Windows

Windows

Microsoft Windows is a group of several graphical operating system families, all of which are developed, marketed, and sold by Microsoft.

Available solutions




Source: https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/templates/os/windows_agent


Template Module Windows CPU by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$CPU.INTERRUPT.CRIT.MAX}

The critical threshold of the % Interrupt Time counter.

50
{$CPU.PRIV.CRIT.MAX}

The threshold of the % Privileged Time counter.

30
{$CPU.QUEUE.CRIT.MAX}

The threshold of the Processor Queue Length counter.

3
{$CPU.UTIL.CRIT}

-

90

Template links

There are no template links in this template.

Discovery rules

Items collected

GroupNameDescriptionTypeKey and additional info
CPUCPU utilization

CPU utilization in %

ZABBIX_PASSIVEsystem.cpu.util
CPUCPU interrupt time

The Processor Information% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

ZABBIX_PASSIVEperf_counter_en["\Processor Information(_total)% Interrupt Time"]
CPUContext switches per second

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.

Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.

It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.

There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

ZABBIX_PASSIVEperf_counter_en["\System\Context Switches/sec"]
CPUCPU privileged time

The Processor Information% Privileged Time counter shows the percent of time that the processor is spent

executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt

Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode

functions of the Windows® Operating System.

ZABBIX_PASSIVEperf_counter_en["\Processor Information(_total)% Privileged Time"]
CPUCPU DPC time

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure

calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a

component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is

sustained, there may be a processor bottleneck or an application or hardware related issue that can

significantly diminish overall system performance.

ZABBIX_PASSIVEperf_counter_en["\Processor Information(_total)% DPC Time"]
CPUCPU user time

The Processor Information% User Time counter shows the percent of time that the processor(s) is spent executing

in User mode.

ZABBIX_PASSIVEperf_counter_en["\Processor Information(_total)% User Time"]
CPUCPU queue length

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue

and are waiting to be executed.

ZABBIX_PASSIVEperf_counter_en["\System\Processor Queue Length"]

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)

-

{TEMPLATE_NAME:system.cpu.util.min(5m)}>{$CPU.UTIL.CRIT}WARNING
CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)

"The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."

The Processor Information% Interrupt Time is the time the processor spends receiving and servicing

hardware interrupts during sample intervals. This value is an indirect indicator of the activity of

devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication

lines, network interface cards and other peripheral devices. This is an easy way to identify a potential

hardware failure. This should never be higher than 20%.

{TEMPLATE_NAME:perf_counter_en["\Processor Information(_total)\% Interrupt Time"].min(5m)}>{$CPU.INTERRUPT.CRIT.MAX}WARNING

Depends on:

- High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)

CPU privileged time is too high (over {$CPU.PRIV.CRIT.MAX}% for 5m)

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.

{TEMPLATE_NAME:perf_counter_en["\Processor Information(_total)\% Privileged Time"].min(5m)}>{$CPU.PRIV.CRIT.MAX}WARNING

Depends on:

- CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)

- High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)

CPU queue length is too high (over {$CPU.QUEUE.CRIT.MAX}% for 5m)

The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}%.

{TEMPLATE_NAME:perf_counter_en["\System\Processor Queue Length"].min(5m)}>{$CPU.QUEUE.CRIT.MAX}WARNING

Depends on:

- High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)

Feedback

Please report any issues with the template at https://support.zabbix.com

Template Module Windows memory by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$MEM.PAGE_SEC.CRIT.MAX}

The warning threshold of the Memory Pages/sec counter.

1000
{$MEM.PAGE_TABLE_CRIT.MIN}

The warning threshold of the Free System Page Table Entries counter.

5000
{$MEMORY.UTIL.MAX}

The warning threshold of the Memory util item.

90
{$SWAP.PFREE.MIN.WARN}

The warning threshold of the minimum free swap.

20

Template links

There are no template links in this template.

Discovery rules

Items collected

GroupNameDescriptionTypeKey and additional info
MemoryUsed memory

Used memory in Bytes

ZABBIX_PASSIVEvm.memory.size[used]
MemoryTotal memory

Total memory in Bytes

ZABBIX_PASSIVEvm.memory.size[total]
MemoryMemory utilization

Memory utilization in %

CALCULATEDvm.memory.util

Expression:

last("vm.memory.size[used]") / last("vm.memory.size[total]") * 100
MemoryCache bytes

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes,

Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays

the last observed value only; it is not an average.

