Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/7.4
Linux by Zabbix agent
Overview
This is an official Linux template. It requires Zabbix agent 7.4 or newer.
Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
- Utilization formula:
pused = 100 - 100 * (available / total - free + available)
- Utilization formula:
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.
Requirements
Zabbix version: 7.4 and higher.
Tested versions
This template has been tested on:
- Linux OS
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Install Zabbix agent on Linux OS following Zabbix documentation.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | Critical threshold of CPU utilization expressed in %. |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | The CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$VFS.FS.PUSED.MAX.WARN} | The warning threshold of the filesystem utilization. |
80 |
{$VFS.FS.PUSED.MAX.CRIT} | The critical threshold of the filesystem utilization. |
90 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | The warning threshold of the filesystem metadata utilization. |
20 |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | The critical threshold of the filesystem metadata utilization. |
10 |
{$VFS.FS.FSNAME.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
.+ |
{$VFS.FS.FSNAME.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VFS.FS.FSTYPE.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.FS.FSTYPE.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^\s$ |
{$MEMORY.UTIL.MAX} | Used as a threshold in the memory utilization trigger. |
90 |
{$MEMORY.AVAILABLE.MIN} | Used as a threshold in the available memory trigger. |
20M |
{$SWAP.PFREE.MIN.WARN} | The warning threshold of the minimum free swap. |
50 |
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger fires. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger fires. |
20 |
{$VFS.DEV.DEVNAME.MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
.+ |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$IFCONTROL} | Link status trigger will be fired only for interfaces where the context macro equals "1". |
1 |
{$IF.UTIL.MAX} | Used as a threshold in the interface utilization trigger. |
90 |
{$IF.ERRORS.WARN} | Warning threshold of error packet rate. Can be used with interface name as context. |
2 |
{$NET.IF.IFNAME.MATCHES} | Used for network interface discovery. Can be overridden on the host or linked template level. |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filters out |
Macro too long. Please see the template. |
{$KERNEL.MAXPROC.MIN} | 1024 |
|
{$KERNEL.MAXFILES.MIN} | 256 |
|
{$SYSTEM.FUZZYTIME.MIN} | The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping. |
10s |
{$SYSTEM.FUZZYTIME.MAX} | The upper threshold for difference of system time. |
60s |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Version of Zabbix agent running | Zabbix agent | agent.version Preprocessing
|
|
Host name of Zabbix agent running | Zabbix agent | agent.hostname Preprocessing
|
|
Zabbix agent ping | The agent always returns "1" for this item. May be used in combination with |
Zabbix agent | agent.ping |
Zabbix agent availability | Used for monitoring the availability status of the agent. |
Zabbix internal | zabbix[host,agent,available] |
Number of CPUs | Zabbix agent | system.cpu.num Preprocessing
|
|
Load average (1m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg1] |
Load average (5m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg5] |
Load average (15m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg15] |
CPU utilization | CPU utilization expressed in %. |
Dependent item | system.cpu.util Preprocessing
|
CPU idle time | Time the CPU has spent doing nothing. |
Zabbix agent | system.cpu.util[,idle] |
CPU system time | Time the CPU has spent running the kernel and its processes. |
Zabbix agent | system.cpu.util[,system] |
CPU user time | Time the CPU has spent running users' processes that are not niced. |
Zabbix agent | system.cpu.util[,user] |
CPU nice time | Time the CPU has spent running users' processes that have been niced. |
Zabbix agent | system.cpu.util[,nice] |
CPU iowait time | Time the CPU has been waiting for I/O to complete. |
Zabbix agent | system.cpu.util[,iowait] |
CPU steal time | The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
Zabbix agent | system.cpu.util[,steal] |
CPU interrupt time | Time the CPU has spent servicing hardware interrupts. |
Zabbix agent | system.cpu.util[,interrupt] |
CPU softirq time | Time the CPU has been servicing software interrupts. |
Zabbix agent | system.cpu.util[,softirq] |
CPU guest time | Time spent on running a virtual CPU for a guest operating system. |
Zabbix agent | system.cpu.util[,guest] |
CPU guest nice time | Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
Zabbix agent | system.cpu.util[,guest_nice] |
Context switches per second | The combined rate at which all processors on the computer are switched from one thread to another. |
Zabbix agent | system.cpu.switches Preprocessing
|
Interrupts per second | Number of interrupts processed. |
Zabbix agent | system.cpu.intr Preprocessing
|
Get filesystems | The |
Zabbix agent | vfs.fs.get |
Memory utilization | The percentage of used memory is calculated as |
Dependent item | vm.memory.utilization Preprocessing
|
Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[pavailable] |
Total memory | Total memory expressed in bytes. |
Zabbix agent | vm.memory.size[total] |
Available memory | The available memory: - in Linux = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[available] |
Total swap space | The total space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,total] |
Free swap space | The free space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,free] |
Free swap space in % | The free space of the swap volume/file expressed in %. |
Zabbix agent | system.swap.size[,pfree] |
System uptime | The system uptime expressed in the following format: "N days, hh:mm:ss". |
Zabbix agent | system.uptime |
System boot time | Zabbix agent | system.boottime Preprocessing
|
|
System local time | The local system time of the host. |
Zabbix agent | system.localtime |
System name | The host name of the system. |
Zabbix agent | system.hostname Preprocessing
|
System description | The information as normally returned by |
Zabbix agent | system.uname Preprocessing
|
Number of logged in users | The number of users who are currently logged in. |
Zabbix agent | system.users.num |
Maximum number of open file descriptors | May be increased by using the |
Zabbix agent | kernel.maxfiles Preprocessing
|
Maximum number of processes | May be increased by using the |
Zabbix agent | kernel.maxproc Preprocessing
|
Number of processes | Zabbix agent | proc.num | |
Number of running processes | Zabbix agent | proc.num[,,run] | |
Checksum of /etc/passwd | Zabbix agent | vfs.file.cksum[/etc/passwd,sha256] Preprocessing
|
|
Operating system | Zabbix agent | system.sw.os Preprocessing
|
|
Operating system architecture | The architecture of the operating system. |
Zabbix agent | system.sw.arch Preprocessing
|
Number of installed packages | Zabbix agent | system.sw.packages.get Preprocessing
|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Zabbix agent is not available | For passive agents only, host availability is used with |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
Average | Manual close: Yes |
Linux: Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
Average | |
Linux: High CPU utilization | CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | Depends on:
|
Linux: High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
Average | Depends on:
|
Linux: Lack of available memory | The system is running out of memory. |
max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
Average | |
Linux: High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
Warning | Depends on:
|
Linux: {HOST.NAME} has been restarted | The host uptime is less than 10 minutes. |
last(/Linux by Zabbix agent/system.uptime)<10m |
Warning | Manual close: Yes |
Linux: System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
Warning | Manual close: Yes |
Linux: System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.hostname) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
Info | Manual close: Yes |
Linux: Configured max number of open filedescriptors is too low | last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
Info | ||
Linux: Configured max number of processes is too low | last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
Info | Depends on:
|
|
Linux: Getting closer to process limit | last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
Warning | ||
Linux: /etc/passwd has been changed | last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
Info | Manual close: Yes Depends on:
|
|
Linux: Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.sw.os) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
Info | Manual close: Yes Depends on:
|
Linux: Number of installed packages has been changed | change(/Linux by Zabbix agent/system.sw.packages.get)<>0 |
Warning | Manual close: Yes |
LLD rule Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
Dependent item | vfs.fs.dependent.discovery Preprocessing
|
Item prototypes for Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FS [{#FSNAME}]: Get data | Intermediate data of |
Dependent item | vfs.fs.dependent[{#FSNAME},data] Preprocessing
|
FS [{#FSNAME}]: Option: Read-only | The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher. |
Dependent item | vfs.fs.dependent[{#FSNAME},readonly] Preprocessing
|
FS [{#FSNAME}]: Space: Used | Used storage expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},used] Preprocessing
|
FS [{#FSNAME}]: Space: Total | Total space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},total] Preprocessing
|
FS [{#FSNAME}]: Space: Used, in % | Calculated as the percentage of currently used space compared to the maximum available space. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},pused] Preprocessing
|
FS [{#FSNAME}]: Space: Available | Available storage space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},free] Preprocessing
|
FS [{#FSNAME}]: Inodes: Free, in % | Free metadata space expressed in %. |
Dependent item | vfs.fs.dependent.inode[{#FSNAME},pfree] Preprocessing
|
Trigger prototypes for Mounted filesystem discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: FS [{#FSNAME}]: Filesystem has become read-only | The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher. |
last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly],#2)=0 and last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly])=1 |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is critically low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
Average | |
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
Warning | Depends on:
|
LLD rule Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | Zabbix agent | vfs.dev.discovery |
Item prototypes for Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DEVNAME}: Get stats | The contents of get |
Zabbix agent | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing
|
{#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
Dependent item | vfs.dev.read.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
Dependent item | vfs.dev.write.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in |
Dependent item | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in |
Dependent item | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.read.await[{#DEVNAME}] |
{#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.write.await[{#DEVNAME}] |
{#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
Dependent item | vfs.dev.queue_size[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk utilization | The percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
Dependent item | vfs.dev.util[{#DEVNAME}] Preprocessing
|
Trigger prototypes for Block devices discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: {#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
Warning | Manual close: Yes |
LLD rule Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | The discovery of network interfaces. |
Zabbix agent | net.if.discovery |
Item prototypes for Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}: Bits received | Zabbix agent | net.if.in["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Bits sent | Zabbix agent | net.if.out["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets with errors | Zabbix agent | net.if.out["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets with errors | Zabbix agent | net.if.in["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets discarded | Zabbix agent | net.if.out["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets discarded | Zabbix agent | net.if.in["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing
|
Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing
|
Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing
|
Trigger prototypes for Network interface discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: Link down | This trigger expression works as follows: |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) |
Average | Manual close: Yes |
Linux: Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) |
Info | Manual close: Yes Depends on:
|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/7.2
Linux by Zabbix agent
Overview
This is an official Linux template. It requires Zabbix agent 7.2 or newer.
Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
- Utilization formula:
pused = 100 - 100 * (available / total - free + available)
- Utilization formula:
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.
Requirements
Zabbix version: 7.2 and higher.
