zabbix_export: version: '6.2' date: '2022-06-01T14:33:31Z' groups: - uuid: 846977d1dfed4968bc5f8bdb363285bc name: 'Templates/Operating systems' templates: - uuid: 5fdd2ca8b8f84962aaea5a218b46ea7d template: 'Windows by Zabbix agent active' name: 'Windows by Zabbix agent active' description: | Official Windows template. Requires agent of Zabbix 4.4 and newer. You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback/387224-discussion-thread-for-official-zabbix-template-for-windows Template tooling version used: 0.41 groups: - name: 'Templates/Operating systems' items: - uuid: 042ce35b908748c8bdd322f818c52c85 name: 'Host name of Zabbix agent running' type: ZABBIX_ACTIVE key: agent.hostname delay: 1h history: 7d trends: '0' value_type: CHAR preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: component value: system - uuid: bd8864ac5450401b9ad479c1ee455805 name: 'Zabbix agent ping' type: ZABBIX_ACTIVE key: agent.ping history: 7d description: 'The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.' valuemap: name: 'Zabbix agent ping status' tags: - tag: component value: system triggers: - uuid: e77c3b1849b64d45a3078794057a2582 expression: 'nodata(/Windows by Zabbix agent active/agent.ping,{$AGENT.NODATA_TIMEOUT})=1' name: 'Zabbix agent is not available' event_name: 'Zabbix agent is not available (or nodata for {$AGENT.NODATA_TIMEOUT})' priority: AVERAGE description: 'For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as time threshold.' manual_close: 'YES' tags: - tag: scope value: availability - uuid: 41cec8b443a94efc9ebca6f66c46ad8a name: 'Version of Zabbix agent running' type: ZABBIX_ACTIVE key: agent.version delay: 1h history: 7d trends: '0' value_type: CHAR preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: component value: application - uuid: 20dceb831b1a4d63af7635656239c495 name: 'Cache bytes' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Cache Bytes"]' history: 7d units: B description: | Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average. tags: - tag: component value: memory - uuid: 71bb18af403248c7818d16444a2eec06 name: 'Free system page table entries' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Free System Page Table Entries"]' history: 7d description: | This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may well be a memory leak or you running out of memory. tags: - tag: component value: memory triggers: - uuid: 37d6b965dd184b66b37018d4375d3e56 expression: 'max(/Windows by Zabbix agent active/perf_counter_en["\Memory\Free System Page Table Entries"],5m)<{$MEM.PAGE_TABLE_CRIT.MIN}' name: 'Number of free system page table entries is too low' event_name: 'Number of free system page table entries is too low (less {$MEM.PAGE_TABLE_CRIT.MIN} for 5m)' priority: WARNING description: 'The Memory Free System Page Table Entries is less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.' dependencies: - name: 'High memory utilization' expression: 'min(/Windows by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' tags: - tag: scope value: capacity - uuid: 19ec57305ba34ed890e2e4c8a500a214 name: 'Memory page faults per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Page Faults/sec"]' history: 7d value_type: FLOAT description: | Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays. tags: - tag: component value: memory - uuid: 920faa3a434d46d48f99395e16ef04ec name: 'Memory pages per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Pages/sec"]' history: 7d value_type: FLOAT description: | This measures the rate at which pages are read from or written to disk to resolve hard page faults. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. tags: - tag: component value: memory triggers: - uuid: 05da8b30835e440fb1228fb9a0bc24a4 expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\Memory\Pages/sec"],5m)>{$MEM.PAGE_SEC.CRIT.MAX}' name: 'The Memory Pages/sec is too high' event_name: 'The Memory Pages/sec is too high (over {$MEM.PAGE_SEC.CRIT.MAX} for 5m)' priority: WARNING description: 'The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.' dependencies: - name: 'High memory utilization' expression: 'min(/Windows by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' tags: - tag: scope value: capacity - uuid: 3af0a0717da747849c2b5a2ebfa61a2c name: 'Memory pool non-paged' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Pool Nonpaged Bytes"]' history: 7d units: B description: | This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated. There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). A typical Event ID 2019 is recorded in the system event log. tags: - tag: component value: memory - uuid: 4f7b86eff6c84193a2f9187fff578416 name: 'Used swap space in %' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Paging file(_Total)\% Usage"]' history: 7d value_type: FLOAT units: '%' description: 'The used space of swap volume/file in percent.' tags: - tag: component value: memory - tag: component value: storage - uuid: 553249b52ca7492c87386d051ec53db9 name: 'CPU DPC time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% DPC Time"]' history: 7d value_type: FLOAT units: '%' description: | Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance. tags: - tag: component value: cpu - uuid: 32a32b9fea5d49989668a96bc52db87b name: 'CPU interrupt