ZABBIX_PASSIVEperf_counter_en["\Memory\Cache Bytes"]
MemoryFree swap space

-

ZABBIX_PASSIVEsystem.swap.size[,free]
MemoryFree swap space in %

-

ZABBIX_PASSIVEsystem.swap.size[,pfree]
MemoryTotal swap space

-

ZABBIX_PASSIVEsystem.swap.size[,total]
MemoryFree system page table entries

This indicates the number of page table entries not currently in use by the system. If the number is less

than 5,000, there may well be a memory leak or you running out of memory.

ZABBIX_PASSIVEperf_counter_en["\Memory\Free System Page Table Entries"]
MemoryMemory page faults per second

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages

faulted per second because only one page is faulted in each fault operation, hence this is also equal

to the number of page fault operations. This counter includes both hard faults (those that require

disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most

processors can handle large numbers of soft faults without significant consequence. However, hard faults,

which require disk access, can cause significant delays.

ZABBIX_PASSIVEperf_counter_en["\Memory\Page Faults/sec"]
MemoryMemory pages per second

This measures the rate at which pages are read from or written to disk to resolve hard page faults.

If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

ZABBIX_PASSIVEperf_counter_en["\Memory\Pages/sec"]
MemoryMemory pool non-paged

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects

that cannot be written to disk but instead must remain in physical memory as long as they are allocated.

There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).

A typical Event ID 2019 is recorded in the system event log.

ZABBIX_PASSIVEperf_counter_en["\Memory\Pool Nonpaged Bytes"]

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
High memory utilization ( >{$MEMORY.UTIL.MAX}% for 5m)

-

{TEMPLATE_NAME:vm.memory.util.min(5m)}>{$MEMORY.UTIL.MAX}AVERAGE
High swap space usage ( less than {$SWAP.PFREE.MIN.WARN}% free)

This trigger is ignored, if there is no swap configured

{TEMPLATE_NAME:system.swap.size[,pfree].min(5m)}<{$SWAP.PFREE.MIN.WARN} and {Template Module Windows memory by Zabbix agent:system.swap.size[,total].last()}>0WARNING

Depends on:

- High memory utilization ( >{$MEMORY.UTIL.MAX}% for 5m)

Number of free system page table entries is too low (less {$MEM.PAGE_TABLE_CRIT.MIN} for 5m)

The Memory Free System Page Table Entries is less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.

{TEMPLATE_NAME:perf_counter_en["\Memory\Free System Page Table Entries"].max(5m)}<{$MEM.PAGE_TABLE_CRIT.MIN}WARNING

Depends on:

- High memory utilization ( >{$MEMORY.UTIL.MAX}% for 5m)

The Memory Pages/sec is too high (over {$MEM.PAGE_SEC.CRIT.MAX} for 5m)

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

{TEMPLATE_NAME:perf_counter_en["\Memory\Pages/sec"].min(5m)}>{$MEM.PAGE_SEC.CRIT.MAX}WARNING

Depends on:

- High memory utilization ( >{$MEMORY.UTIL.MAX}% for 5m)

Feedback

Please report any issues with the template at https://support.zabbix.com

Template Module Windows filesystems by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$VFS.FS.FSDRIVETYPE.MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

fixed
{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

^\s$
{$VFS.FS.FSNAME.MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

.*
{$VFS.FS.FSNAME.NOT_MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

`^(/dev
{$VFS.FS.FSTYPE.MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

.*
{$VFS.FS.FSTYPE.NOT_MATCHES}

This macro is used in filesystems discovery. Can be overridden on the host or linked template level.

^\s$
{$VFS.FS.PUSED.MAX.CRIT}

-

90
{$VFS.FS.PUSED.MAX.WARN}

-

80

Template links

There are no template links in this template.

Discovery rules

NameDescriptionTypeKey and additional info
Mounted filesystem discovery

Discovery of file systems of different types.