Tested versions
This template has been tested on:
- Linux OS
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Install Zabbix agent on Linux OS following Zabbix documentation.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | Critical threshold of CPU utilization expressed in %. |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | The CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$VFS.FS.FSNAME.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VFS.FS.FSNAME.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
.+ |
{$VFS.FS.FSTYPE.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.FS.FSTYPE.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | The critical threshold of the filesystem metadata utilization. |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | The warning threshold of the filesystem metadata utilization. |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | The critical threshold of the filesystem utilization. |
90 |
{$VFS.FS.PUSED.MAX.WARN} | The warning threshold of the filesystem utilization. |
80 |
{$MEMORY.UTIL.MAX} | Used as a threshold in the memory utilization trigger. |
90 |
{$MEMORY.AVAILABLE.MIN} | Used as a threshold in the available memory trigger. |
20M |
{$SWAP.PFREE.MIN.WARN} | The warning threshold of the minimum free swap. |
50 |
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger fires. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger fires. |
20 |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.DEV.DEVNAME.MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
.+ |
{$IF.ERRORS.WARN} | Warning threshold of error packet rate. Can be used with interface name as context. |
2 |
{$IFCONTROL} | Link status trigger will be fired only for interfaces where the context macro equals "1". |
1 |
{$NET.IF.IFNAME.MATCHES} | Used for network interface discovery. Can be overridden on the host or linked template level. |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filters out |
Macro too long. Please see the template. |
{$IF.UTIL.MAX} | Used as a threshold in the interface utilization trigger. |
90 |
{$SYSTEM.FUZZYTIME.MAX} | The upper threshold for difference of system time. |
60s |
{$SYSTEM.FUZZYTIME.MIN} | The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping. |
10s |
{$KERNEL.MAXPROC.MIN} | 1024 |
|
{$KERNEL.MAXFILES.MIN} | 256 |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Version of Zabbix agent running | Zabbix agent | agent.version Preprocessing
|
|
Host name of Zabbix agent running | Zabbix agent | agent.hostname Preprocessing
|
|
Zabbix agent ping | The agent always returns "1" for this item. May be used in combination with |
Zabbix agent | agent.ping |
Zabbix agent availability | Used for monitoring the availability status of the agent. |
Zabbix internal | zabbix[host,agent,available] |
Number of CPUs | Zabbix agent | system.cpu.num Preprocessing
|
|
Load average (1m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg1] |
Load average (5m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg5] |
Load average (15m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg15] |
CPU utilization | CPU utilization expressed in %. |
Dependent item | system.cpu.util Preprocessing
|
CPU idle time | Time the CPU has spent doing nothing. |
Zabbix agent | system.cpu.util[,idle] |
CPU system time | Time the CPU has spent running the kernel and its processes. |
Zabbix agent | system.cpu.util[,system] |
CPU user time | Time the CPU has spent running users' processes that are not niced. |
Zabbix agent | system.cpu.util[,user] |
CPU nice time | Time the CPU has spent running users' processes that have been niced. |
Zabbix agent | system.cpu.util[,nice] |
CPU iowait time | Time the CPU has been waiting for I/O to complete. |
Zabbix agent | system.cpu.util[,iowait] |
CPU steal time | The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
Zabbix agent | system.cpu.util[,steal] |
CPU interrupt time | Time the CPU has spent servicing hardware interrupts. |
Zabbix agent | system.cpu.util[,interrupt] |
CPU softirq time | Time the CPU has been servicing software interrupts. |
Zabbix agent | system.cpu.util[,softirq] |
CPU guest time | Time spent on running a virtual CPU for a guest operating system. |
Zabbix agent | system.cpu.util[,guest] |
CPU guest nice time | Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
Zabbix agent | system.cpu.util[,guest_nice] |
Context switches per second | The combined rate at which all processors on the computer are switched from one thread to another. |
Zabbix agent | system.cpu.switches Preprocessing
|
Interrupts per second | Number of interrupts processed. |
Zabbix agent | system.cpu.intr Preprocessing
|
Get filesystems | The |
Zabbix agent | vfs.fs.get |
Memory utilization | The percentage of used memory is calculated as |
Dependent item | vm.memory.utilization Preprocessing
|
Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[pavailable] |
Total memory | Total memory expressed in bytes. |
Zabbix agent | vm.memory.size[total] |
Available memory | The available memory: - in Linux = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[available] |
Total swap space | The total space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,total] |
Free swap space | The free space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,free] |
Free swap space in % | The free space of the swap volume/file expressed in %. |
Zabbix agent | system.swap.size[,pfree] |
System uptime | The system uptime expressed in the following format: "N days, hh:mm:ss". |
Zabbix agent | system.uptime |
System boot time | Zabbix agent | system.boottime Preprocessing
|
|
System local time | The local system time of the host. |
Zabbix agent | system.localtime |
System name | The host name of the system. |
Zabbix agent | system.hostname Preprocessing
|
System description | The information as normally returned by |
Zabbix agent | system.uname Preprocessing
|
Number of logged in users | The number of users who are currently logged in. |
Zabbix agent | system.users.num |
Maximum number of open file descriptors | May be increased by using the |
Zabbix agent | kernel.maxfiles Preprocessing
|
Maximum number of processes | May be increased by using the |
Zabbix agent | kernel.maxproc Preprocessing
|
Number of processes | Zabbix agent | proc.num | |
Number of running processes | Zabbix agent | proc.num[,,run] | |
Checksum of /etc/passwd | Zabbix agent | vfs.file.cksum[/etc/passwd,sha256] Preprocessing
|
|
Operating system | Zabbix agent | system.sw.os Preprocessing
|
|
Operating system architecture | The architecture of the operating system. |
Zabbix agent | system.sw.arch Preprocessing
|
Number of installed packages | Zabbix agent | system.sw.packages.get Preprocessing
|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Zabbix agent is not available | For passive agents only, host availability is used with |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
Average | Manual close: Yes |
Linux: Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
Average | |
Linux: High CPU utilization | CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | Depends on:
|
Linux: High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
Average | Depends on:
|
Linux: Lack of available memory | The system is running out of memory. |
max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
Average | |
Linux: High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
Warning | Depends on:
|
Linux: {HOST.NAME} has been restarted | The host uptime is less than 10 minutes. |
last(/Linux by Zabbix agent/system.uptime)<10m |
Warning | Manual close: Yes |
Linux: System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
Warning | Manual close: Yes |
Linux: System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.hostname) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
Info | Manual close: Yes |
Linux: Configured max number of open filedescriptors is too low | last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
Info | ||
Linux: Configured max number of processes is too low | last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
Info | Depends on:
|
|
Linux: Getting closer to process limit | last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
Warning | ||
Linux: /etc/passwd has been changed | last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
Info | Manual close: Yes Depends on:
|
|
Linux: Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.sw.os) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
Info | Manual close: Yes Depends on:
|
Linux: Number of installed packages has been changed | change(/Linux by Zabbix agent/system.sw.packages.get)<>0 |
Warning | Manual close: Yes |
LLD rule Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
Dependent item | vfs.fs.dependent.discovery Preprocessing
|
Item prototypes for Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FS [{#FSNAME}]: Get data | Intermediate data of |
Dependent item | vfs.fs.dependent[{#FSNAME},data] Preprocessing
|
FS [{#FSNAME}]: Option: Read-only | The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher. |
Dependent item | vfs.fs.dependent[{#FSNAME},readonly] Preprocessing
|
FS [{#FSNAME}]: Space: Used | Used storage expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},used] Preprocessing
|
FS [{#FSNAME}]: Space: Total | Total space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},total] Preprocessing
|
FS [{#FSNAME}]: Space: Used, in % | Calculated as the percentage of currently used space compared to the maximum available space. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},pused] Preprocessing
|
FS [{#FSNAME}]: Space: Available | Available storage space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},free] Preprocessing
|
FS [{#FSNAME}]: Inodes: Free, in % | Free metadata space expressed in %. |
Dependent item | vfs.fs.dependent.inode[{#FSNAME},pfree] Preprocessing
|
Trigger prototypes for Mounted filesystem discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: FS [{#FSNAME}]: Filesystem has become read-only | The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher. |
last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly],#2)=0 and last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly])=1 |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is critically low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
Average | |
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
Warning | Depends on:
|
LLD rule Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | Zabbix agent | vfs.dev.discovery |
Item prototypes for Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DEVNAME}: Get stats | The contents of get |
Zabbix agent | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing
|
{#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
Dependent item | vfs.dev.read.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
Dependent item | vfs.dev.write.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in |
Dependent item | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in |
Dependent item | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.read.await[{#DEVNAME}] |
{#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.write.await[{#DEVNAME}] |
{#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
Dependent item | vfs.dev.queue_size[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk utilization | The percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
Dependent item | vfs.dev.util[{#DEVNAME}] Preprocessing
|
Trigger prototypes for Block devices discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: {#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
Warning | Manual close: Yes |
LLD rule Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | The discovery of network interfaces. |
Zabbix agent | net.if.discovery |
Item prototypes for Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}: Bits received | Zabbix agent | net.if.in["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Bits sent | Zabbix agent | net.if.out["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets with errors | Zabbix agent | net.if.out["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets with errors | Zabbix agent | net.if.in["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets discarded | Zabbix agent | net.if.out["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets discarded | Zabbix agent | net.if.in["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing
|
Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing
|
Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing
|
Trigger prototypes for Network interface discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: Link down | This trigger expression works as follows: |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) |
Average | Manual close: Yes |
Linux: Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) |
Info | Manual close: Yes Depends on:
|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/7.0
Linux by Zabbix agent
Overview
This is an official Linux template. It requires Zabbix agent 7.0 or newer.
Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
- Utilization formula:
pused = 100 - 100 * (available / total - free + available)
- Utilization formula:
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.
Requirements
Zabbix version: 7.0 and higher.
Tested versions
This template has been tested on:
- Linux OS
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Install Zabbix agent on Linux OS following Zabbix documentation.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | Critical threshold of CPU utilization expressed in %. |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | The CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$VFS.FS.FSNAME.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VFS.FS.FSNAME.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
.+ |
{$VFS.FS.FSTYPE.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.FS.FSTYPE.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | The critical threshold of the filesystem metadata utilization. |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | The warning threshold of the filesystem metadata utilization. |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | The critical threshold of the filesystem utilization. |
90 |
{$VFS.FS.PUSED.MAX.WARN} | The warning threshold of the filesystem utilization. |
80 |
{$MEMORY.UTIL.MAX} | Used as a threshold in the memory utilization trigger. |
90 |
{$MEMORY.AVAILABLE.MIN} | Used as a threshold in the available memory trigger. |
20M |
{$SWAP.PFREE.MIN.WARN} | The warning threshold of the minimum free swap. |
50 |
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger fires. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger fires. |
20 |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.DEV.DEVNAME.MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
.+ |
{$IF.ERRORS.WARN} | Warning threshold of error packet rate. Can be used with interface name as context. |
2 |
{$IFCONTROL} | Link status trigger will be fired only for interfaces where the context macro equals "1". |
1 |
{$NET.IF.IFNAME.MATCHES} | Used for network interface discovery. Can be overridden on the host or linked template level. |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filters out |
Macro too long. Please see the template. |
{$IF.UTIL.MAX} | Used as a threshold in the interface utilization trigger. |
90 |
{$SYSTEM.FUZZYTIME.MAX} | The upper threshold for difference of system time. |
60s |
{$SYSTEM.FUZZYTIME.MIN} | The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping. |
10s |
{$KERNEL.MAXPROC.MIN} | 1024 |
|
{$KERNEL.MAXFILES.MIN} | 256 |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Version of Zabbix agent running | Zabbix agent | agent.version Preprocessing
|
|
Host name of Zabbix agent running | Zabbix agent | agent.hostname Preprocessing
|
|
Zabbix agent ping | The agent always returns "1" for this item. May be used in combination with |
Zabbix agent | agent.ping |
Zabbix agent availability | Used for monitoring the availability status of the agent. |
Zabbix internal | zabbix[host,agent,available] |
Number of CPUs | Zabbix agent | system.cpu.num Preprocessing
|
|
Load average (1m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg1] |
Load average (5m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg5] |
Load average (15m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg15] |
CPU utilization | CPU utilization expressed in %. |
Dependent item | system.cpu.util Preprocessing
|
CPU idle time | Time the CPU has spent doing nothing. |
Zabbix agent | system.cpu.util[,idle] |
CPU system time | Time the CPU has spent running the kernel and its processes. |
Zabbix agent | system.cpu.util[,system] |
CPU user time | Time the CPU has spent running users' processes that are not niced. |
Zabbix agent | system.cpu.util[,user] |
CPU nice time | Time the CPU has spent running users' processes that have been niced. |
Zabbix agent | system.cpu.util[,nice] |
CPU iowait time | Time the CPU has been waiting for I/O to complete. |
Zabbix agent | system.cpu.util[,iowait] |
CPU steal time | The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
Zabbix agent | system.cpu.util[,steal] |
CPU interrupt time | Time the CPU has spent servicing hardware interrupts. |
Zabbix agent | system.cpu.util[,interrupt] |
CPU softirq time | Time the CPU has been servicing software interrupts. |
Zabbix agent | system.cpu.util[,softirq] |
CPU guest time | Time spent on running a virtual CPU for a guest operating system. |
Zabbix agent | system.cpu.util[,guest] |
CPU guest nice time | Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
Zabbix agent | system.cpu.util[,guest_nice] |
Context switches per second | The combined rate at which all processors on the computer are switched from one thread to another. |
Zabbix agent | system.cpu.switches Preprocessing
|
Interrupts per second | Number of interrupts processed. |
Zabbix agent | system.cpu.intr Preprocessing
|
Get filesystems | The |
Zabbix agent | vfs.fs.get |
Memory utilization | The percentage of used memory is calculated as |
Dependent item | vm.memory.utilization Preprocessing
|
Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[pavailable] |
Total memory | Total memory expressed in bytes. |
Zabbix agent | vm.memory.size[total] |
Available memory | The available memory: - in Linux = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[available] |
Total swap space | The total space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,total] |
Free swap space | The free space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,free] |
Free swap space in % | The free space of the swap volume/file expressed in %. |
Zabbix agent | system.swap.size[,pfree] |
System uptime | The system uptime expressed in the following format: "N days, hh:mm:ss". |
Zabbix agent | system.uptime |
System boot time | Zabbix agent | system.boottime Preprocessing
|
|
System local time | The local system time of the host. |
Zabbix agent | system.localtime |
System name | The host name of the system. |
Zabbix agent | system.hostname Preprocessing
|
System description | The information as normally returned by |
Zabbix agent | system.uname Preprocessing
|
Number of logged in users | The number of users who are currently logged in. |
Zabbix agent | system.users.num |
Maximum number of open file descriptors | May be increased by using the |
Zabbix agent | kernel.maxfiles Preprocessing
|
Maximum number of processes | May be increased by using the |
Zabbix agent | kernel.maxproc Preprocessing
|
Number of processes | Zabbix agent | proc.num | |
Number of running processes | Zabbix agent | proc.num[,,run] | |
Checksum of /etc/passwd | Zabbix agent | vfs.file.cksum[/etc/passwd,sha256] Preprocessing
|
|
Operating system | Zabbix agent | system.sw.os Preprocessing
|
|
Operating system architecture | The architecture of the operating system. |
Zabbix agent | system.sw.arch Preprocessing
|
Number of installed packages | Zabbix agent | system.sw.packages.get Preprocessing
|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Zabbix agent is not available | For passive agents only, host availability is used with |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
Average | Manual close: Yes |
Linux: Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
Average | |
Linux: High CPU utilization | CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | Depends on:
|
Linux: High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
Average | Depends on:
|
Linux: Lack of available memory | The system is running out of memory. |
max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
Average | |
Linux: High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
Warning | Depends on:
|
Linux: {HOST.NAME} has been restarted | The host uptime is less than 10 minutes. |
last(/Linux by Zabbix agent/system.uptime)<10m |
Warning | Manual close: Yes |
Linux: System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
Warning | Manual close: Yes |
Linux: System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.hostname) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
Info | Manual close: Yes |
Linux: Configured max number of open filedescriptors is too low | last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
Info | ||
Linux: Configured max number of processes is too low | last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
Info | Depends on:
|
|
Linux: Getting closer to process limit | last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
Warning | ||
Linux: /etc/passwd has been changed | last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
Info | Manual close: Yes Depends on:
|
|
Linux: Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.sw.os) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
Info | Manual close: Yes Depends on:
|
Linux: Number of installed packages has been changed | change(/Linux by Zabbix agent/system.sw.packages.get)<>0 |
Warning | Manual close: Yes |
LLD rule Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
Dependent item | vfs.fs.dependent.discovery Preprocessing
|
Item prototypes for Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FS [{#FSNAME}]: Get data | Intermediate data of |
Dependent item | vfs.fs.dependent[{#FSNAME},data] Preprocessing
|
FS [{#FSNAME}]: Option: Read-only | The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher. |
Dependent item | vfs.fs.dependent[{#FSNAME},readonly] Preprocessing
|
FS [{#FSNAME}]: Space: Used | Used storage expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},used] Preprocessing
|
FS [{#FSNAME}]: Space: Total | Total space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},total] Preprocessing
|
FS [{#FSNAME}]: Space: Used, in % | Calculated as the percentage of currently used space compared to the maximum available space. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},pused] Preprocessing
|
FS [{#FSNAME}]: Space: Available | Available storage space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},free] Preprocessing
|
FS [{#FSNAME}]: Inodes: Free, in % | Free metadata space expressed in %. |
Dependent item | vfs.fs.dependent.inode[{#FSNAME},pfree] Preprocessing
|
Trigger prototypes for Mounted filesystem discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: FS [{#FSNAME}]: Filesystem has become read-only | The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher. |
last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly],#2)=0 and last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly])=1 |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is critically low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} |
Average | Manual close: Yes |
Linux: FS [{#FSNAME}]: Space is low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
Average | |
Linux: FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
Warning | Depends on:
|
LLD rule Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | Zabbix agent | vfs.dev.discovery |
Item prototypes for Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DEVNAME}: Get stats | The contents of get |
Zabbix agent | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing
|
{#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
Dependent item | vfs.dev.read.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
Dependent item | vfs.dev.write.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in |
Dependent item | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in |
Dependent item | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.read.await[{#DEVNAME}] |
{#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.write.await[{#DEVNAME}] |
{#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
Dependent item | vfs.dev.queue_size[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk utilization | The percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
Dependent item | vfs.dev.util[{#DEVNAME}] Preprocessing
|
Trigger prototypes for Block devices discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: {#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
Warning | Manual close: Yes |
LLD rule Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | The discovery of network interfaces. |
Zabbix agent | net.if.discovery |
Item prototypes for Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}: Bits received | Zabbix agent | net.if.in["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Bits sent | Zabbix agent | net.if.out["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets with errors | Zabbix agent | net.if.out["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets with errors | Zabbix agent | net.if.in["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets discarded | Zabbix agent | net.if.out["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets discarded | Zabbix agent | net.if.in["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing
|
Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing
|
Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing
|
Trigger prototypes for Network interface discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Linux: Interface {#IFNAME}: Link down | This trigger expression works as follows: |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) |
Average | Manual close: Yes |
Linux: Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) |
Info | Manual close: Yes Depends on:
|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/6.4
Linux by Zabbix agent
Overview
This is an official Linux template. It requires Zabbix agent 6.4 or newer.
Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
- Utilization formula:
pused = 100 - 100 * (available / total - free + available)
- Utilization formula:
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.
Requirements
Zabbix version: 6.4 and higher.
Tested versions
This template has been tested on:
- Linux OS
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Install Zabbix agent on Linux OS following Zabbix documentation.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | Critical threshold of CPU utilization expressed in %. |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | The CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$VFS.FS.FSNAME.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VFS.FS.FSNAME.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
.+ |
{$VFS.FS.FSTYPE.MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.FS.FSTYPE.NOT_MATCHES} | Used for filesystem discovery. Can be overridden on the host or linked template level. |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | The critical threshold of the filesystem metadata utilization. |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | The warning threshold of the filesystem metadata utilization. |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | The critical threshold of the filesystem utilization. |
90 |
{$VFS.FS.PUSED.MAX.WARN} | The warning threshold of the filesystem utilization. |
80 |
{$MEMORY.UTIL.MAX} | Used as a threshold in the memory utilization trigger. |
90 |
{$MEMORY.AVAILABLE.MIN} | Used as a threshold in the available memory trigger. |
20M |
{$SWAP.PFREE.MIN.WARN} | The warning threshold of the minimum free swap. |
50 |
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger fires. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger fires. |
20 |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
Macro too long. Please see the template. |
{$VFS.DEV.DEVNAME.MATCHES} | Used for block device discovery. Can be overridden on the host or linked template level. |
.+ |
{$IF.ERRORS.WARN} | Warning threshold of error packet rate. Can be used with interface name as context. |
2 |
{$IFCONTROL} | Link status trigger will be fired only for interfaces where the context macro equals "1". |
1 |
{$NET.IF.IFNAME.MATCHES} | Used for network interface discovery. Can be overridden on the host or linked template level. |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filters out |
Macro too long. Please see the template. |
{$IF.UTIL.MAX} | Used as a threshold in the interface utilization trigger. |
90 |
{$SYSTEM.FUZZYTIME.MAX} | The upper threshold for difference of system time. |
60s |
{$SYSTEM.FUZZYTIME.MIN} | The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping. |
10s |
{$KERNEL.MAXPROC.MIN} | 1024 |
|
{$KERNEL.MAXFILES.MIN} | 256 |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Linux: Version of Zabbix agent running | Zabbix agent | agent.version Preprocessing
|
|
Linux: Host name of Zabbix agent running | Zabbix agent | agent.hostname Preprocessing
|
|
Linux: Zabbix agent ping | The agent always returns 1 for this item. It could be used in combination with nodata() for availability check. |
Zabbix agent | agent.ping |
Linux: Zabbix agent availability | Monitoring the availability status of the agent. |
Zabbix internal | zabbix[host,agent,available] |
Linux: Number of CPUs | Zabbix agent | system.cpu.num Preprocessing
|
|
Linux: Load average (1m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg1] |
Linux: Load average (5m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg5] |
Linux: Load average (15m avg) | Calculated as the system CPU load divided by the number of CPU cores. |
Zabbix agent | system.cpu.load[all,avg15] |
Linux: CPU utilization | CPU utilization expressed in %. |
Dependent item | system.cpu.util Preprocessing
|
Linux: CPU idle time | Time the CPU has spent doing nothing. |
Zabbix agent | system.cpu.util[,idle] |
Linux: CPU system time | Time the CPU has spent running the kernel and its processes. |
Zabbix agent | system.cpu.util[,system] |
Linux: CPU user time | Time the CPU has spent running users' processes that are not niced. |
Zabbix agent | system.cpu.util[,user] |
Linux: CPU nice time | Time the CPU has spent running users' processes that have been niced. |
Zabbix agent | system.cpu.util[,nice] |
Linux: CPU iowait time | Time the CPU has been waiting for I/O to complete. |
Zabbix agent | system.cpu.util[,iowait] |
Linux: CPU steal time | The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
Zabbix agent | system.cpu.util[,steal] |
Linux: CPU interrupt time | Time the CPU has spent servicing hardware interrupts. |
Zabbix agent | system.cpu.util[,interrupt] |
Linux: CPU softirq time | Time the CPU has been servicing software interrupts. |
Zabbix agent | system.cpu.util[,softirq] |
Linux: CPU guest time | Time spent on running a virtual CPU for a guest operating system. |
Zabbix agent | system.cpu.util[,guest] |
Linux: CPU guest nice time | Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
Zabbix agent | system.cpu.util[,guest_nice] |
Linux: Context switches per second | The combined rate at which all processors on the computer are switched from one thread to another. |
Zabbix agent | system.cpu.switches Preprocessing
|
Linux: Interrupts per second | Number of interrupts processed. |
Zabbix agent | system.cpu.intr Preprocessing
|
Linux: Get filesystems | The |
Zabbix agent | vfs.fs.get |
Linux: Memory utilization | The percentage of used memory is calculated as |
Dependent item | vm.memory.utilization Preprocessing
|
Linux: Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[pavailable] |
Linux: Total memory | Total memory expressed in bytes. |
Zabbix agent | vm.memory.size[total] |
Linux: Available memory | The available memory: - in Linux = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[available] |
Linux: Total swap space | The total space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,total] |
Linux: Free swap space | The free space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,free] |
Linux: Free swap space in % | The free space of the swap volume/file expressed in %. |
Zabbix agent | system.swap.size[,pfree] |
Linux: System uptime | The system uptime expressed in the following format: "N days, hh:mm:ss". |
Zabbix agent | system.uptime |
Linux: System boot time | Zabbix agent | system.boottime Preprocessing
|
|
Linux: System local time | The local system time of the host. |
Zabbix agent | system.localtime |
Linux: System name | The host name of the system. |
Zabbix agent | system.hostname Preprocessing
|
Linux: System description | The information as normally returned by |
Zabbix agent | system.uname Preprocessing
|
Linux: Number of logged in users | The number of users who are currently logged in. |
Zabbix agent | system.users.num |
Linux: Maximum number of open file descriptors | May be increased by using the |
Zabbix agent | kernel.maxfiles Preprocessing
|
Linux: Maximum number of processes | May be increased by using the |
Zabbix agent | kernel.maxproc Preprocessing
|
Linux: Number of processes | Zabbix agent | proc.num | |
Linux: Number of running processes | Zabbix agent | proc.num[,,run] | |
Linux: Checksum of /etc/passwd | Zabbix agent | vfs.file.cksum[/etc/passwd,sha256] Preprocessing
|
|
Linux: Operating system | Zabbix agent | system.sw.os Preprocessing
|
|
Linux: Operating system architecture | The architecture of the operating system. |
Zabbix agent | system.sw.arch Preprocessing
|
Linux: Number of installed packages | Zabbix agent | system.sw.packages.get Preprocessing
|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Zabbix agent is not available | For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold. |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
Average | Manual close: Yes |
Linux: Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
Average | |
Linux: High CPU utilization | CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | Depends on:
|
Linux: High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
Average | Depends on:
|
Linux: Lack of available memory | The system is running out of memory. |
max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
Average | |
Linux: High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
Warning | Depends on:
|
Linux: {HOST.NAME} has been restarted | The host uptime is less than 10 minutes. |
last(/Linux by Zabbix agent/system.uptime)<10m |
Warning | Manual close: Yes |
Linux: System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
Warning | Manual close: Yes |
Linux: System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.hostname) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
Info | Manual close: Yes |
Linux: Configured max number of open filedescriptors is too low | last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
Info | ||
Linux: Configured max number of processes is too low | last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
Info | Depends on:
|
|
Linux: Getting closer to process limit | last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
Warning | ||
Linux: /etc/passwd has been changed | last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
Info | Manual close: Yes Depends on:
|
|
Linux: Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.sw.os) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
Info | Manual close: Yes Depends on:
|
Linux: Number of installed packages has been changed | change(/Linux by Zabbix agent/system.sw.packages.get)<>0 |
Warning | Manual close: Yes |
LLD rule Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
Dependent item | vfs.fs.dependent.discovery Preprocessing
|
Item prototypes for Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
FS [{#FSNAME}]: Get data | Intermediate data of |
Dependent item | vfs.fs.dependent[{#FSNAME},data] Preprocessing
|
FS [{#FSNAME}]: Option: Read-only | The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher. |
Dependent item | vfs.fs.dependent[{#FSNAME},readonly] Preprocessing
|
FS [{#FSNAME}]: Space: Used | Used storage expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},used] Preprocessing
|
FS [{#FSNAME}]: Space: Total | Total space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},total] Preprocessing
|
FS [{#FSNAME}]: Space: Used, in % | Calculated as the percentage of currently used space compared to the maximum available space. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},pused] Preprocessing
|
FS [{#FSNAME}]: Space: Available | Available storage space expressed in bytes. |
Dependent item | vfs.fs.dependent.size[{#FSNAME},free] Preprocessing
|
FS [{#FSNAME}]: Inodes: Free, in % | Free metadata space expressed in %. |
Dependent item | vfs.fs.dependent.inode[{#FSNAME},pfree] Preprocessing
|
Trigger prototypes for Mounted filesystem discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
FS [{#FSNAME}]: Filesystem has become read-only | The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher. |
last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly],#2)=0 and last(/Linux by Zabbix agent/vfs.fs.dependent[{#FSNAME},readonly])=1 |
Average | Manual close: Yes |
FS [{#FSNAME}]: Space is critically low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} |
Average | Manual close: Yes |
FS [{#FSNAME}]: Space is low | The volume's space usage exceeds the |
min(/Linux by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} |
Warning | Manual close: Yes Depends on:
|
FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
Average | |
FS [{#FSNAME}]: Running out of free inodes | Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space. |
min(/Linux by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
Warning | Depends on:
|
LLD rule Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | Zabbix agent | vfs.dev.discovery Preprocessing
|
Item prototypes for Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DEVNAME}: Get stats | The contents of get |
Zabbix agent | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing
|
{#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
Dependent item | vfs.dev.read.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
Dependent item | vfs.dev.write.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in |
Dependent item | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in |
Dependent item | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.read.await[{#DEVNAME}] |
{#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.write.await[{#DEVNAME}] |
{#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
Dependent item | vfs.dev.queue_size[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk utilization | The percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
Dependent item | vfs.dev.util[{#DEVNAME}] Preprocessing
|
Trigger prototypes for Block devices discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
Warning | Manual close: Yes |
LLD rule Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | The discovery of network interfaces. |
Zabbix agent | net.if.discovery |
Item prototypes for Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}: Bits received | Zabbix agent | net.if.in["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Bits sent | Zabbix agent | net.if.out["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets with errors | Zabbix agent | net.if.out["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets with errors | Zabbix agent | net.if.in["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets discarded | Zabbix agent | net.if.out["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets discarded | Zabbix agent | net.if.in["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing
|
Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing
|
Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing
|
Trigger prototypes for Network interface discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}: Link down | This trigger expression works as follows: |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) |
Average | Manual close: Yes |
Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) |
Info | Manual close: Yes Depends on:
|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/6.2
Linux by Zabbix agent
Overview
For Zabbix version: 6.2 and higher. New official Linux template. Requires agent of Zabbix 3.0.14, 3.4.5 and 4.0.0 or newer.