time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. This is an easy way to identify a potential hardware failure. This should never be higher than 20%. tags: - tag: component value: cpu triggers: - uuid: 2eb661f6a42f40ce8cc25cef542763a9 expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}' name: 'CPU interrupt time is too high' event_name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)' priority: WARNING description: | "The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%." The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. This is an easy way to identify a potential hardware failure. This should never be higher than 20%. dependencies: - name: 'High CPU utilization' expression: 'min(/Windows by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' tags: - tag: scope value: performance - uuid: 0747e92e52cc4a6a9b83c6f94889bff1 name: 'CPU privileged time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows® Operating System. tags: - tag: component value: cpu triggers: - uuid: cee69c70da6a415186b922305d0cabdc expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Privileged Time"],5m)>{$CPU.PRIV.CRIT.MAX}' name: 'CPU privileged time is too high' event_name: 'CPU privileged time is too high (over {$CPU.PRIV.CRIT.MAX}% for 5m)' priority: WARNING description: 'The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.' dependencies: - name: 'CPU interrupt time is too high' expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}' - name: 'High CPU utilization' expression: 'min(/Windows by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' tags: - tag: scope value: performance - uuid: 954a81efad4c4791bee052194b900268 name: 'CPU user time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% User Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing in User mode. tags: - tag: component value: cpu - uuid: f23957a6fb9a44a3a7010b19b16e77b5 name: 'Context switches per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Context Switches/sec"]' history: 7d value_type: FLOAT description: | Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service. It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches. There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. tags: - tag: component value: cpu - uuid: c1da358e5c8f40279c703d93896aa571 name: 'CPU queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Processor Queue Length"]' history: 7d value_type: FLOAT description: | The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed. tags: - tag: component value: cpu - uuid: c738b97ec0dc49f380ed0e4a27ae9bb6 name: 'Number of threads' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Threads"]' history: 7d description: 'The number of threads used by all running processes.' tags: - tag: component value: os - uuid: 5229689338ae4a559d3c94a98032131e name: 'Number of processes' type: ZABBIX_ACTIVE key: 'proc.num[]' history: 7d description: 'The number of processes.' tags: - tag: component value: os - uuid: 0f3ffe45092d461a91a1296cd6cfb19f name: 'CPU utilization' type: ZABBIX_ACTIVE key: system.cpu.util history: 7d value_type: FLOAT units: '%' description: 'CPU utilization in %.' tags: - tag: component value: cpu triggers: - uuid: ab3cbf18088a4d7a82f6c678ce49ffce expression: 'min(/Windows by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' name: 'High CPU utilization' event_name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)' opdata: 'Current utilization: {ITEM.LASTVALUE1}' priority: WARNING description: 'CPU utilization is too high. The system might be slow to respond.' tags: - tag: scope value: performance - uuid: 5d99b356e30444a0b99e597506f35a69 name: 'System name' type: ZABBIX_ACTIVE key: system.hostname delay: 1h history: 2w trends: '0' value_type: CHAR description: 'System host name.' inventory_link: NAME preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: component value: system triggers: - uuid: 3aea75603e584d2f9dc96e7f3cc2b7fa expression: 'last(/Windows by Zabbix agent active/system.hostname,#1)<>last(/Windows by Zabbix agent active/system.hostname,#2) and length(last(/Windows by Zabbix agent active/system.hostname))>0' name: 'System name has changed' event_name: 'System name has changed (new name: {ITEM.VALUE})' priority: INFO description: 'System name has changed. Ack to close.' manual_close: 'YES' tags: - tag: scope value: notice - uuid: 89f928affba54c4a8dc7abead09cac68 name: 'System local time' type: ZABBIX_ACTIVE key: system.localtime history: 7d units: unixtime description: 'System local time of the host.' tags: - tag: component value: system triggers: - uuid: c5c52f75d4214a68b095e8bf55a6a934 expression: 'fuzzytime(/Windows by Zabbix agent active/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0' name: 'System time is out of sync' event_name: 'System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s)' priority: WARNING description: 'The host system time is different from the Zabbix server time.' manual_close: 'YES' tags: - tag: scope value: notice - uuid: 16a7ae509f0c4f9d8631efae88fe6324 name: 'Operating system architecture' type: ZABBIX_ACTIVE key: system.sw.arch delay: 1h history: 2w trends: '0' value_type: CHAR description: 'Operating system architecture of the host.