ZABBIX_PASSIVEvfs.fs.discovery

Filter:

AND

- A: { #FSTYPE} MATCHES_REGEX {$VFS.FS.FSTYPE.MATCHES}

- B: { #FSTYPE} NOT_MATCHES_REGEX {$VFS.FS.FSTYPE.NOT_MATCHES}

- C: { #FSNAME} MATCHES_REGEX {$VFS.FS.FSNAME.MATCHES}

- D: { #FSNAME} NOT_MATCHES_REGEX {$VFS.FS.FSNAME.NOT_MATCHES}

- E: { #FSDRIVETYPE} MATCHES_REGEX {$VFS.FS.FSDRIVETYPE.MATCHES}

- F: { #FSDRIVETYPE} NOT_MATCHES_REGEX {$VFS.FS.FSDRIVETYPE.NOT_MATCHES}

Items collected

GroupNameDescriptionTypeKey and additional info
Filesystems{ #FSNAME}: Used space

Used storage in Bytes

ZABBIX_PASSIVEvfs.fs.size[{ #FSNAME},used]
Filesystems{ #FSNAME}: Total space

Total space in Bytes

ZABBIX_PASSIVEvfs.fs.size[{ #FSNAME},total]
Filesystems{ #FSNAME}: Space utilization

Space utilization in % for { #FSNAME}

ZABBIX_PASSIVEvfs.fs.size[{ #FSNAME},pused]

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
{ #FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{ #FSNAME}"}%)

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{ #FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than 5G.

- The disk will be full in less than 24 hours.

{TEMPLATE_NAME:vfs.fs.size[{ #FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.CRIT:"{ #FSNAME}"} and (({Template Module Windows filesystems by Zabbix agent:vfs.fs.size[{ #FSNAME},total].last()}-{Template Module Windows filesystems by Zabbix agent:vfs.fs.size[{ #FSNAME},used].last()})<5G or {TEMPLATE_NAME:vfs.fs.size[{ #FSNAME},pused].timeleft(1h,,100)}<1d)AVERAGE

Manual close: YES

{ #FSNAME}: Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{ #FSNAME}"}%)

Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{ #FSNAME}"}.

Second condition should be one of the following:

- The disk free space is less than 10G.

- The disk will be full in less than 24 hours.

{TEMPLATE_NAME:vfs.fs.size[{ #FSNAME},pused].last()}>{$VFS.FS.PUSED.MAX.WARN:"{ #FSNAME}"} and (({Template Module Windows filesystems by Zabbix agent:vfs.fs.size[{ #FSNAME},total].last()}-{Template Module Windows filesystems by Zabbix agent:vfs.fs.size[{ #FSNAME},used].last()})<10G or {TEMPLATE_NAME:vfs.fs.size[{ #FSNAME},pused].timeleft(1h,,100)}<1d)WARNING

Manual close: YES

Depends on:

- { #FSNAME}: Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{ #FSNAME}"}%)

Feedback

Please report any issues with the template at https://support.zabbix.com

Template Module Windows physical disks by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$VFS.DEV.DEVNAME.MATCHES}

-

.*
{$VFS.DEV.DEVNAME.NOT_MATCHES}

-

_Total
{$VFS.DEV.UTIL.MAX.WARN}

-

95

Template links

There are no template links in this template.

Discovery rules

NameDescriptionTypeKey and additional info
Physical disks discovery

-

DEPENDENTvfs.dev.discovery

Preprocessing:

- JAVASCRIPT: output = JSON.parse(value).map(function(dev){ return { "{ #DEVNAME}": dev.Name, "{ #DEVQUEUE}": dev.CurrentDiskQueueLength, "{ #DEVREADS}": dev.DiskReadsPersec, "{ #DEVTIME}": dev.PercentDiskTime, "{ #DEVWRITES}": dev.DiskWritesPersec }}) return JSON.stringify({"data": output})

- DISCARD_UNCHANGED_HEARTBEAT: 1h

Filter:

AND

- A: { #DEVNAME} MATCHES_REGEX {$VFS.DEV.DEVNAME.MATCHES}

- B: { #DEVNAME} NOT_MATCHES_REGEX {$VFS.DEV.DEVNAME.NOT_MATCHES}

Items collected

GroupNameDescriptionTypeKey and additional info
Storage{ #DEVNAME}: Disk read rate

-

DEPENDENTvfs.dev.read.rate[DiskReadsPersec.{ #DEVNAME}]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #DEVNAME}")].DiskReadsPersec.first()

Storage{ #DEVNAME}: Disk write rate

-

DEPENDENTvfs.dev.write.rate[DiskWritesPersec.{ #DEVNAME}]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #DEVNAME}")].DiskWritesPersec.first()

Storage{ #DEVNAME}: Disk average queue size (avgqu-sz)