Setup
Install Zabbix agent on Linux OS according to Zabbix documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | - |
90 |
{$IF.ERRORS.WARN} | - |
2 |
{$IF.UTIL.MAX} | This macro is used as a threshold in the interface utilization trigger. |
90 |
{$IFCONTROL} | - |
1 |
{$KERNEL.MAXFILES.MIN} | - |
256 |
{$KERNEL.MAXPROC.MIN} | - |
1024 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$MEMORY.AVAILABLE.MIN} | This macro is used as a threshold in the memory available trigger. |
20M |
{$MEMORY.UTIL.MAX} | This macro is used as a threshold in the memory utilization trigger. |
90 |
{$NET.IF.IFNAME.MATCHES} | - |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | It filters out loopbacks, nulls, docker veth links and docker0 bridge by default. |
`(^Software Loopback Interface |
{$SWAP.PFREE.MIN.WARN} | - |
50 |
{$SYSTEM.FUZZYTIME.MAX} | - |
60 |
{$VFS.DEV.DEVNAME.MATCHES} | This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level. |
.+ |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level. |
`^(loop[0-9]* |
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger would fire. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger would fire. |
20 |
{$VFS.FS.FREE.MIN.CRIT} | The critical threshold for utilization of the filesystem. |
5G |
{$VFS.FS.FREE.MIN.WARN} | The warning threshold for utilization of the filesystem. |
10G |
{$VFS.FS.FSNAME.MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
.+ |
{$VFS.FS.FSNAME.NOT_MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
`^(/dev |
{$VFS.FS.FSTYPE.MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
`^(btrfs |
{$VFS.FS.FSTYPE.NOT_MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | - |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | - |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | - |
90 |
{$VFS.FS.PUSED.MAX.WARN} | - |
80 |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | - |
ZABBIX_PASSIVE | vfs.dev.discovery Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: Filter: AND- {#DEVTYPE} MATCHES_REGEX - {#DEVNAME} MATCHES_REGEX - {#DEVNAME} NOT_MATCHES_REGEX |
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
ZABBIX_PASSIVE | vfs.fs.discovery Filter: AND- {#FSTYPE} MATCHES_REGEX - {#FSTYPE} NOT_MATCHES_REGEX - {#FSNAME} MATCHES_REGEX - {#FSNAME} NOT_MATCHES_REGEX Overrides: Skip metadata collection for dynamic FS |
Network interface discovery | The discovery of network interfaces. |
ZABBIX_PASSIVE | net.if.discovery Filter: AND- {#IFNAME} MATCHES_REGEX - {#IFNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
CPU | Number of CPUs | - |
ZABBIX_PASSIVE | system.cpu.num Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
CPU | Load average (1m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg1] |
CPU | Load average (5m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg5] |
CPU | Load average (15m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg15] |
CPU | CPU utilization | The CPU utilization expressed in %. |
DEPENDENT | system.cpu.util Preprocessing: - JAVASCRIPT: |
CPU | CPU idle time | The time the CPU has spent doing nothing. |
ZABBIX_PASSIVE | system.cpu.util[,idle] |
CPU | CPU system time | The time the CPU has spent running the kernel and its processes. |
ZABBIX_PASSIVE | system.cpu.util[,system] |
CPU | CPU user time | The time the CPU has spent running users' processes that are not niced. |
ZABBIX_PASSIVE | system.cpu.util[,user] |
CPU | CPU nice time | The time the CPU has spent running users' processes that have been niced. |
ZABBIX_PASSIVE | system.cpu.util[,nice] |
CPU | CPU iowait time | The amount of time the CPU has been waiting for I/O to complete. |
ZABBIX_PASSIVE | system.cpu.util[,iowait] |
CPU | CPU steal time | The amount of 'stolen' CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
ZABBIX_PASSIVE | system.cpu.util[,steal] |
CPU | CPU interrupt time | The amount of time the CPU has been servicing hardware interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,interrupt] |
CPU | CPU softirq time | The amount of time the CPU has been servicing software interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,softirq] |
CPU | CPU guest time | Guest time - the time spent on running a virtual CPU for a guest operating system. |
ZABBIX_PASSIVE | system.cpu.util[,guest] |
CPU | CPU guest nice time | The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
ZABBIX_PASSIVE | system.cpu.util[,guest_nice] |
CPU | Context switches per second | - |
ZABBIX_PASSIVE | system.cpu.switches Preprocessing: - CHANGE_PER_SECOND |
CPU | Interrupts per second | - |
ZABBIX_PASSIVE | system.cpu.intr Preprocessing: - CHANGE_PER_SECOND |
Filesystems | {#FSNAME}: Used space | Used storage expressed in Bytes |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},used] |
Filesystems | {#FSNAME}: Total space | The total space expressed in Bytes. |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},total] |
Filesystems | {#FSNAME}: Space utilization | The space utilization expressed in % for {#FSNAME}. |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},pused] |
Filesystems | {#FSNAME}: Free inodes in % | - |
ZABBIX_PASSIVE | vfs.fs.inode[{#FSNAME},pfree] |
General | System boot time | - |
ZABBIX_PASSIVE | system.boottime Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System local time | The local system time of the host. |
ZABBIX_PASSIVE | system.localtime |
General | System name | The host name of the system. |
ZABBIX_PASSIVE | system.hostname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System description | The information as normally returned by 'uname -a'. |
ZABBIX_PASSIVE | system.uname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of logged in users | The number of users who are currently logged in. |
ZABBIX_PASSIVE | system.users.num |
General | Maximum number of open file descriptors | It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxfiles Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Maximum number of processes | It could be increased by using sysctl utility or modifying the file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxproc Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of processes | - |
ZABBIX_PASSIVE | proc.num |
General | Number of running processes | - |
ZABBIX_PASSIVE | proc.num[,,run] |
Inventory | Operating system | - |
ZABBIX_PASSIVE | system.sw.os Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Operating system architecture | The architecture of the host's operating system. |
ZABBIX_PASSIVE | system.sw.arch Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Software installed | - |
ZABBIX_PASSIVE | system.sw.packages Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Memory | Memory utilization | The percentage of used memory is calculated as 100-pavailable. |
DEPENDENT | vm.memory.utilization Preprocessing: - JAVASCRIPT: |
Memory | Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[pavailable] |
Memory | Total memory | The total memory expressed in Bytes. |
ZABBIX_PASSIVE | vm.memory.size[total] |
Memory | Available memory | The available memory: - in Linux - available = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[available] |
Memory | Total swap space | The total space of the swap volume/file expressed in bytes. |
ZABBIX_PASSIVE | system.swap.size[,total] |
Memory | Free swap space | The free space of the swap volume/file expressed in bytes. |
ZABBIX_PASSIVE | system.swap.size[,free] |
Memory | Free swap space in % | The free space of the swap volume/file expressed in %. |
ZABBIX_PASSIVE | system.swap.size[,pfree] |
Monitoring agent | Version of Zabbix agent running | - |
ZABBIX_PASSIVE | agent.version Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Monitoring agent | Host name of Zabbix agent running | - |
ZABBIX_PASSIVE | agent.hostname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Monitoring agent | Zabbix agent ping | The agent always returns 1 for this item. It could be used in combination with nodata() for availability check. |
ZABBIX_PASSIVE | agent.ping |
Network interfaces | Interface {#IFNAME}: Bits received | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
Network interfaces | Interface {#IFNAME}: Bits sent | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
Network interfaces | Interface {#IFNAME}: Outbound packets with errors | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
Network interfaces | Interface {#IFNAME}: Inbound packets with errors | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
Network interfaces | Interface {#IFNAME}: Outbound packets discarded | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
Network interfaces | Interface {#IFNAME}: Inbound packets discarded | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
Network interfaces | Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing: - JAVASCRIPT: |
Network interfaces | Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See include/uapi/linux/if_arp.h for all possible values. Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Network interfaces | Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool get_link_ksettings method (mostly Ethernet). Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing: - MULTIPLIER: - DISCARD_UNCHANGED_HEARTBEAT: |
Security | Checksum of /etc/passwd | - |
ZABBIX_PASSIVE | vfs.file.cksum[/etc/passwd,sha256] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Status | System uptime | The system uptime expressed in the following format:'N days, hh:mm:ss'. |
ZABBIX_PASSIVE | system.uptime |
Status | Zabbix agent availability | Monitoring the availability status of the agent. |
INTERNAL | zabbix[host,agent,available] |
Storage | {#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
DEPENDENT | vfs.dev.read.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
DEPENDENT | vfs.dev.write.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
CALCULATED | vfs.dev.read.await[{#DEVNAME}] Expression: (last(//vfs.dev.read.time.rate[{#DEVNAME}])/(last(//vfs.dev.read.rate[{#DEVNAME}])+(last(//vfs.dev.read.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.read.rate[{#DEVNAME}]) > 0) |
Storage | {#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
CALCULATED | vfs.dev.write.await[{#DEVNAME}] Expression: (last(//vfs.dev.write.time.rate[{#DEVNAME}])/(last(//vfs.dev.write.rate[{#DEVNAME}])+(last(//vfs.dev.write.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.write.rate[{#DEVNAME}]) > 0) |
Storage | {#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
DEPENDENT | vfs.dev.queue_size[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Storage | {#DEVNAME}: Disk utilization | This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
DEPENDENT | vfs.dev.util[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix raw items | {#DEVNAME}: Get stats | The contents of get /sys/block/{#DEVNAME}/stat to get the disk statistics. |
ZABBIX_PASSIVE | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing: - JAVASCRIPT: |
Zabbix raw items | {#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in r_await calculation. |
DEPENDENT | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix raw items | {#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in w_await calculation. |
DEPENDENT | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
AVERAGE | |
High CPU utilization | The CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
WARNING | Depends on: - Load average is too high |
{#FSNAME}: Disk space is critically low | Two conditions should match: 1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. 2. The second condition should be one of the following: - the disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}; - the disk will be full in less than 24 hours. |
last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) |
AVERAGE | Manual close: YES |
{#FSNAME}: Disk space is low | Two conditions should match: 1. The first condition - utilization of space should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. 2. The second condition should be one of the following: - the disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}; - the disk will be full in less than 24 hours. |
last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and ((last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or timeleft(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) |
WARNING | Manual close: YES Depends on: - {#FSNAME}: Disk space is critically low |
{#FSNAME}: Running out of free inodes | It may become impossible to write to a disk if there are no index nodes left. Following error messages may be returned as symptoms, even though the free space is available: - 'No space left on device'; - 'Disk is full'. |
min(/Linux by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
AVERAGE | |
{#FSNAME}: Running out of free inodes | It may become impossible to write to a disk if there are no index nodes left. Following error messages may be returned as symptoms, even though the free space is available: - 'No space left on device'; - 'Disk is full'. |
min(/Linux by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
WARNING | Depends on: - {#FSNAME}: Running out of free inodes |
System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
WARNING | Manual close: YES |
System name has changed | The name of the system has changed. Ack to close the problem manually. |
last(/Linux by Zabbix agent/system.hostname,#1)<>last(/Linux by Zabbix agent/system.hostname,#2) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
INFO | Manual close: YES |
Configured max number of open filedescriptors is too low | - |
last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
INFO | |
Configured max number of processes is too low | - |
last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
INFO | Depends on: - Getting closer to process limit |
Getting closer to process limit | - |
last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
WARNING | |
Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Ack to close the problem manually. |
last(/Linux by Zabbix agent/system.sw.os,#1)<>last(/Linux by Zabbix agent/system.sw.os,#2) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
INFO | Manual close: YES Depends on: - System name has changed |
High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
AVERAGE | Depends on: - Lack of available memory |
Lack of available memory | - |
max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
AVERAGE | |
High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
WARNING | Depends on: - High memory utilization - Lack of available memory |
Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 Recovery expression: avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) and avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the {$IF.ERRORS.WARN:"{#IFNAME}"} threshold |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} Recovery expression: max(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 and max(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: Link down | This trigger expression works as follows: 1. It can be triggered if the operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - the trigger fires only if the operational status was up to (1) sometime before (so, do not fire for the 'ethernal off' interfaces.) WARNING: if closed manually - it will not fire again on the next poll, because of .diff. |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) Recovery expression: last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2 or {$IFCONTROL:"{#IFNAME}"}=0 |
AVERAGE | Manual close: YES |
Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge (Ack) to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) Recovery expression: (change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"],#2)>0) or (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2) |
INFO | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
/etc/passwd has been changed | - |
last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
INFO | Manual close: YES Depends on: - Operating system description has changed - System name has changed |
has been restarted | The host uptime is less than 10 minutes |
last(/Linux by Zabbix agent/system.uptime)<10m |
WARNING | Manual close: YES |
Zabbix agent is not available | For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold. |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
AVERAGE | Manual close: YES |
{#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk {#DEVNAME} saturation. |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
WARNING | Manual close: YES |
Feedback
Please report any issues with the template at https://support.zabbix.com.