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: component value: os - uuid: 9d6f14cc540846ab98052bf741a4247b name: 'Free swap space' type: CALCULATED key: system.swap.free history: 7d units: B params: 'last(//system.swap.size[,total]) - last(//system.swap.size[,total]) / 100 * last(//perf_counter_en["\Paging file(_Total)\% Usage"])' description: 'The free space of swap volume/file in bytes.' tags: - tag: component value: memory - tag: component value: storage - uuid: e91b5f08c6b745bca975797ea4abd02a name: 'Free swap space in %' type: DEPENDENT key: system.swap.pfree delay: '0' history: 7d value_type: FLOAT units: '%' description: 'The free space of swap volume/file in percent.' preprocessing: - type: JAVASCRIPT parameters: - 'return (100 - value)' master_item: key: 'perf_counter_en["\Paging file(_Total)\% Usage"]' tags: - tag: component value: memory - tag: component value: storage - uuid: b5af29f7b8ee451895b49c0444e929f4 name: 'Total swap space' type: ZABBIX_ACTIVE key: 'system.swap.size[,total]' history: 7d units: B description: 'The total space of swap volume/file in bytes.' tags: - tag: component value: memory - tag: component value: storage - uuid: 8fa1259420ad486ab6e2520c9b047073 name: 'System description' type: ZABBIX_ACTIVE key: system.uname delay: 15m history: 2w trends: '0' value_type: CHAR description: 'System description of the host.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: component value: system - uuid: 695053710ea14cc48692b5cb260d0dfb name: Uptime type: ZABBIX_ACTIVE key: system.uptime delay: 30s history: 2w trends: 0d units: uptime description: 'System uptime in ''N days, hh:mm:ss'' format.' tags: - tag: component value: system triggers: - uuid: 4114e248a3b347f4a2fefc7816f2e940 expression: 'last(/Windows by Zabbix agent active/system.uptime)<10m' name: 'Host has been restarted' event_name: 'Host has been restarted (uptime < 10m)' priority: WARNING description: 'The device uptime is less than 10 minutes.' manual_close: 'YES' tags: - tag: scope value: notice - uuid: 83185781999742268a7742695c5d3ee3 name: 'Total memory' type: ZABBIX_ACTIVE key: 'vm.memory.size[total]' history: 7d units: B description: 'Total memory in Bytes.' tags: - tag: component value: memory - uuid: f85ec8917f084c7d9b6bc36e186d74d6 name: 'Used memory' type: ZABBIX_ACTIVE key: 'vm.memory.size[used]' history: 7d units: B description: 'Used memory in Bytes.' tags: - tag: component value: memory - uuid: 9b62965a4670472b8c672dc1021bb8fd name: 'Memory utilization' type: CALCULATED key: vm.memory.util history: 7d value_type: FLOAT units: '%' params: 'last(//vm.memory.size[used]) / last(//vm.memory.size[total]) * 100' description: 'Memory utilization in %.' tags: - tag: component value: memory triggers: - uuid: 610a0893be834c11b35a0472dcabab7c expression: 'min(/Windows by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' name: 'High memory utilization' event_name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)' priority: AVERAGE description: 'The system is running out of free memory.' tags: - tag: scope value: capacity - tag: scope value: performance - uuid: c35940d1a12e4b96b7114ac8dbbfcec4 name: 'Network interfaces WMI get' type: ZABBIX_ACTIVE key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' history: '0' trends: '0' value_type: TEXT description: 'Raw data of win32_networkadapter.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h tags: - tag: component value: raw - uuid: 3dcf69f6637f496ca0406e0ed403f03c name: 'Number of cores' type: ZABBIX_ACTIVE key: 'wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]' history: 7d description: 'The number of logical processors available on the computer.' tags: - tag: component value: cpu - uuid: 3c1068939adf4d998a942dcb6be23656 name: 'Active agent availability' type: INTERNAL key: 'zabbix[host,active_agent,available]' history: 7d description: | Availability of active checks on the host. The value of this item corresponds to availability icons in the host list. Possible value: 0 - unknown 1 - available 2 - not available valuemap: name: zabbix.host.active_agent.available tags: - tag: component value: health - tag: component value: network triggers: - uuid: ce4a95a80cc54353ab0e0d2ae6312930 expression: 'min(/Windows by Zabbix agent active/zabbix[host,active_agent,available],{$AGENT.TIMEOUT})=2' name: 'Zabbix agent: active checks are not available' opdata: 'Current state: {ITEM.LASTVALUE1}' priority: HIGH description: 'Active checks are considered unavailable. Agent is not sending heartbeat for prolonged time.' tags: - tag: scope value: availability discovery_rules: - uuid: c05c8d1be5614ffab1688cc92db32f12 name: 'Network interfaces discovery' type: DEPENDENT key: net.if.discovery delay: '0' filter: evaltype: AND conditions: - macro: '{#IFNAME}' value: '{$NET.IF.IFNAME.MATCHES}' formulaid: E - macro: '{#IFNAME}' value: '{$NET.IF.IFNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: F - macro: '{#IFDESCR}' value: '{$NET.IF.IFDESCR.MATCHES}' formulaid: C - macro: '{#IFDESCR}' value: '{$NET.IF.IFDESCR.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D - macro: '{#IFALIAS}' value: '{$NET.IF.IFALIAS.MATCHES}' formulaid: A - macro: '{#IFALIAS}' value: '{$NET.IF.IFALIAS.