-

DEPENDENTvfs.dev.queue_size[CurrentDiskQueueLength.{ #DEVNAME}]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #DEVNAME}")].CurrentDiskQueueLength.first()

Storage{ #DEVNAME}: Disk utilization

-

DEPENDENTvfs.dev.util[PercentDiskTime.{ #DEVNAME}]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #DEVNAME}")].PercentDiskTime.first()

Zabbix_raw_itemsPhysical disks WMI get

-

ZABBIX_PASSIVEwmi.getall[root\cimv2,"select * from win32_perfformatteddata_perfdisk_physicaldisk"]

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
{ #DEVNAME}: Disk is overloaded (util > {$VFS.DEV.UTIL.MAX.WARN}% for 15m)

-

{TEMPLATE_NAME:vfs.dev.util[PercentDiskTime.{ #DEVNAME}].min(15m)}>{$VFS.DEV.UTIL.MAX.WARN}WARNING

Manual close: YES

Feedback

Please report any issues with the template at https://support.zabbix.com

Template Module Windows generic by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$SYSTEM.FUZZYTIME.MAX}

-

60

Template links

There are no template links in this template.

Discovery rules

Items collected

GroupNameDescriptionTypeKey and additional info
GeneralSystem local time

-

ZABBIX_PASSIVEsystem.localtime
GeneralSystem name

System host name.

ZABBIX_PASSIVEsystem.hostname

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 1d

GeneralSystem description

-

ZABBIX_PASSIVEsystem.uname

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 1d

GeneralNumber of processes

-

ZABBIX_PASSIVEproc.num[]
GeneralNumber of threads

The number of threads used by all running processes.

ZABBIX_PASSIVEperf_counter_en["\System\Threads"]
InventoryOperating system architecture

-

ZABBIX_PASSIVEsystem.sw.arch

Preprocessing:

- DISCARD_UNCHANGED_HEARTBEAT: 1d

StatusUptime

-

ZABBIX_PASSIVEsystem.uptime

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s)

-

{TEMPLATE_NAME:system.localtime.fuzzytime({$SYSTEM.FUZZYTIME.MAX})}=0WARNING

Manual close: YES

System name has changed (new name: {ITEM.VALUE})

System name has changed. Ack to close.

{TEMPLATE_NAME:system.hostname.diff()}=1 and {TEMPLATE_NAME:system.hostname.strlen()}>0INFO

Manual close: YES

Host has been restarted (uptime < 10m)

The device uptime is less than 10 minutes.

{TEMPLATE_NAME:system.uptime.last()}<10mWARNING

Manual close: YES

Feedback

Please report any issues with the template at https://support.zabbix.com

Template Module Windows network by Zabbix agent

Overview

For Zabbix version: 4.4

Setup

Zabbix configuration

Macros used

NameDescriptionDefault
{$NET.IF.IFALIAS.MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

.*
{$NET.IF.IFALIAS.NOT_MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

CHANGE_THIS
{$NET.IF.IFDESCR.MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

.*
{$NET.IF.IFDESCR.NOT_MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

CHANGE_THIS
{$NET.IF.IFNAME.MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

.*
{$NET.IF.IFNAME.NOT_MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

`Miniport
{$NET.IF.IFNETENABLED.MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

True
{$NET.IF.IFNETENABLED.NOT_MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

CHANGE_THIS
{$NET.IF.PHYSICALADAPTER.MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

True
{$NET.IF.PHYSICALADAPTER.NOT_MATCHES}

This macro is used in Network interface discovery. Can be overridden on the host or linked template level.

CHANGE_THIS

Template links

There are no template links in this template.

Discovery rules

NameDescriptionTypeKey and additional info
Network interfaces discovery

-

DEPENDENTnet.if.discovery

Preprocessing:

- JAVASCRIPT: output = JSON.parse(value).map(function(net){ return { "{ #IFNAME}": net.Name, "{ #IFDESCR}": net.Description, "{ #IFPHYSICALADAPTER}": net.PhysicalAdapter, "{ #IFALIAS}" : net.NetConnectionID, "{ #IFNETENABLED}": net.NetEnabled, "{ #IFNETSTATUS}": net.NetConnectionStatus, "{ #IFSPEED}": net.Speed }}) return JSON.stringify({"data": output})

- DISCARD_UNCHANGED_HEARTBEAT: 1h

Filter:

