":"Realtek PCIe GBE Family Controller"},
  {"{#IFNAME}":"WAN Miniport (IP)-QoS Packet Scheduler-0000"},
  {"{#IFNAME}":"WAN Miniport (IPv6)-QoS Packet Scheduler-0000"},
  {"{#IFNAME}":"WAN Miniport (PPPOE)"},
  {"{#IFNAME}":"RAS Async Adapter"},
  {"{#IFNAME}":"Software Loopback Interface 1"},
  {"{#IFNAME}":"WAN Miniport (SSTP)"},
  {"{#IFNAME}":"WAN Miniport (IKEv2)"},
  {"{#IFNAME}":"WAN Miniport (L2TP)"},
  {"{#IFNAME}":"WAN Miniport (PPTP)"},
  {"{#IFNAME}":"Microsoft ISATAP Adapter"},
  {"{#IFNAME}":"Microsoft 6to4 Adapter"},
  {"{#IFNAME}":"Teredo Tunneling Pseudo-Interface"}]}]

How do I find which of the interface are enabled and physical? I only need those but I have nothing to filter by...

[Quimby]

Just filter the adapters you are not interested generally.

this is our list:
^TAP [Result is FALSE]
Filter Driver [Result is FALSE]
Hyper-V Virtual Switch [Result is FALSE]
Multiplexor [Result is FALSE]
^IPHTTPSInterface [Result is FALSE]
WFP LightWeight [Result is FALSE]
WFP 802 [Result is FALSE]
QoS Pack [Result is FALSE]
^Microsoft Kernel [Result is FALSE]
^RAS Async [Result is FALSE]
^Microsoft-ISATAP [Result is FALSE]
^WAN Miniport [Result is FALSE]
Teredo [Result is FALSE]
^Software Loopback Interface [Result is FALSE]
WFP Native MAC Layer [Result is FALSE]
Microsoft ISATAP [Result is FALSE]
6to4 [Result is FALSE]
Hyper-V Network Switch [Result is FALSE]
isatap [Result is FALSE]
RAS [Result is FALSE]
WAN-Miniport [Result is FALSE]
Loopback [Result is FALSE]
^lo$ [Result is FALSE]

[Chazz]

Thank you for the replies!

I did not really trust this approach as some IS_ENABLED and IS_PHYSICAL filters/checks would seem what I actually need. But if that's not possible, I'll just try to catch and exclude all the false adapters as you suggested.

I ended up with
(Loopback|Miniport|Microsoft|Teredo|LightWeight|Qo S|RAS|Extension|isatap) [Result is FALSE]
and it seems to filter out all that I didn't want to see