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of installed network interfaces.' item_prototypes: - uuid: 344f0ce5ba5244cb90cc08db556e6f9c name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}",dropped]' delay: 3m history: 7d description: 'The number of incoming packets dropped on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: a2461163f9b44b678008e3d5fd96a168 name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}",errors]' delay: 3m history: 7d description: 'The number of incoming packets with errors on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: a8f69dac86d646b194f9b204f22aeb3b name: 'Interface {#IFNAME}({#IFALIAS}): Bits received' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}"]' delay: 3m history: 7d units: bps description: 'Incoming traffic on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' - type: MULTIPLIER parameters: - '8' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: 46d947876b844223bb500f29cbf82273 name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}",dropped]' delay: 3m history: 7d description: 'The number of outgoing packets dropped on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: 1f5854d4ad5d4b65b63e5ca9ffa5007c name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}",errors]' delay: 3m history: 7d description: 'The number of outgoing packets with errors on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: 1adceed263804e089108bb2cc1aa51e1 name: 'Interface {#IFNAME}({#IFALIAS}): Bits sent' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}"]' delay: 3m history: 7d units: bps description: 'Outgoing traffic on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' - type: MULTIPLIER parameters: - '8' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: 820ca9809e6f46af8aa3f41195f246d9 name: 'Interface {#IFNAME}({#IFALIAS}): Speed' type: DEPENDENT key: 'net.if.speed["{#IFGUID}"]' delay: '0' history: 7d trends: 0d units: bps description: 'Estimated bandwidth of the network interface if any.' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].Speed.first()' error_handler: CUSTOM_VALUE error_handler_params: '0' - type: JAVASCRIPT parameters: - 'return (value==''9223372036854775807'' ? 0 : value)' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' - uuid: 929917f16ecd4369a5535fe8178248d6 name: 'Interface {#IFNAME}({#IFALIAS}): Operational status' type: DEPENDENT key: 'net.if.status["{#IFGUID}"]' delay: '0' history: 7d trends: '0' description: 'The operational status of the network interface.' valuemap: name: 'Win32_NetworkAdapter::NetConnectionStatus' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' trigger_prototypes: - uuid: f9d1ac2feb0e43249cc849166ca9014c expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_mode: RECOVERY_EXPRESSION recovery_expression: 'last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' name: 'Interface {#IFNAME}({#IFALIAS}): Link down' opdata: 'Current state: {ITEM.LASTVALUE1}' priority: AVERAGE description: | This trigger expression works as follows: 1. Can be triggered if operations status is down. 2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2). WARNING: if closed manually - won't fire again on next poll, because of .diff. manual_close: 'YES' tags: - tag: scope value: availability - uuid: 1e513ffd8cd24a39a04b2140dce65b62 name: 'Interface {#IFNAME}({#IFALIAS}): Interface type' type: DEPENDENT key: 'net.if.type["{#IFGUID}"]' delay: '0' history: 7d trends: 0d description: 'The type of the network interface.' valuemap: name: 'Win32_NetworkAdapter::AdapterTypeId' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: component value: network - tag: description value: '{#IFALIAS}' - tag: interface value: '{#IFNAME}' trigger_prototypes: - uuid: 27a60f88cbd0457291153105ace75e4d expression: | change(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"])<0 and last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"])>0 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])=2 name: 'Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before' opdata: 'Current reported speed: {ITEM.LASTVALUE1}' priority: INFO description: 'This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' tags: - tag: scope value: capacity - uuid: a9ead42a45f5496a84a6a2bc619cece4 expression: | (avg(/Windows by Zabbix agent active/net.if.in["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"]) or avg(/Windows by Zabbix agent active/net.if.out["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"])) and last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"])>0 recovery_mode: RECOVERY_EXPRESSION recovery_expression: | avg(/Windows by Zabbix agent active/net.if.in["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"]) and avg(/Windows by Zabbix agent active/net.if.out["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows by Zabbix agent active/net.if.speed["{#IFGUID}"]) name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage' event_name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%)' opdata: 'In: {ITEM.LASTVALUE1}, out: {ITEM.LASTVALUE3}, speed: {ITEM.LASTVALUE2}' priority: WARNING description: 'The network interface utilization is close to its estimated maximum bandwidth.' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' tags: - tag: scope value: performance - uuid: 1945fd9bc15c471fb050d0a5430245a6 expression: | min(/Windows by Zabbix agent active/net.if.in["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Windows by Zabbix agent active/net.if.out["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} recovery_mode: RECOVERY_EXPRESSION recovery_expression: | max(/Windows by Zabbix agent active/net.if.in["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 and max(/Windows by Zabbix agent active/net.if.out["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 name: 'Interface {#IFNAME}({#IFALIAS}): High error rate' event_name: 'Interface {#IFNAME}({#IFALIAS}): High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m)' opdata: 'errors in: {ITEM.LASTVALUE1}, errors out: {ITEM.LASTVALUE2}' priority: WARNING description: 'Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' tags: - tag: scope value: availability graph_prototypes: - uuid: 1181f5ffedb643d4953c9fd5df14a21e name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'net.if.in["{#IFGUID}"]' - sortorder: '1' drawtype: BOLD_LINE color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'net.if.out["{#IFGUID}"]' - sortorder: '2' color: F63100 yaxisside: RIGHT item: host: 'Windows by Zabbix agent active' key: 'net.if.out["{#IFGUID}",errors]' - sortorder: '3' color: A54F10 yaxisside: RIGHT item: host: 'Windows by Zabbix agent active' key: 'net.if.in["{#IFGUID}",errors]' - sortorder: '4' color: FC6EA3 yaxisside: RIGHT item: host: 'Windows by Zabbix agent active' key: 'net.if.out["{#IFGUID}",dropped]' - sortorder: '5' color: 6C59DC yaxisside: RIGHT item: host: 'Windows by Zabbix agent active' key: 'net.if.in["{#IFGUID}",dropped]' master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' preprocessing: - type: JAVASCRIPT parameters: - | output = JSON.parse(value).map(function(net){ return { "{#IFNAME}": net.Name, "{#IFDESCR}": net.Description, "{#IFALIAS}": net.NetConnectionID, "{#IFGUID}": net.GUID }}) return JSON.stringify({"data": output}) - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h - uuid: b2a9c04e3e0846ab89d5dbc39d273567 name: 'Physical disks discovery' type: ZABBIX_ACTIVE key: 'perf_instance_en.discovery[PhysicalDisk]' delay: 1h filter: evaltype: AND conditions: - macro: '{#DEVNAME}' value: '{$VFS.DEV.DEVNAME.MATCHES}' formulaid: A - macro: '{#DEVNAME}' value: '{$VFS.DEV.DEVNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of installed physical disks.' item_prototypes: - uuid: 714bbd069d34400895df413fe4627543 name: '{#DEVNAME}: Disk utilization by idle time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]' history: 7d value_type: FLOAT units: '%' description: 'This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.' preprocessing: - type: JAVASCRIPT parameters: - 'return (100 - value)' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' trigger_prototypes: - uuid: 00031ae791d6424dbd29c91be91a249f expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60],15m)>{$VFS.DEV.UTIL.MAX.WARN}' name: '{#DEVNAME}: Disk is overloaded' event_name: '{#DEVNAME}: Disk is overloaded (util > {$VFS.DEV.UTIL.MAX.WARN}% for 15m)' priority: WARNING description: 'The disk appears to be under heavy load' manual_close: 'YES' dependencies: - name: '{#DEVNAME}: Disk read request responses are too high' expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}' - name: '{#DEVNAME}: Disk write request responses are too high' expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}' tags: - tag: scope value: performance - uuid: abdcdffc92114fda93d4893c772cf14a name: '{#DEVNAME}: Average disk read queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]' history: 7d value_type: FLOAT description: 'Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' - uuid: 208b3a3868844e85a7e3e5f3940d744d name: '{#DEVNAME}: Disk read request avg waiting time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]' history: 7d value_type: FLOAT units: s description: 'The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' trigger_prototypes: - uuid: f6c28fa8eef542a786b29d745dd2e56f expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}' name: '{#DEVNAME}: Disk read request responses are too high' event_name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m' priority: WARNING description: 'This trigger might indicate disk {#DEVNAME} saturation.' manual_close: 'YES' tags: - tag: scope value: performance - uuid: 6a162aca790c48a7bd726d54494d67e9 name: '{#DEVNAME}: Disk write request avg waiting time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]' history: 7d value_type: FLOAT units: s description: 'The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' trigger_prototypes: - uuid: 9a0c7aa60e0e40d8abec9be6d6d49190 expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}' name: '{#DEVNAME}: Disk write request responses are too high' event_name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)' priority: WARNING description: 'This trigger might indicate disk {#DEVNAME} saturation.' manual_close: 'YES' tags: - tag: scope value: performance - uuid: ba3a369741544f6c88a476a4f2d30ab2 name: '{#DEVNAME}: Average disk write queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]' history: 7d value_type: FLOAT description: 'Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' - uuid: 24d15f53439148919e11d5811f25adf1 name: '{#DEVNAME}: Disk average queue size (avgqu-sz)' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]' history: 7d value_type: FLOAT description: 'Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' - uuid: c1424c1c2fe647a8baf3357c34ae261e name: '{#DEVNAME}: Disk read rate' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]' history: 7d value_type: FLOAT units: '!r/s' description: 'Rate of read operations on the disk.