AND

- A: { #IFPHYSICALADAPTER} MATCHES_REGEX {$NET.IF.PHYSICALADAPTER.MATCHES}

- B: { #IFPHYSICALADAPTER} NOT_MATCHES_REGEX {$NET.IF.PHYSICALADAPTER.NOT_MATCHES}

- C: { #IFNAME} MATCHES_REGEX {$NET.IF.IFNAME.MATCHES}

- D: { #IFNAME} NOT_MATCHES_REGEX {$NET.IF.IFNAME.NOT_MATCHES}

- E: { #IFDESCR} MATCHES_REGEX {$NET.IF.IFDESCR.MATCHES}

- F: { #IFDESCR} NOT_MATCHES_REGEX {$NET.IF.IFDESCR.NOT_MATCHES}

- G: { #IFALIAS} MATCHES_REGEX {$NET.IF.IFALIAS.MATCHES}

- H: { #IFALIAS} NOT_MATCHES_REGEX {$NET.IF.IFALIAS.NOT_MATCHES}

- I: { #IFNETENABLED} MATCHES_REGEX {$NET.IF.IFNETENABLED.MATCHES}

- J: { #IFNETENABLED} NOT_MATCHES_REGEX {$NET.IF.IFNETENABLED.NOT_MATCHES}

Items collected

GroupNameDescriptionTypeKey and additional info
Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Bits receivedZABBIX_PASSIVEnet.if.in["{ #IFNAME}"]

Preprocessing:

- CHANGE_PER_SECOND

- MULTIPLIER: 8

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Bits sentZABBIX_PASSIVEnet.if.out["{ #IFNAME}"]

Preprocessing:

- CHANGE_PER_SECOND

- MULTIPLIER: 8

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Inbound packets discardedZABBIX_PASSIVEnet.if.in["{ #IFNAME}",dropped]

Preprocessing:

- CHANGE_PER_SECOND

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Outbound packets discardedZABBIX_PASSIVEnet.if.out["{ #IFNAME}",dropped]

Preprocessing:

- CHANGE_PER_SECOND

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Inbound packets with errorsZABBIX_PASSIVEnet.if.in["{ #IFNAME}",errors]

Preprocessing:

- CHANGE_PER_SECOND

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Outbound packets with errorsZABBIX_PASSIVEnet.if.out["{ #IFNAME}",errors]

Preprocessing:

- CHANGE_PER_SECOND

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): SpeedDEPENDENTnet.if.speed["{ #IFNAME}"]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #IFNAME}")].Speed.first()

⛔️ON_FAIL: CUSTOM_VALUE -> 0

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Interface typeDEPENDENTnet.if.type["{ #IFNAME}"]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #IFNAME}")].AdapterTypeId.first()

Network_interfacesInterface { #IFNAME}({ #IFALIAS}): Operational statusDEPENDENTnet.if.status["{ #IFNAME}"]

Preprocessing:

- JSONPATH: $[?(@.Name == "{ #IFNAME}")].NetConnectionStatus.first()

Zabbix_raw_itemsNetwork interfaces WMI get

-

ZABBIX_PASSIVEwmi.getall[root\cimv2,"select * from win32_networkadapter where PhysicalAdapter=True"]

Triggers

NameDescriptionExpressionSeverityDependencies and additional info
Interface { #IFNAME}({ #IFALIAS}): High bandwidth usage ( > {$IF.UTIL.MAX:"{ #IFNAME}"}% )

-

({TEMPLATE_NAME:net.if.in["{ #IFNAME}"].avg(15m)}>({$IF.UTIL.MAX:"{ #IFNAME}"}/100)*{Template Module Windows network by Zabbix agent:net.if.speed["{ #IFNAME}"].last()} or {Template Module Windows network by Zabbix agent:net.if.out["{ #IFNAME}"].avg(15m)}>({$IF.UTIL.MAX:"{ #IFNAME}"}/100)*{Template Module Windows network by Zabbix agent:net.if.speed["{ #IFNAME}"].last()}) and {Template Module Windows network by Zabbix agent:net.if.speed["{ #IFNAME}"].last()}>0

Recovery expression:

{TEMPLATE_NAME:net.if.in["{ #IFNAME}"].avg(15m)}<(({$IF.UTIL.MAX:"{ #IFNAME}"}-3)/100)*{Template Module Windows network by Zabbix agent:net.if.speed["{ #IFNAME}"].last()} and {Template Module Windows network by Zabbix agent:net.if.out["{ #IFNAME}"].avg(15m)}<(({$IF.UTIL.MAX:"{ #IFNAME}"}-3)/100)*{Template Module Windows network by Zabbix agent:net.if.speed["{ #IFNAME}"].last()}
WARNING