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums.
Known Issues
- Description: Network discovery. Zabbix agent as of 4.2 doesn't support items such as net.if.status, net.if.speed.
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/6.0
Linux by Zabbix agent
Overview
New official Linux template. Requires agent of Zabbix 6.0 or newer.
Requirements
Zabbix version: 6.0 and higher.
Tested versions
This template has been tested on:
- Linux OS
Configuration
Zabbix should be configured according to the instructions in the Templates out of the box section.
Setup
Install Zabbix agent on Linux OS following Zabbix documentation.
Macros used
Name | Description | Default |
---|---|---|
{$AGENT.TIMEOUT} | Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode). |
3m |
{$CPU.UTIL.CRIT} | 90 |
|
{$LOAD_AVG_PER_CPU.MAX.WARN} | The CPU load per core is considered sustainable. If necessary, it can be tuned. |
1.5 |
{$VFS.FS.FSNAME.NOT_MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
^(/dev|/sys|/run|/proc|.+/shm$) |
{$VFS.FS.FSNAME.MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
.+ |
{$VFS.FS.FSTYPE.MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
Macro too long. Please see the template. |
{$VFS.FS.FSTYPE.NOT_MATCHES} | This macro is used for discovery of the filesystems. It can be overridden on host level or its linked template level. |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | The critical threshold of the filesystem metadata utilization. |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | The warning threshold of the filesystem metadata utilization. |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | The critical threshold of the filesystem utilization. |
90 |
{$VFS.FS.PUSED.MAX.WARN} | The warning threshold of the filesystem utilization. |
80 |
{$MEMORY.UTIL.MAX} | This macro is used as a threshold in the memory utilization trigger. |
90 |
{$MEMORY.AVAILABLE.MIN} | This macro is used as a threshold in the memory available trigger. |
20M |
{$SWAP.PFREE.MIN.WARN} | 50 |
|
{$VFS.DEV.READ.AWAIT.WARN} | The average response time (in ms) of disk read before the trigger would fire. |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | The average response time (in ms) of disk write before the trigger would fire. |
20 |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level. |
Macro too long. Please see the template. |
{$VFS.DEV.DEVNAME.MATCHES} | This macro is used for a discovery of block devices. It can be overridden on host level or its linked template level. |
.+ |
{$IF.ERRORS.WARN} | 2 |
|
{$IFCONTROL} | 1 |
|
{$NET.IF.IFNAME.MATCHES} | ^.*$ |
|
{$NET.IF.IFNAME.NOT_MATCHES} | It filters out |
Macro too long. Please see the template. |
{$IF.UTIL.MAX} | This macro is used as a threshold in the interface utilization trigger. |
90 |
{$SYSTEM.FUZZYTIME.MAX} | The upper threshold for difference of system time. |
60s |
{$SYSTEM.FUZZYTIME.MIN} | The lower threshold for difference of system time. Used in recovery expression to avoid trigger flapping. |
10s |
{$KERNEL.MAXPROC.MIN} | 1024 |
|
{$KERNEL.MAXFILES.MIN} | 256 |
Items
Name | Description | Type | Key and additional info |
---|---|---|---|
Linux: Version of Zabbix agent running | Zabbix agent | agent.version Preprocessing
|
|
Linux: Host name of Zabbix agent running | Zabbix agent | agent.hostname Preprocessing
|
|
Linux: Zabbix agent ping | The agent always returns 1 for this item. It could be used in combination with nodata() for availability check. |
Zabbix agent | agent.ping |
Linux: Zabbix agent availability | Monitoring the availability status of the agent. |
Zabbix internal | zabbix[host,agent,available] |
Linux: Number of CPUs | Zabbix agent | system.cpu.num Preprocessing
|
|
Linux: Load average (1m avg) | Zabbix agent | system.cpu.load[all,avg1] | |
Linux: Load average (5m avg) | Zabbix agent | system.cpu.load[all,avg5] | |
Linux: Load average (15m avg) | Zabbix agent | system.cpu.load[all,avg15] | |
Linux: CPU utilization | The CPU utilization expressed in %. |
Dependent item | system.cpu.util Preprocessing
|
Linux: CPU idle time | The time the CPU has spent doing nothing. |
Zabbix agent | system.cpu.util[,idle] |
Linux: CPU system time | The time the CPU has spent running the kernel and its processes. |
Zabbix agent | system.cpu.util[,system] |
Linux: CPU user time | The time the CPU has spent running users' processes that are not niced. |
Zabbix agent | system.cpu.util[,user] |
Linux: CPU nice time | The time the CPU has spent running users' processes that have been niced. |
Zabbix agent | system.cpu.util[,nice] |
Linux: CPU iowait time | The amount of time the CPU has been waiting for I/O to complete. |
Zabbix agent | system.cpu.util[,iowait] |
Linux: CPU steal time | The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine. |
Zabbix agent | system.cpu.util[,steal] |
Linux: CPU interrupt time | The amount of time the CPU has been servicing hardware interrupts. |
Zabbix agent | system.cpu.util[,interrupt] |
Linux: CPU softirq time | The amount of time the CPU has been servicing software interrupts. |
Zabbix agent | system.cpu.util[,softirq] |
Linux: CPU guest time | Guest time - the time spent on running a virtual CPU for a guest operating system. |
Zabbix agent | system.cpu.util[,guest] |
Linux: CPU guest nice time | The time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel). |
Zabbix agent | system.cpu.util[,guest_nice] |
Linux: Context switches per second | Zabbix agent | system.cpu.switches Preprocessing
|
|
Linux: Interrupts per second | Zabbix agent | system.cpu.intr Preprocessing
|
|
Linux: Memory utilization | The percentage of used memory is calculated as |
Dependent item | vm.memory.utilization Preprocessing
|
Linux: Available memory in % | The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[pavailable] |
Linux: Total memory | The total memory expressed in bytes. |
Zabbix agent | vm.memory.size[total] |
Linux: Available memory | The available memory: - in Linux - available = free + buffers + cache; - on other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the |
Zabbix agent | vm.memory.size[available] |
Linux: Total swap space | The total space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,total] |
Linux: Free swap space | The free space of the swap volume/file expressed in bytes. |
Zabbix agent | system.swap.size[,free] |
Linux: Free swap space in % | The free space of the swap volume/file expressed in %. |
Zabbix agent | system.swap.size[,pfree] |
Linux: System uptime | The system uptime expressed in the following format: "N days, hh:mm:ss". |
Zabbix agent | system.uptime |
Linux: System boot time | Zabbix agent | system.boottime Preprocessing
|
|
Linux: System local time | The local system time of the host. |
Zabbix agent | system.localtime |
Linux: System name | The host name of the system. |
Zabbix agent | system.hostname Preprocessing
|
Linux: System description | The information as normally returned by |
Zabbix agent | system.uname Preprocessing
|
Linux: Number of logged in users | The number of users who are currently logged in. |
Zabbix agent | system.users.num |
Linux: Maximum number of open file descriptors | It could be increased by using |
Zabbix agent | kernel.maxfiles Preprocessing
|
Linux: Maximum number of processes | It could be increased by using |
Zabbix agent | kernel.maxproc Preprocessing
|
Linux: Number of processes | Zabbix agent | proc.num | |
Linux: Number of running processes | Zabbix agent | proc.num[,,run] | |
Linux: Checksum of /etc/passwd | Zabbix agent | vfs.file.cksum[/etc/passwd,sha256] Preprocessing
|
|
Linux: Operating system | Zabbix agent | system.sw.os Preprocessing
|
|
Linux: Operating system architecture | The architecture of the operating system. |
Zabbix agent | system.sw.arch Preprocessing
|
Linux: Software installed | Zabbix agent | system.sw.packages Preprocessing
|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Linux: Zabbix agent is not available | For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold. |
max(/Linux by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0 |
Average | Manual close: Yes |
Linux: Load average is too high | The load average per CPU is too high. The system may be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent/system.cpu.load[all,avg15])>0 |
Average | |
Linux: High CPU utilization | The CPU utilization is too high. The system might be slow to respond. |
min(/Linux by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
Warning | Depends on:
|
Linux: High memory utilization | The system is running out of free memory. |
min(/Linux by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
Average | Depends on:
|
Linux: Lack of available memory | max(/Linux by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent/vm.memory.size[total])>0 |
Average | ||
Linux: High swap space usage | If there is no swap configured, this trigger is ignored. |
max(/Linux by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent/system.swap.size[,total])>0 |
Warning | Depends on:
|
Linux: {HOST.NAME} has been restarted | The host uptime is less than 10 minutes. |
last(/Linux by Zabbix agent/system.uptime)<10m |
Warning | Manual close: Yes |
Linux: System time is out of sync | The host's system time is different from Zabbix server time. |
fuzzytime(/Linux by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
Warning | Manual close: Yes |
Linux: System name has changed | The name of the system has changed. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.hostname) and length(last(/Linux by Zabbix agent/system.hostname))>0 |
Info | Manual close: Yes |
Linux: Configured max number of open filedescriptors is too low | last(/Linux by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
Info | ||
Linux: Configured max number of processes is too low | last(/Linux by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
Info | Depends on:
|
|
Linux: Getting closer to process limit | last(/Linux by Zabbix agent/proc.num)/last(/Linux by Zabbix agent/kernel.maxproc)*100>80 |
Warning | ||
Linux: /etc/passwd has been changed | last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2) |
Info | Manual close: Yes Depends on:
|
|
Linux: Operating system description has changed | The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/system.sw.os) and length(last(/Linux by Zabbix agent/system.sw.os))>0 |
Info | Manual close: Yes Depends on:
|
LLD rule Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | The discovery of mounted filesystems with different types. |
Zabbix agent | vfs.fs.discovery |
Item prototypes for Mounted filesystem discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#FSNAME}: Used space | Used storage in bytes |
Zabbix agent | vfs.fs.size[{#FSNAME},used] |
{#FSNAME}: Total space | Total space in bytes |
Zabbix agent | vfs.fs.size[{#FSNAME},total] |
{#FSNAME}: Space utilization | The space utilization expressed in % for {#FSNAME}. |
Zabbix agent | vfs.fs.size[{#FSNAME},pused] |
{#FSNAME}: Free inodes in % | Zabbix agent | vfs.fs.inode[{#FSNAME},pfree] |
Trigger prototypes for Mounted filesystem discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#FSNAME}: Disk space is critically low | The volume's space usage exceeds the |
last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} |
Average | Manual close: Yes |
{#FSNAME}: Disk space is low | The volume's space usage exceeds the |
last(/Linux by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} |
Warning | Manual close: Yes Depends on:
|
{#FSNAME}: Running out of free inodes | It may become impossible to write to a disk if there are no index nodes left. |
min(/Linux by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
Average | |
{#FSNAME}: Running out of free inodes | It may become impossible to write to a disk if there are no index nodes left. |
min(/Linux by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
Warning | Depends on:
|
LLD rule Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | Zabbix agent | vfs.dev.discovery |
Item prototypes for Block devices discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
{#DEVNAME}: Get stats | The contents of get |
Zabbix agent | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing
|
{#DEVNAME}: Disk read rate | r/s (read operations per second) - the number (after merges) of read requests completed per second for the device. |
Dependent item | vfs.dev.read.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write rate | w/s (write operations per second) - the number (after merges) of write requests completed per second for the device. |
Dependent item | vfs.dev.write.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read time (rate) | The rate of total read time counter; used in |
Dependent item | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk write time (rate) | The rate of total write time counter; used in |
Dependent item | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.read.await[{#DEVNAME}] |
{#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero. |
Calculated | vfs.dev.write.await[{#DEVNAME}] |
{#DEVNAME}: Disk average queue size (avgqu-sz) | The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected. |
Dependent item | vfs.dev.queue_size[{#DEVNAME}] Preprocessing
|
{#DEVNAME}: Disk utilization | This item is the percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests. |
Dependent item | vfs.dev.util[{#DEVNAME}] Preprocessing
|
Trigger prototypes for Block devices discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#DEVNAME}: Disk read/write request responses are too high | This trigger might indicate the disk |
min(/Linux by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
Warning | Manual close: Yes |
LLD rule Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | The discovery of network interfaces. |
Zabbix agent | net.if.discovery |
Item prototypes for Network interface discovery
Name | Description | Type | Key and additional info |
---|---|---|---|
Interface {#IFNAME}: Bits received | Zabbix agent | net.if.in["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Bits sent | Zabbix agent | net.if.out["{#IFNAME}"] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets with errors | Zabbix agent | net.if.out["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets with errors | Zabbix agent | net.if.in["{#IFNAME}",errors] Preprocessing
|
|
Interface {#IFNAME}: Outbound packets discarded | Zabbix agent | net.if.out["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Inbound packets discarded | Zabbix agent | net.if.in["{#IFNAME}",dropped] Preprocessing
|
|
Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing
|
Interface {#IFNAME}: Interface type | It indicates the interface protocol type as a decimal value. See Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing
|
Interface {#IFNAME}: Speed | It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec. This attribute is only valid for the interfaces that implement the ethtool Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
Zabbix agent | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing
|
Trigger prototypes for Network interface discovery
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Interface {#IFNAME}: High bandwidth usage | The utilization of the network interface is close to its estimated maximum bandwidth. |
(avg(/Linux by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}: High error rate | It recovers when it is below 80% of the |
min(/Linux by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} |
Warning | Manual close: Yes Depends on:
|
Interface {#IFNAME}: Link down | This trigger expression works as follows: |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) |
Average | Manual close: Yes |
Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually. |
change(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) |
Info | Manual close: Yes Depends on:
|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/5.4
Linux CPU by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$CPU.UTIL.CRIT} | - |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | Load per CPU considered sustainable. Tune if needed. |
1.5 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
CPU | Number of CPUs | - |
ZABBIX_PASSIVE | system.cpu.num Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
CPU | Load average (1m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg1] |
CPU | Load average (5m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg5] |
CPU | Load average (15m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg15] |
CPU | CPU utilization | CPU utilization in % |
DEPENDENT | system.cpu.util Preprocessing: - JAVASCRIPT: |
CPU | CPU idle time | The time the CPU has spent doing nothing. |
ZABBIX_PASSIVE | system.cpu.util[,idle] |
CPU | CPU system time | The time the CPU has spent running the kernel and its processes. |
ZABBIX_PASSIVE | system.cpu.util[,system] |
CPU | CPU user time | The time the CPU has spent running users' processes that are not niced. |
ZABBIX_PASSIVE | system.cpu.util[,user] |
CPU | CPU nice time | The time the CPU has spent running users' processes that have been niced. |
ZABBIX_PASSIVE | system.cpu.util[,nice] |
CPU | CPU iowait time | Amount of time the CPU has been waiting for I/O to complete. |
ZABBIX_PASSIVE | system.cpu.util[,iowait] |
CPU | CPU steal time | The amount of CPU 'stolen' from this virtual machine by the hypervisor for other tasks (such as running another virtual machine). |
ZABBIX_PASSIVE | system.cpu.util[,steal] |
CPU | CPU interrupt time | The amount of time the CPU has been servicing hardware interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,interrupt] |
CPU | CPU softirq time | The amount of time the CPU has been servicing software interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,softirq] |
CPU | CPU guest time | Guest time (time spent running a virtual CPU for a guest operating system) |
ZABBIX_PASSIVE | system.cpu.util[,guest] |