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' - uuid: 4d10e563bbd1402daa1c9c8516095aa8 name: '{#DEVNAME}: Disk write rate' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]' history: 7d value_type: FLOAT units: '!w/s' description: 'Rate of write operations on the disk.' tags: - tag: component value: storage - tag: disk value: '{#DEVNAME}' graph_prototypes: - uuid: e249ca7462a14508bdbdbf748102015a name: '{#DEVNAME}: Disk average queue length' graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]' - sortorder: '1' color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]' - uuid: 790265fa66e14e97badadfce392ef8df name: '{#DEVNAME}: Disk average waiting time' graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]' - uuid: 024945537eab4facb18483b6f3ce8d3e name: '{#DEVNAME}: Disk read/write rates' graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]' - uuid: 70de55df5604410d8a67cdca31957b03 name: '{#DEVNAME}: Disk utilization and queue' graph_items: - color: 1A7C11 yaxisside: RIGHT item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]' preprocessing: - type: STR_REPLACE parameters: - '{#INSTANCE}' - '{#DEVNAME}' - uuid: dbde6e6c7c13436b9bd20230f1d309ed name: 'Windows services discovery' type: ZABBIX_ACTIVE key: service.discovery delay: 1h filter: evaltype: AND conditions: - macro: '{#SERVICE.NAME}' value: '{$SERVICE.NAME.MATCHES}' formulaid: A - macro: '{#SERVICE.NAME}' value: '{$SERVICE.NAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B - macro: '{#SERVICE.STARTUPNAME}' value: '{$SERVICE.STARTUPNAME.MATCHES}' formulaid: C - macro: '{#SERVICE.STARTUPNAME}' value: '{$SERVICE.STARTUPNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D description: 'Discovery of Windows services of different types as defined in template''s macros.' item_prototypes: - uuid: d6379e85f1974734abbe60fef1a6ca1d name: 'State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})' type: ZABBIX_ACTIVE key: 'service.info["{#SERVICE.NAME}",state]' history: 7d valuemap: name: 'Windows service state' tags: - tag: component value: system - tag: name value: '{#SERVICE.DISPLAYNAME}' - tag: service value: '{#SERVICE.NAME}' trigger_prototypes: - uuid: c6f2c1c32cdf401091e4439624a24fab expression: 'min(/Windows by Zabbix agent active/service.info["{#SERVICE.NAME}",state],#3)<>0' name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running' event_name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME})' priority: AVERAGE description: 'The service has a state other than "Running" for the last three times.' tags: - tag: scope value: notice - uuid: 4fbbdf83609e48e68011f6c394c652f9 name: 'Mounted filesystem discovery' type: ZABBIX_ACTIVE key: vfs.fs.discovery delay: 1h filter: evaltype: AND conditions: - macro: '{#FSTYPE}' value: '{$VFS.FS.FSTYPE.MATCHES}' formulaid: E - macro: '{#FSTYPE}' value: '{$VFS.FS.FSTYPE.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: F - macro: '{#FSNAME}' value: '{$VFS.FS.FSNAME.MATCHES}' formulaid: C - macro: '{#FSNAME}' value: '{$VFS.FS.FSNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D - macro: '{#FSDRIVETYPE}' value: '{$VFS.FS.FSDRIVETYPE.MATCHES}' formulaid: A - macro: '{#FSDRIVETYPE}' value: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of file systems of different types.' item_prototypes: - uuid: 8949201f93ab46f0a0ad95ca6ce6124c name: '{#FSLABEL}({#FSNAME}): Space utilization' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},pused]' history: 7d value_type: FLOAT units: '%' description: 'Space utilization in % for {#FSNAME}' tags: - tag: component value: storage - tag: filesystem value: '{#FSNAME}' - uuid: d45f2c3469dd424486bdee586e4a61eb name: '{#FSLABEL}({#FSNAME}): Total space' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},total]' history: 7d units: B description: 'Total space in Bytes' tags: - tag: component value: storage - tag: filesystem value: '{#FSNAME}' - uuid: ddd24d7eaa5742ac9d6cbae42bcfa1ae name: '{#FSLABEL}({#FSNAME}): Used space' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},used]' history: 7d units: B description: 'Used storage in Bytes' tags: - tag: component value: storage - tag: filesystem value: '{#FSNAME}' trigger_prototypes: - uuid: 5bed682545044584852888d96454df86 expression: | last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) name: '{#FSLABEL}({#FSNAME}): Disk space is critically low' event_name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)' opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})' priority: AVERAGE description: | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}. - The disk will be full in less than 24 hours. manual_close: 'YES' tags: - tag: scope value: capacity - uuid: 1e5e9718c5a14099b9421ff7956b2f33 expression: | last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and ((last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) name: '{#FSLABEL}({#FSNAME}): Disk space is low' event_name: '{#FSLABEL}({#FSNAME}): Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%)' opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})' priority: WARNING description: | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}. - The disk will be full in less than 24 hours. manual_close: 'YES' dependencies: - name: '{#FSLABEL}({#FSNAME}): Disk space is critically low' expression: | last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) tags: - tag: scope value: capacity graph_prototypes: - uuid: 8d0581d07b92406aa9f007f6d03ad24e name: '{#FSLABEL}({#FSNAME}): Disk space usage' width: '600' height: '340' type: PIE show_3d: 'YES' graph_items: - color: '969696' calc_fnc: LAST type: GRAPH_SUM item: host: 'Windows by Zabbix agent active' key: 'vfs.fs.size[{#FSNAME},total]' - sortorder: '1' color: C80000 calc_fnc: LAST item: host: 'Windows by Zabbix agent active' key: 'vfs.fs.size[{#FSNAME},used]' tags: - tag: class value: os - tag: target value: windows macros: - macro: '{$AGENT.NODATA_TIMEOUT}' value: 30m description: 'No data timeout for active agents. Consider to keep it relatively high.' - macro: '{$AGENT.TIMEOUT}' value: 5m description: 'Timeout after which agent is considered unavailable.' - macro: '{$CPU.INTERRUPT.CRIT.MAX}' value: '50' description: 'The critical threshold of the % Interrupt Time counter.' - macro: '{$CPU.PRIV.CRIT.MAX}' value: '30' description: 'The threshold of the % Privileged Time counter.' - macro: '{$CPU.QUEUE.CRIT.MAX}' value: '3' description: 'The threshold of the Processor Queue Length counter.' - macro: '{$CPU.UTIL.CRIT}' value: '90' description: 'The critical threshold of the CPU utilization in %.' - macro: '{$IF.ERRORS.WARN}' value: '2' - macro: '{$IF.UTIL.MAX}' value: '90' - macro: '{$IFCONTROL}' value: '1' - macro: '{$MEM.PAGE_SEC.CRIT.MAX}' value: '1000' description: 'The warning threshold of the Memory Pages/sec counter.' - macro: '{$MEM.PAGE_TABLE_CRIT.MIN}' value: '5000' description: 'The warning threshold of the Free System Page Table Entries counter.' - macro: '{$MEMORY.UTIL.MAX}' value: '90' description: 'The warning threshold of the Memory util item.' - macro: '{$NET.IF.IFALIAS.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFALIAS.NOT_MATCHES}' value: CHANGE_THIS description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFDESCR.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFDESCR.NOT_MATCHES}' value: CHANGE_THIS description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFNAME.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFNAME.NOT_MATCHES}' value: Miniport|Virtual|Teredo|Kernel|Loopback|Bluetooth|HTTPS|6to4|QoS|Layer description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.NAME.MATCHES}' value: '^.*$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.NAME.NOT_MATCHES}' value: '^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc|wuauserv)$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.STARTUPNAME.MATCHES}' value: '^(?:automatic|automatic delayed)$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.STARTUPNAME.NOT_MATCHES}' value: '^(?:manual|disabled)$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SWAP.PFREE.MIN.WARN}' value: '20' description: 'The warning threshold of the minimum free swap.' - macro: '{$SYSTEM.FUZZYTIME.MAX}' value: '60' description: 'The threshold for difference of system time in seconds.' - macro: '{$VFS.DEV.DEVNAME.MATCHES}' value: '.*' description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.DEV.DEVNAME.NOT_MATCHES}' value: _Total description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.DEV.READ.AWAIT.WARN}' value: '0.02' description: 'Disk read average response time (in s) before the trigger would fire.' - macro: '{$VFS.DEV.UTIL.MAX.WARN}' value: '95' description: 'The warning threshold of disk time utilization in percent.' - macro: '{$VFS.DEV.WRITE.AWAIT.WARN}' value: '0.02' description: 'Disk write average response time (in s) before the trigger would fire.' - macro: '{$VFS.FS.FREE.MIN.CRIT}' value: 5G description: 'The critical threshold of the filesystem utilization.' - macro: '{$VFS.FS.FREE.MIN.WARN}' value: 10G description: 'The warning threshold of the filesystem utilization.' - macro: '{$VFS.FS.FSDRIVETYPE.MATCHES}' value: fixed description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}' value: ^\s$ description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSNAME.MATCHES}' value: '.*' description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSNAME.NOT_MATCHES}' value: '^(?:/dev|/sys|/run|/proc|.+/shm$)' description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSTYPE.MATCHES}' value: '.*' description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSTYPE.NOT_MATCHES}' value: ^\s$ description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.PUSED.MAX.CRIT}' value: '90' description: 'The critical threshold of the filesystem utilization in percent.' - macro: '{$VFS.FS.PUSED.MAX.WARN}' value: '80' description: 'The warning threshold of the filesystem utilization in percent.' dashboards: - uuid: 59033ebe1b084a86b820fc59049db125 name: 'Network interfaces' pages: - widgets: - type: GRAPH_PROTOTYPE width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' host: 'Windows by Zabbix agent active' - uuid: 234161507ccb4d83b111cb31e0db8ae5 name: 'System performance' pages: - widgets: - type: GRAPH_CLASSIC width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'CPU usage' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC x: '12' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '1' - type: ITEM name: itemid value: key: 'perf_counter_en["\System\Processor Queue