Manual close: YES

Depends on:

- Interface { #IFNAME}({ #IFALIAS}): Link down

Interface { #IFNAME}({ #IFALIAS}): High error rate ( > {$IF.ERRORS.WARN:"{ #IFNAME}"} for 5m)

Recovers when below 80% of {$IF.ERRORS.WARN:"{ #IFNAME}"} threshold

{TEMPLATE_NAME:net.if.in["{ #IFNAME}",errors].min(5m)}>{$IF.ERRORS.WARN:"{ #IFNAME}"} or {Template Module Windows network by Zabbix agent:net.if.out["{ #IFNAME}",errors].min(5m)}>{$IF.ERRORS.WARN:"{ #IFNAME}"}

Recovery expression:

{TEMPLATE_NAME:net.if.in["{ #IFNAME}",errors].max(5m)}<{$IF.ERRORS.WARN:"{ #IFNAME}"}*0.8 and {Template Module Windows network by Zabbix agent:net.if.out["{ #IFNAME}",errors].max(5m)}<{$IF.ERRORS.WARN:"{ #IFNAME}"}*0.8
WARNING

Manual close: YES

Depends on:

- Interface { #IFNAME}({ #IFALIAS}): Link down

Interface { #IFNAME}({ #IFALIAS}): Ethernet has changed to lower speed than it was before

This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.

{TEMPLATE_NAME:net.if.speed["{ #IFNAME}"].change()}<0 and {TEMPLATE_NAME:net.if.speed["{ #IFNAME}"].last()}>0 and ( {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=6 or {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=7 or {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=11 or {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=62 or {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=69 or {Template Module Windows network by Zabbix agent:net.if.type["{ #IFNAME}"].last()}=117 ) and ({Template Module Windows network by Zabbix agent:net.if.status["{ #IFNAME}"].last()}<>2)

Recovery expression:

({TEMPLATE_NAME:net.if.speed["{ #IFNAME}"].change()}>0 and {TEMPLATE_NAME:net.if.speed["{ #IFNAME}"].prev()}>0) or ({Template Module Windows network by Zabbix agent:net.if.status["{ #IFNAME}"].last()}=2)
INFO

Manual close: YES

Depends on:

- Interface { #IFNAME}({ #IFALIAS}): Link down

Interface { #IFNAME}({ #IFALIAS}): Link down

This trigger expression works as follows:

1. Can be triggered if operations status is down.

2. {$IFCONTROL:"{ #IFNAME}"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down.

3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status was up(1) sometime before. (So, do not fire 'ethernal off' interfaces.)

WARNING: if closed manually - won't fire again on next poll, because of .diff.

{$IFCONTROL:"{ #IFNAME}"}=1 and ({TEMPLATE_NAME:net.if.status["{ #IFNAME}"].last()}=2 and {TEMPLATE_NAME:net.if.status["{ #IFNAME}"].diff()}=1)

Recovery expression:

{TEMPLATE_NAME:net.if.status["{ #IFNAME}"].last()}<>2
AVERAGE

Manual close: YES

Feedback

Please report any issues with the template at https://support.zabbix.com

Template OS Windows by Zabbix agent

Overview

For Zabbix version: 4.4
New official Windows template. Requires agent of Zabbix 4.4 and newer.

This template was tested on:

  • Windows, version 7 and newer.
  • Windows Server, version 2008 R2 and newer.

Setup

Install Zabbix agent to Windows OS according to Zabbix documentation.

Zabbix configuration

No specific Zabbix configuration is required.

Template links

Name
Template Module Windows CPU by Zabbix agent
Template Module Windows filesystems by Zabbix agent
Template Module Windows generic by Zabbix agent
Template Module Windows memory by Zabbix agent
Template Module Windows network by Zabbix agent
Template Module Windows physical disks by Zabbix agent
Template Module Zabbix agent

Discovery rules

Items collected

GroupNameDescriptionTypeKey and additional info

Triggers

NameDescriptionExpressionSeverityDependencies and additional info

Feedback

Please report any issues with the template at https://support.zabbix.com

You can also provide feedback, discuss the template or ask for help with it at ZABBIX forums.

Add your solution