CPU | CPU guest nice time | Time spent running a niced guest (virtual CPU for guest operating systems under the control of the Linux kernel) |
ZABBIX_PASSIVE | system.cpu.util[,guest_nice] |
CPU | Context switches per second | - |
ZABBIX_PASSIVE | system.cpu.switches Preprocessing: - CHANGE_PER_SECOND |
CPU | Interrupts per second | - |
ZABBIX_PASSIVE | system.cpu.intr Preprocessing: - CHANGE_PER_SECOND |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Load average is too high (per CPU load over {$LOAD_AVG_PER_CPU.MAX.WARN} for 5m) | Per CPU load average is too high. Your system may be slow to respond. |
min(/Linux CPU by Zabbix agent/system.cpu.load[all,avg1],5m)/last(/Linux CPU by Zabbix agent/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux CPU by Zabbix agent/system.cpu.load[all,avg5])>0 and last(/Linux CPU by Zabbix agent/system.cpu.load[all,avg15])>0 |
AVERAGE | |
High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m) | CPU utilization is too high. The system might be slow to respond. |
min(/Linux CPU by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT} |
WARNING | Depends on: - Load average is too high (per CPU load over {$LOAD_AVG_PER_CPU.MAX.WARN} for 5m) |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux filesystems by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$VFS.FS.FSNAME.MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
.+ |
{$VFS.FS.FSNAME.NOT_MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
`^(/dev |
{$VFS.FS.FSTYPE.MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
`^(btrfs |
{$VFS.FS.FSTYPE.NOT_MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | - |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | - |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | - |
90 |
{$VFS.FS.PUSED.MAX.WARN} | - |
80 |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | Discovery of file systems of different types. |
ZABBIX_PASSIVE | vfs.fs.discovery Filter: AND- {#FSTYPE} MATCHES_REGEX - {#FSTYPE} NOT_MATCHES_REGEX - {#FSNAME} MATCHES_REGEX - {#FSNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Filesystems | {#FSNAME}: Used space | Used storage in Bytes |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},used] |
Filesystems | {#FSNAME}: Total space | Total space in Bytes |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},total] |
Filesystems | {#FSNAME}: Space utilization | Space utilization in % for {#FSNAME} |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},pused] |
Filesystems | {#FSNAME}: Free inodes in % | - |
ZABBIX_PASSIVE | vfs.fs.inode[{#FSNAME},pfree] |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%) | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than 5G. - The disk will be full in less than 24 hours. |
last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<5G or timeleft(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) |
AVERAGE | Manual close: YES |
{#FSNAME}: Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%) | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than 10G. - The disk will be full in less than 24 hours. |
last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and ((last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<10G or timeleft(/Linux filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) |
WARNING | Manual close: YES Depends on: - {#FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%) |
{#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}%) | It may become impossible to write to disk if there are no index nodes left. As symptoms, 'No space left on device' or 'Disk is full' errors may be seen even though free space is available. |
min(/Linux filesystems by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
AVERAGE | |
{#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"}%) | It may become impossible to write to disk if there are no index nodes left. As symptoms, 'No space left on device' or 'Disk is full' errors may be seen even though free space is available. |
min(/Linux filesystems by Zabbix agent/vfs.fs.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
WARNING | Depends on: - {#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}%) |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux memory by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$MEMORY.AVAILABLE.MIN} | This macro is used as a threshold in memory available trigger. |
20M |
{$MEMORY.UTIL.MAX} | This macro is used as a threshold in memory utilization trigger. |
90 |
{$SWAP.PFREE.MIN.WARN} | - |
50 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Memory | Memory utilization | Memory used percentage is calculated as (100-pavailable) |
DEPENDENT | vm.memory.utilization Preprocessing: - JAVASCRIPT: |
Memory | Available memory in % | Available memory as percentage of total. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[pavailable] |
Memory | Total memory | Total memory in Bytes |
ZABBIX_PASSIVE | vm.memory.size[total] |
Memory | Available memory | Available memory, in Linux, available = free + buffers + cache. On other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[available] |
Memory | Total swap space | The total space of swap volume/file in bytes. |
ZABBIX_PASSIVE | system.swap.size[,total] |
Memory | Free swap space | The free space of swap volume/file in bytes. |
ZABBIX_PASSIVE | system.swap.size[,free] |
Memory | Free swap space in % | The free space of swap volume/file in percent. |
ZABBIX_PASSIVE | system.swap.size[,pfree] |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m) | The system is running out of free memory. |
min(/Linux memory by Zabbix agent/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX} |
AVERAGE | Depends on: - Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) |
Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) | - |
min(/Linux memory by Zabbix agent/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux memory by Zabbix agent/vm.memory.size[total])>0 |
AVERAGE | |
High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free) | This trigger is ignored, if there is no swap configured |
min(/Linux memory by Zabbix agent/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux memory by Zabbix agent/system.swap.size[,total])>0 |
WARNING | Depends on: - High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m) - Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux block devices by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$VFS.DEV.DEVNAME.MATCHES} | This macro is used in block devices discovery. Can be overridden on the host or linked template level |
.+ |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | This macro is used in block devices discovery. Can be overridden on the host or linked template level |
`^(loop[0-9]* |
{$VFS.DEV.READ.AWAIT.WARN} | Disk read average response time (in ms) before the trigger would fire |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | Disk write average response time (in ms) before the trigger would fire |
20 |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | - |
ZABBIX_PASSIVE | vfs.dev.discovery Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: Filter: AND- {#DEVTYPE} MATCHES_REGEX - {#DEVNAME} MATCHES_REGEX - {#DEVNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Storage | {#DEVNAME}: Disk read rate | r/s. The number (after merges) of read requests completed per second for the device. |
DEPENDENT | vfs.dev.read.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk write rate | w/s. The number (after merges) of write requests completed per second for the device. |
DEPENDENT | vfs.dev.write.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception. |
CALCULATED | vfs.dev.read.await[{#DEVNAME}] Expression: (last(//vfs.dev.read.time.rate[{#DEVNAME}])/(last(//vfs.dev.read.rate[{#DEVNAME}])+(last(//vfs.dev.read.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.read.rate[{#DEVNAME}]) > 0) |
Storage | {#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception. |
CALCULATED | vfs.dev.write.await[{#DEVNAME}] Expression: (last(//vfs.dev.write.time.rate[{#DEVNAME}])/(last(//vfs.dev.write.rate[{#DEVNAME}])+(last(//vfs.dev.write.rate[{#DEVNAME}])=0)))*1000*(last(//vfs.dev.write.rate[{#DEVNAME}]) > 0) |
Storage | {#DEVNAME}: Disk average queue size (avgqu-sz) | Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected. |
DEPENDENT | vfs.dev.queue_size[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Storage | {#DEVNAME}: Disk utilization | This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests. |
DEPENDENT | vfs.dev.util[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix_raw_items | {#DEVNAME}: Get stats | Get contents of /sys/block/{#DEVNAME}/stat for disk stats. |
ZABBIX_PASSIVE | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing: - JAVASCRIPT: |
Zabbix_raw_items | {#DEVNAME}: Disk read time (rate) | Rate of total read time counter. Used in r_await calculation |
DEPENDENT | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix_raw_items | {#DEVNAME}: Disk write time (rate) | Rate of total write time counter. Used in w_await calculation |
DEPENDENT | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#DEVNAME}: Disk read/write request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} ms for 15m or write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} ms for 15m) | This trigger might indicate disk {#DEVNAME} saturation. |
min(/Linux block devices by Zabbix agent/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux block devices by Zabbix agent/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
WARNING | Manual close: YES |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux network interfaces by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$IF.ERRORS.WARN} | - |
2 |
{$IF.UTIL.MAX} | This macro is used as a threshold in interface utilization trigger. |
90 |
{$IFCONTROL} | - |
1 |
{$NET.IF.IFNAME.MATCHES} | - |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filter out loopbacks, nulls, docker veth links and docker0 bridge by default |
`(^Software Loopback Interface |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | Discovery of network interfaces. |
ZABBIX_PASSIVE | net.if.discovery Filter: AND- {#IFNAME} MATCHES_REGEX - {#IFNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Network_interfaces | Interface {#IFNAME}: Bits received | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
Network_interfaces | Interface {#IFNAME}: Bits sent | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
Network_interfaces | Interface {#IFNAME}: Outbound packets with errors | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
Network_interfaces | Interface {#IFNAME}: Inbound packets with errors | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
Network_interfaces | Interface {#IFNAME}: Outbound packets discarded | - |
ZABBIX_PASSIVE | net.if.out["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
Network_interfaces | Interface {#IFNAME}: Inbound packets discarded | - |
ZABBIX_PASSIVE | net.if.in["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
Network_interfaces | Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing: - JAVASCRIPT: |
Network_interfaces | Interface {#IFNAME}: Interface type | Indicates the interface protocol type as a decimal value. See include/uapi/linux/if_arp.h for all possible values. Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Network interfaces | Interface {#IFNAME}: Speed | Indicates the interface latest or current speed value. Value is an integer representing the link speed in bits/sec. This attribute is only valid for interfaces that implement the ethtool get_link_ksettings method (mostly Ethernet). Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing: - MULTIPLIER: - DISCARD_UNCHANGED_HEARTBEAT: |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Interface {#IFNAME}: High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%) | The network interface utilization is close to its estimated maximum bandwidth. |
(avg(/Linux network interfaces by Zabbix agent/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux network interfaces by Zabbix agent/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 Recovery expression: avg(/Linux network interfaces by Zabbix agent/net.if.in["{#IFNAME}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) and avg(/Linux network interfaces by Zabbix agent/net.if.out["{#IFNAME}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m) | Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold |
min(/Linux network interfaces by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux network interfaces by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} Recovery expression: max(/Linux network interfaces by Zabbix agent/net.if.in["{#IFNAME}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 and max(/Linux network interfaces by Zabbix agent/net.if.out["{#IFNAME}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: Link down | This trigger expression works as follows: 1. Can be triggered if operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status was up(1) sometime before. (So, do not fire 'ethernal off' interfaces.) WARNING: if closed manually - won't fire again on next poll, because of .diff. |
{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2)) Recovery expression: last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2 or {$IFCONTROL:"{#IFNAME}"}=0 |
AVERAGE | Manual close: YES |
Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close. |
change(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2) Recovery expression: (change(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"],#2)>0) or (last(/Linux network interfaces by Zabbix agent/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2) |
INFO | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux generic by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$KERNEL.MAXFILES.MIN} | - |
256 |
{$KERNEL.MAXPROC.MIN} | - |
1024 |
{$SYSTEM.FUZZYTIME.MAX} | - |
60 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
General | System boot time | - |
ZABBIX_PASSIVE | system.boottime Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System local time | System local time of the host. |
ZABBIX_PASSIVE | system.localtime |
General | System name | System host name. |
ZABBIX_PASSIVE | system.hostname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System description | The information as normally returned by 'uname -a'. |
ZABBIX_PASSIVE | system.uname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of logged in users | Number of users who are currently logged in. |
ZABBIX_PASSIVE | system.users.num |
General | Maximum number of open file descriptors | It could be increased by using sysctrl utility or modifying file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxfiles Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Maximum number of processes | It could be increased by using sysctrl utility or modifying file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxproc Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of processes | - |
ZABBIX_PASSIVE | proc.num |
General | Number of running processes | - |
ZABBIX_PASSIVE | proc.num[,,run] |
Inventory | Operating system | - |
ZABBIX_PASSIVE | system.sw.os Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Operating system architecture | Operating system architecture of the host. |
ZABBIX_PASSIVE | system.sw.arch Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Software installed | - |
ZABBIX_PASSIVE | system.sw.packages Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Security | Checksum of /etc/passwd | - |
ZABBIX_PASSIVE | vfs.file.cksum[/etc/passwd] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Status | System uptime | System uptime in 'N days, hh:mm:ss' format. |
ZABBIX_PASSIVE | system.uptime |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s) | The host system time is different from the Zabbix server time. |
fuzzytime(/Linux generic by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0 |
WARNING | Manual close: YES |
System name has changed (new name: {ITEM.VALUE}) | System name has changed. Ack to close. |
last(/Linux generic by Zabbix agent/system.hostname,#1)<>last(/Linux generic by Zabbix agent/system.hostname,#2) and length(last(/Linux generic by Zabbix agent/system.hostname))>0 |
INFO | Manual close: YES |
Configured max number of open filedescriptors is too low (< {$KERNEL.MAXFILES.MIN}) | - |
last(/Linux generic by Zabbix agent/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN} |
INFO | |
Configured max number of processes is too low (< {$KERNEL.MAXPROC.MIN}) | - |
last(/Linux generic by Zabbix agent/kernel.maxproc)<{$KERNEL.MAXPROC.MIN} |
INFO | Depends on: - Getting closer to process limit (over 80% used) |
Getting closer to process limit (over 80% used) | - |
last(/Linux generic by Zabbix agent/proc.num)/last(/Linux generic by Zabbix agent/kernel.maxproc)*100>80 |
WARNING | |
Operating system description has changed | Operating system description has changed. Possible reasons that system has been updated or replaced. Ack to close. |
last(/Linux generic by Zabbix agent/system.sw.os,#1)<>last(/Linux generic by Zabbix agent/system.sw.os,#2) and length(last(/Linux generic by Zabbix agent/system.sw.os))>0 |
INFO | Manual close: YES Depends on: - System name has changed (new name: {ITEM.VALUE}) |
/etc/passwd has been changed | - |
last(/Linux generic by Zabbix agent/vfs.file.cksum[/etc/passwd],#1)<>last(/Linux generic by Zabbix agent/vfs.file.cksum[/etc/passwd],#2) |
INFO | Manual close: YES Depends on: - Operating system description has changed - System name has changed (new name: {ITEM.VALUE}) |
{HOST.NAME} has been restarted (uptime < 10m) | The host uptime is less than 10 minutes |
last(/Linux generic by Zabbix agent/system.uptime)<10m |
WARNING | Manual close: YES |
Feedback
Please report any issues with the template at https://support.zabbix.com
Linux by Zabbix agent
Overview
For Zabbix version: 5.4 and higher
New official Linux template. Requires agent of Zabbix 3.0.14, 3.4.5 and 4.0.0 or newer.