Length"]' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC 'y': '5' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'Memory utilization' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC x: '12' 'y': '5' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'Swap usage' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '10' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#FSLABEL}({#FSNAME}): Disk space usage' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '15' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#DEVNAME}: Disk read/write rates' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '20' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#DEVNAME}: Disk utilization and queue' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '25' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' host: 'Windows by Zabbix agent active' valuemaps: - uuid: 224ca38281f04c83844763251505cdce name: 'Win32_NetworkAdapter::AdapterTypeId' mappings: - value: '0' newvalue: 'Ethernet 802.3' - value: '1' newvalue: 'Token Ring 802.5' - value: '2' newvalue: 'Fiber Distributed Data Interface (FDDI)' - value: '3' newvalue: 'Wide Area Network (WAN)' - value: '4' newvalue: LocalTalk - value: '5' newvalue: 'Ethernet using DIX header format' - value: '6' newvalue: ARCNET - value: '7' newvalue: 'ARCNET (878.2)' - value: '8' newvalue: ATM - value: '9' newvalue: Wireless - value: '10' newvalue: 'Infrared Wireless' - value: '11' newvalue: Bpc - value: '12' newvalue: CoWan - value: '13' newvalue: '1394' - uuid: 850e339a24de4ef6a0a881dc57bfa3a6 name: 'Win32_NetworkAdapter::NetConnectionStatus' mappings: - value: '0' newvalue: Disconnected - value: '1' newvalue: Connecting - value: '2' newvalue: Connected - value: '3' newvalue: Disconnecting - value: '4' newvalue: 'Hardware Not Present' - value: '5' newvalue: 'Hardware Disabled' - value: '6' newvalue: 'Hardware Malfunction' - value: '7' newvalue: 'Media Disconnected' - value: '8' newvalue: Authenticating - value: '9' newvalue: 'Authentication Succeeded' - value: '10' newvalue: 'Authentication Failed' - value: '11' newvalue: 'Invalid Address' - value: '12' newvalue: 'Credentials Required' - uuid: e29ffb786c21406aa2338e3d35b484ef name: 'Windows service state' mappings: - value: '0' newvalue: Running - value: '1' newvalue: Paused - value: '2' newvalue: 'Start pending' - value: '3' newvalue: 'Pause pending' - value: '4' newvalue: 'Continue pending' - value: '5' newvalue: 'Stop pending' - value: '6' newvalue: Stopped - value: '7' newvalue: Unknown - value: '255' newvalue: 'No such service' - uuid: 6e7949c77d3442849778ff80271211df name: zabbix.host.active_agent.available mappings: - value: '0' newvalue: unknown - value: '1' newvalue: available - value: '2' newvalue: 'not available' - uuid: 9c0c0eb0ed7e495b9d4d487df7af0acd name: zabbix.host.available mappings: - value: '0' newvalue: 'not available' - value: '1' newvalue: available - value: '2' newvalue: unknown - uuid: c8fa75d469d74d2e97b9f410d219ef61 name: 'Zabbix agent ping status' mappings: - value: '1' newvalue: Up triggers: - uuid: 384393bb344e497382ea10e7fce7fcb3 expression: 'min(/Windows by Zabbix agent active/perf_counter_en["\System\Processor Queue Length"],5m) - last(/Windows by Zabbix agent active/wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]) * 2 > {$CPU.QUEUE.CRIT.MAX}' name: 'CPU queue length is too high' event_name: 'CPU queue length is too high (over {$CPU.QUEUE.CRIT.MAX} for 5m)' priority: WARNING description: 'The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.' dependencies: - name: 'High CPU utilization' expression: 'min(/Windows by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' tags: - tag: scope value: performance - uuid: ac93631f79584e2d9909f4bb2f12c866 expression: 'min(/Windows by Zabbix agent active/system.swap.pfree,5m)<{$SWAP.PFREE.MIN.WARN} and last(/Windows by Zabbix agent active/system.swap.size[,total])>0' name: 'High swap space usage' event_name: 'High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free)' opdata: 'Free: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}' priority: WARNING description: 'This trigger is ignored, if there is no swap configured' dependencies: - name: 'High memory utilization' expression: 'min(/Windows by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' tags: - tag: scope value: performance graphs: - uuid: 133a9930f45b448abbf35fe3a00d10c6 name: 'CPU jumps' graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\System\Context Switches/sec"]' - sortorder: '1' color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]' - uuid: 2a650f6de7804835a9a02db021649fca name: 'CPU usage' type: STACKED ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% User Time"]' - sortorder: '1' color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]' - uuid: 0865f60b2cd845aea2f2daad93c3bf83 name: 'CPU utilization' ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: system.cpu.util - uuid: f09c95d4637140c89a7b43165906db96 name: 'Memory utilization' ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: vm.memory.util - uuid: 441075d89a7045c283a7da9dd74e2a1b name: 'Swap usage' graph_items: - color: 1A7C11 item: host: 'Windows by Zabbix agent active' key: system.swap.free - sortorder: '1' color: 2774A4 item: host: 'Windows by Zabbix agent active' key: 'system.swap.size[,total]'