Setup
Install Zabbix agent on Linux OS according to Zabbix documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Template links
Name |
---|
Linux CPU by Zabbix agent |
Linux block devices by Zabbix agent |
Linux filesystems by Zabbix agent |
Linux generic by Zabbix agent |
Linux memory by Zabbix agent |
Linux network interfaces by Zabbix agent |
Zabbix agent |
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|
Feedback
Please report any issues with the template at https://support.zabbix.com
You can also provide a feedback, discuss the template or ask for help with it at ZABBIX forums.
Known Issues
- Description: Network discovery. Zabbix agent as of 4.2 doesn't support items such as net.if.status, net.if.speed.
Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/linux?at=release/5.0
Template Module Linux CPU by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$CPU.UTIL.CRIT} | - |
90 |
{$LOAD_AVG_PER_CPU.MAX.WARN} | Load per CPU considered sustainable. Tune if needed. |
1.5 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
CPU | Number of CPUs | - |
ZABBIX_PASSIVE | system.cpu.num Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
CPU | Load average (1m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg1] |
CPU | Load average (5m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg5] |
CPU | Load average (15m avg) | - |
ZABBIX_PASSIVE | system.cpu.load[all,avg15] |
CPU | CPU utilization | CPU utilization in %. |
DEPENDENT | system.cpu.util Preprocessing: - JAVASCRIPT: |
CPU | CPU idle time | The time the CPU has spent doing nothing. |
ZABBIX_PASSIVE | system.cpu.util[,idle] |
CPU | CPU system time | The time the CPU has spent running the kernel and its processes. |
ZABBIX_PASSIVE | system.cpu.util[,system] |
CPU | CPU user time | The time the CPU has spent running users' processes that are not niced. |
ZABBIX_PASSIVE | system.cpu.util[,user] |
CPU | CPU nice time | The time the CPU has spent running users' processes that have been niced. |
ZABBIX_PASSIVE | system.cpu.util[,nice] |
CPU | CPU iowait time | Amount of time the CPU has been waiting for I/O to complete. |
ZABBIX_PASSIVE | system.cpu.util[,iowait] |
CPU | CPU steal time | The amount of CPU 'stolen' from this virtual machine by the hypervisor for other tasks (such as running another virtual machine). |
ZABBIX_PASSIVE | system.cpu.util[,steal] |
CPU | CPU interrupt time | The amount of time the CPU has been servicing hardware interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,interrupt] |
CPU | CPU softirq time | The amount of time the CPU has been servicing software interrupts. |
ZABBIX_PASSIVE | system.cpu.util[,softirq] |
CPU | CPU guest time | Guest time (time spent running a virtual CPU for a guest operating system). |
ZABBIX_PASSIVE | system.cpu.util[,guest] |
CPU | CPU guest nice time | Time spent running a niced guest (virtual CPU for guest operating systems under the control of the Linux kernel). |
ZABBIX_PASSIVE | system.cpu.util[,guest_nice] |
CPU | Context switches per second | - |
ZABBIX_PASSIVE | system.cpu.switches Preprocessing: - CHANGE_PER_SECOND |
CPU | Interrupts per second | - |
ZABBIX_PASSIVE | system.cpu.intr Preprocessing: - CHANGE_PER_SECOND |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Load average is too high (per CPU load over {$LOAD_AVG_PER_CPU.MAX.WARN} for 5m) | Per CPU load average is too high. Your system may be slow to respond. |
{TEMPLATE_NAME:system.cpu.load[all,avg1].min(5m)}/{TEMPLATE_NAME:system.cpu.num.last()}>{$LOAD_AVG_PER_CPU.MAX.WARN} and {TEMPLATE_NAME:system.cpu.load[all,avg5].last()}>0 and {TEMPLATE_NAME:system.cpu.load[all,avg15].last()}>0 |
AVERAGE | |
High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m) | CPU utilization is too high. The system might be slow to respond. |
{TEMPLATE_NAME:system.cpu.util.min(5m)}>{$CPU.UTIL.CRIT} |
WARNING | Depends on: - Load average is too high (per CPU load over {$LOAD_AVG_PER_CPU.MAX.WARN} for 5m) |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template Module Linux filesystems by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$VFS.FS.FREE.MIN.CRIT} | The critical threshold of the filesystem utilization. |
5G |
{$VFS.FS.FREE.MIN.WARN} | The warning threshold of the filesystem utilization. |
10G |
{$VFS.FS.FSNAME.MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
.+ |
{$VFS.FS.FSNAME.NOT_MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
`^(/dev |
{$VFS.FS.FSTYPE.MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
`^(btrfs |
{$VFS.FS.FSTYPE.NOT_MATCHES} | This macro is used in filesystems discovery. Can be overridden on the host or linked template level |
^\s$ |
{$VFS.FS.INODE.PFREE.MIN.CRIT} | - |
10 |
{$VFS.FS.INODE.PFREE.MIN.WARN} | - |
20 |
{$VFS.FS.PUSED.MAX.CRIT} | - |
90 |
{$VFS.FS.PUSED.MAX.WARN} | - |
80 |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Mounted filesystem discovery | Discovery of file systems of different types. |
ZABBIX_PASSIVE | vfs.fs.discovery Filter: AND- A: {#FSTYPE} MATCHES_REGEX - B: {#FSTYPE} NOT_MATCHES_REGEX - C: {#FSNAME} MATCHES_REGEX - D: {#FSNAME} NOT_MATCHES_REGEX Overrides: Skip metadata collection for dynamic FS |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Filesystems | {#FSNAME}: Used space | Used storage in Bytes |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},used] |
Filesystems | {#FSNAME}: Total space | Total space in Bytes |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},total] |
Filesystems | {#FSNAME}: Space utilization | Space utilization in % for {#FSNAME} |
ZABBIX_PASSIVE | vfs.fs.size[{#FSNAME},pused] |
Filesystems | {#FSNAME}: Free inodes in % | - |
ZABBIX_PASSIVE | vfs.fs.inode[{#FSNAME},pfree] |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%) | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}. - The disk will be full in less than 24 hours. |
{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and (({TEMPLATE_NAME:vfs.fs.size[{#FSNAME},total].last()}-{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},used].last()})<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or {TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].timeleft(1h,,100)}<1d) |
AVERAGE | Manual close: YES |
{#FSNAME}: Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%) | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}. - The disk will be full in less than 24 hours. |
{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and (({TEMPLATE_NAME:vfs.fs.size[{#FSNAME},total].last()}-{TEMPLATE_NAME:vfs.fs.size[{#FSNAME},used].last()})<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or {TEMPLATE_NAME:vfs.fs.size[{#FSNAME},pused].timeleft(1h,,100)}<1d) |
WARNING | Manual close: YES Depends on: - {#FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%) |
{#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}%) | It may become impossible to write to disk if there are no index nodes left. As symptoms, 'No space left on device' or 'Disk is full' errors may be seen even though free space is available. |
{TEMPLATE_NAME:vfs.fs.inode[{#FSNAME},pfree].min(5m)}<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"} |
AVERAGE | |
{#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"}%) | It may become impossible to write to disk if there are no index nodes left. As symptoms, 'No space left on device' or 'Disk is full' errors may be seen even though free space is available. |
{TEMPLATE_NAME:vfs.fs.inode[{#FSNAME},pfree].min(5m)}<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"} |
WARNING | Depends on: - {#FSNAME}: Running out of free inodes (free < {$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}%) |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template Module Linux memory by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$MEMORY.AVAILABLE.MIN} | This macro is used as a threshold in memory available trigger. |
20M |
{$MEMORY.UTIL.MAX} | This macro is used as a threshold in memory utilization trigger. |
90 |
{$SWAP.PFREE.MIN.WARN} | - |
50 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Memory | Memory utilization | Memory used percentage is calculated as (100-pavailable) |
DEPENDENT | vm.memory.utilization Preprocessing: - JAVASCRIPT: |
Memory | Available memory in % | Available memory as percentage of total. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[pavailable] |
Memory | Total memory | Total memory in Bytes. |
ZABBIX_PASSIVE | vm.memory.size[total] |
Memory | Available memory | Available memory, in Linux, available = free + buffers + cache. On other platforms calculation may vary. See also Appendixes in Zabbix Documentation about parameters of the vm.memory.size item. |
ZABBIX_PASSIVE | vm.memory.size[available] |
Memory | Total swap space | The total space of swap volume/file in bytes. |
ZABBIX_PASSIVE | system.swap.size[,total] |
Memory | Free swap space | The free space of swap volume/file in bytes. |
ZABBIX_PASSIVE | system.swap.size[,free] |
Memory | Free swap space in % | The free space of swap volume/file in percent. |
ZABBIX_PASSIVE | system.swap.size[,pfree] |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m) | The system is running out of free memory. |
{TEMPLATE_NAME:vm.memory.utilization.min(5m)}>{$MEMORY.UTIL.MAX} |
AVERAGE | Depends on: - Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) |
Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) | - |
{TEMPLATE_NAME:vm.memory.size[available].max(5m)}<{$MEMORY.AVAILABLE.MIN} and {TEMPLATE_NAME:vm.memory.size[total].last()}>0 |
AVERAGE | |
High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free) | This trigger is ignored, if there is no swap configured. |
{TEMPLATE_NAME:system.swap.size[,pfree].max(5m)}<{$SWAP.PFREE.MIN.WARN} and {TEMPLATE_NAME:system.swap.size[,total].last()}>0 |
WARNING | Depends on: - High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m) - Lack of available memory (<{$MEMORY.AVAILABLE.MIN} of {ITEM.VALUE2}) |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template Module Linux block devices by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$VFS.DEV.DEVNAME.MATCHES} | This macro is used in block devices discovery. Can be overridden on the host or linked template level |
.+ |
{$VFS.DEV.DEVNAME.NOT_MATCHES} | This macro is used in block devices discovery. Can be overridden on the host or linked template level |
`^(loop[0-9]* |
{$VFS.DEV.READ.AWAIT.WARN} | Disk read average response time (in ms) before the trigger would fire |
20 |
{$VFS.DEV.WRITE.AWAIT.WARN} | Disk write average response time (in ms) before the trigger would fire |
20 |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Block devices discovery | - |
ZABBIX_PASSIVE | vfs.dev.discovery Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: Filter: AND- A: {#DEVTYPE} MATCHES_REGEX - B: {#DEVNAME} MATCHES_REGEX - C: {#DEVNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Storage | {#DEVNAME}: Disk read rate | r/s. The number (after merges) of read requests completed per second for the device. |
DEPENDENT | vfs.dev.read.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk write rate | w/s. The number (after merges) of write requests completed per second for the device. |
DEPENDENT | vfs.dev.write.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND |
Storage | {#DEVNAME}: Disk read request avg waiting time (r_await) | This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception. |
CALCULATED | vfs.dev.read.await[{#DEVNAME}] Expression: (last("vfs.dev.read.time.rate[{#DEVNAME}]")/(last("vfs.dev.read.rate[{#DEVNAME}]")+(last("vfs.dev.read.rate[{#DEVNAME}]")=0)))*1000*(last("vfs.dev.read.rate[{#DEVNAME}]") > 0) |
Storage | {#DEVNAME}: Disk write request avg waiting time (w_await) | This formula contains two boolean expressions that evaluates to 1 or 0 in order to set calculated metric to zero and to avoid division by zero exception. |
CALCULATED | vfs.dev.write.await[{#DEVNAME}] Expression: (last("vfs.dev.write.time.rate[{#DEVNAME}]")/(last("vfs.dev.write.rate[{#DEVNAME}]")+(last("vfs.dev.write.rate[{#DEVNAME}]")=0)))*1000*(last("vfs.dev.write.rate[{#DEVNAME}]") > 0) |
Storage | {#DEVNAME}: Disk average queue size (avgqu-sz) | Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected. |
DEPENDENT | vfs.dev.queue_size[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Storage | {#DEVNAME}: Disk utilization | This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests. |
DEPENDENT | vfs.dev.util[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix_raw_items | {#DEVNAME}: Get stats | Get contents of /sys/block/{#DEVNAME}/stat for disk stats. |
ZABBIX_PASSIVE | vfs.file.contents[/sys/block/{#DEVNAME}/stat] Preprocessing: - JAVASCRIPT: |
Zabbix_raw_items | {#DEVNAME}: Disk read time (rate) | Rate of total read time counter. Used in r_await calculation |
DEPENDENT | vfs.dev.read.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Zabbix_raw_items | {#DEVNAME}: Disk write time (rate) | Rate of total write time counter. Used in w_await calculation |
DEPENDENT | vfs.dev.write.time.rate[{#DEVNAME}] Preprocessing: - JSONPATH: - CHANGE_PER_SECOND - MULTIPLIER: |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
{#DEVNAME}: Disk read/write request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} ms for 15m or write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} ms for 15m) | This trigger might indicate disk {#DEVNAME} saturation. |
{TEMPLATE_NAME:vfs.dev.read.await[{#DEVNAME}].min(15m)} > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or {TEMPLATE_NAME:vfs.dev.write.await[{#DEVNAME}].min(15m)} > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"} |
WARNING | Manual close: YES |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template Module Linux network interfaces by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$IF.ERRORS.WARN} | - |
2 |
{$IF.UTIL.MAX} | This macro is used as a threshold in interface utilization trigger. |
90 |
{$IFCONTROL} | - |
1 |
{$NET.IF.IFNAME.MATCHES} | - |
^.*$ |
{$NET.IF.IFNAME.NOT_MATCHES} | Filter out loopbacks, nulls, docker veth links and docker0 bridge by default |
`(^Software Loopback Interface |
Template links
There are no template links in this template.
Discovery rules
Name | Description | Type | Key and additional info |
---|---|---|---|
Network interface discovery | Discovery of network interfaces. |
ZABBIX_PASSIVE | net.if.discovery Filter: AND- A: {#IFNAME} MATCHES_REGEX - B: {#IFNAME} NOT_MATCHES_REGEX |
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
Network_interfaces | Interface {#IFNAME}: Bits received | ZABBIX_PASSIVE | net.if.in["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
|
Network_interfaces | Interface {#IFNAME}: Bits sent | ZABBIX_PASSIVE | net.if.out["{#IFNAME}"] Preprocessing: - CHANGE_PER_SECOND - MULTIPLIER: |
|
Network_interfaces | Interface {#IFNAME}: Outbound packets with errors | ZABBIX_PASSIVE | net.if.out["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
|
Network_interfaces | Interface {#IFNAME}: Inbound packets with errors | ZABBIX_PASSIVE | net.if.in["{#IFNAME}",errors] Preprocessing: - CHANGE_PER_SECOND |
|
Network_interfaces | Interface {#IFNAME}: Outbound packets discarded | ZABBIX_PASSIVE | net.if.out["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
|
Network_interfaces | Interface {#IFNAME}: Inbound packets discarded | ZABBIX_PASSIVE | net.if.in["{#IFNAME}",dropped] Preprocessing: - CHANGE_PER_SECOND |
|
Network_interfaces | Interface {#IFNAME}: Operational status | Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"] Preprocessing: - JAVASCRIPT: |
Network_interfaces | Interface {#IFNAME}: Interface type | Indicates the interface protocol type as a decimal value. See include/uapi/linux/if_arp.h for all possible values. Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/type"] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Network_interfaces | Interface {#IFNAME}: Speed | Indicates the interface latest or current speed value. Value is an integer representing the link speed in bits/sec. This attribute is only valid for interfaces that implement the ethtool get_link_ksettings method (mostly Ethernet). Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net |
ZABBIX_PASSIVE | vfs.file.contents["/sys/class/net/{#IFNAME}/speed"] Preprocessing: - MULTIPLIER: - DISCARD_UNCHANGED_HEARTBEAT: |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
Interface {#IFNAME}: High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%) | The network interface utilization is close to its estimated maximum bandwidth. |
({TEMPLATE_NAME:net.if.in["{#IFNAME}"].avg(15m)}>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*{TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()} or {TEMPLATE_NAME:net.if.out["{#IFNAME}"].avg(15m)}>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*{TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()}) and {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()}>0 Recovery expression: {TEMPLATE_NAME:net.if.in["{#IFNAME}"].avg(15m)}<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*{TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()} and {TEMPLATE_NAME:net.if.out["{#IFNAME}"].avg(15m)}<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*{TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()} |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m) | Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold |
{TEMPLATE_NAME:net.if.in["{#IFNAME}",errors].min(5m)}>{$IF.ERRORS.WARN:"{#IFNAME}"} or {TEMPLATE_NAME:net.if.out["{#IFNAME}",errors].min(5m)}>{$IF.ERRORS.WARN:"{#IFNAME}"} Recovery expression: {TEMPLATE_NAME:net.if.in["{#IFNAME}",errors].max(5m)}<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 and {TEMPLATE_NAME:net.if.out["{#IFNAME}",errors].max(5m)}<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 |
WARNING | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Interface {#IFNAME}: Link down | This trigger expression works as follows: 1. Can be triggered if operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status was up(1) sometime before. (So, do not fire 'ethernal off' interfaces.) WARNING: if closed manually - won't fire again on next poll, because of .diff. |
{$IFCONTROL:"{#IFNAME}"}=1 and ({TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"].last()}=2 and {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"].diff()}=1) Recovery expression: {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"].last()}<>2 or {$IFCONTROL:"{#IFNAME}"}=0 |
AVERAGE | Manual close: YES |
Interface {#IFNAME}: Ethernet has changed to lower speed than it was before | This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close. |
{TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].change()}<0 and {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].last()}>0 and ({TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/type"].last()}=6 or {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/type"].last()}=1) and ({TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"].last()}<>2) Recovery expression: ({TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].change()}>0 and {TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/speed"].prev()}>0) or ({TEMPLATE_NAME:vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"].last()}=2) |
INFO | Manual close: YES Depends on: - Interface {#IFNAME}: Link down |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template Module Linux generic by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
Setup
Refer to the vendor documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Macros used
Name | Description | Default |
---|---|---|
{$KERNEL.MAXFILES.MIN} | - |
256 |
{$KERNEL.MAXPROC.MIN} | - |
1024 |
{$SYSTEM.FUZZYTIME.MAX} | - |
60 |
Template links
There are no template links in this template.
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|---|---|---|---|
General | System boot time | - |
ZABBIX_PASSIVE | system.boottime Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System local time | System local time of the host. |
ZABBIX_PASSIVE | system.localtime |
General | System name | System host name. |
ZABBIX_PASSIVE | system.hostname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | System description | The information as normally returned by 'uname -a'. |
ZABBIX_PASSIVE | system.uname Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of logged in users | Number of users who are currently logged in. |
ZABBIX_PASSIVE | system.users.num |
General | Maximum number of open file descriptors | It could be increased by using sysctl utility or modifying file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxfiles Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Maximum number of processes | It could be increased by using sysctl utility or modifying file /etc/sysctl.conf. |
ZABBIX_PASSIVE | kernel.maxproc Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
General | Number of processes | - |
ZABBIX_PASSIVE | proc.num |
General | Number of running processes | - |
ZABBIX_PASSIVE | proc.num[,,run] |
Inventory | Operating system | - |
ZABBIX_PASSIVE | system.sw.os Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Operating system architecture | Operating system architecture of the host. |
ZABBIX_PASSIVE | system.sw.arch Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Inventory | Software installed | - |
ZABBIX_PASSIVE | system.sw.packages Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Security | Checksum of /etc/passwd | - |
ZABBIX_PASSIVE | vfs.file.cksum[/etc/passwd] Preprocessing: - DISCARD_UNCHANGED_HEARTBEAT: |
Status | System uptime | System uptime in 'N days, hh:mm:ss' format. |
ZABBIX_PASSIVE | system.uptime |
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|---|---|---|---|
System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s) | The host system time is different from the Zabbix server time. |
{TEMPLATE_NAME:system.localtime.fuzzytime({$SYSTEM.FUZZYTIME.MAX})}=0 |
WARNING | Manual close: YES |
System name has changed (new name: {ITEM.VALUE}) | System name has changed. Ack to close. |
{TEMPLATE_NAME:system.hostname.diff()}=1 and {TEMPLATE_NAME:system.hostname.strlen()}>0 |
INFO | Manual close: YES |
Configured max number of open filedescriptors is too low (< {$KERNEL.MAXFILES.MIN}) | - |
{TEMPLATE_NAME:kernel.maxfiles.last()}<{$KERNEL.MAXFILES.MIN} |
INFO | |
Configured max number of processes is too low (< {$KERNEL.MAXPROC.MIN}) | - |
{TEMPLATE_NAME:kernel.maxproc.last()}<{$KERNEL.MAXPROC.MIN} |
INFO | Depends on: - Getting closer to process limit (over 80% used) |
Getting closer to process limit (over 80% used) | - |
{TEMPLATE_NAME:proc.num.last()}/{TEMPLATE_NAME:kernel.maxproc.last()}*100>80 |
WARNING | |
Operating system description has changed | Operating system description has changed. Possible reasons that system has been updated or replaced. Ack to close. |
{TEMPLATE_NAME:system.sw.os.diff()}=1 and {TEMPLATE_NAME:system.sw.os.strlen()}>0 |
INFO | Manual close: YES Depends on: - System name has changed (new name: {ITEM.VALUE}) |
/etc/passwd has been changed | - |
{TEMPLATE_NAME:vfs.file.cksum[/etc/passwd].diff()}>0 |
INFO | Manual close: YES Depends on: - Operating system description has changed - System name has changed (new name: {ITEM.VALUE}) |
{HOST.NAME} has been restarted (uptime < 10m) | The host uptime is less than 10 minutes |
{TEMPLATE_NAME:system.uptime.last()}<10m |
WARNING | Manual close: YES |
Feedback
Please report any issues with the template at https://support.zabbix.com.
Template OS Linux by Zabbix agent
Overview
For Zabbix version: 5.0 and higher.
New official Linux template. Requires agent of Zabbix 3.0.14, 3.4.5 and 4.0.0 or newer.
Setup
Install Zabbix agent on Linux OS according to Zabbix documentation.
Zabbix configuration
No specific Zabbix configuration is required.
Template links
Name |
---|
Linux CPU by Zabbix agent |
Linux block devices by Zabbix agent |
Linux filesystems by Zabbix agent |
Linux generic by Zabbix agent |
Linux memory by Zabbix agent |
Linux network interfaces by Zabbix agent |
Zabbix agent |
Discovery rules
Items collected
Group | Name | Description | Type | Key and additional info |
---|
Triggers
Name | Description | Expression | Severity | Dependencies and additional info |
---|
Feedback
Please report any issues with the template at https://support.zabbix.com.
You can also provide feedback, discuss the template, or ask for help at ZABBIX forums.
Known Issues
- Description: Network discovery. Zabbix agent as of 4.2 doesn't support items such as net.if.status, net.if.speed.