zabbix_export: version: '6.0' date: '2021-10-27T15:33:54Z' groups: - uuid: 57b7ae836ca64446ba2c296389c009b7 name: Templates/Modules - uuid: 846977d1dfed4968bc5f8bdb363285bc name: 'Templates/Operating systems' templates: - uuid: 5fdd2ca8b8f84962aaea5a218b46ea7d template: 'Windows by Zabbix agent active' name: 'Windows by Zabbix agent active' description: | Official Windows template. Requires agent of Zabbix 4.4 and newer. You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback/387224-discussion-thread-for-official-zabbix-template-for-windows Template tooling version used: 0.39 templates: - name: 'Windows CPU by Zabbix agent active' - name: 'Windows filesystems by Zabbix agent active' - name: 'Windows generic by Zabbix agent active' - name: 'Windows memory by Zabbix agent active' - name: 'Windows network by Zabbix agent active' - name: 'Windows physical disks by Zabbix agent active' - name: 'Windows services by Zabbix agent active' - name: 'Zabbix agent active' groups: - name: 'Templates/Operating systems' dashboards: - uuid: 234161507ccb4d83b111cb31e0db8ae5 name: 'System performance' pages: - widgets: - type: GRAPH_CLASSIC width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'CPU usage' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC x: '12' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '1' - type: ITEM name: itemid value: key: 'perf_counter_en["\System\Processor Queue Length"]' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC 'y': '5' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'Memory utilization' host: 'Windows by Zabbix agent active' - type: GRAPH_CLASSIC x: '12' 'y': '5' width: '12' height: '5' fields: - type: INTEGER name: source_type value: '0' - type: GRAPH name: graphid value: name: 'Swap usage' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '10' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#FSLABEL}({#FSNAME}): Disk space usage' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '15' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#DEVNAME}: Disk read/write rates' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '20' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: '{#DEVNAME}: Disk utilization and queue' host: 'Windows by Zabbix agent active' - type: GRAPH_PROTOTYPE 'y': '25' width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' host: 'Windows by Zabbix agent active' - uuid: 296cb27ad93b4063b77aaf1a8339d40c template: 'Windows CPU by Zabbix agent active' name: 'Windows CPU by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules items: - uuid: 94cedfa2390f4e509456222a69207023 name: 'CPU DPC time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% DPC Time"]' history: 7d value_type: FLOAT units: '%' description: | Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance. tags: - tag: Application value: CPU - uuid: 9c3ee1744a604a41b90dcec49effaff7 name: 'CPU interrupt time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. This is an easy way to identify a potential hardware failure. This should never be higher than 20%. tags: - tag: Application value: CPU triggers: - uuid: cbcd8d6c2eab4f18be5a40c2128e1b76 expression: 'min(/Windows CPU by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}' name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)' priority: WARNING description: | "The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%." The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing hardware interrupts during sample intervals. This value is an indirect indicator of the activity of devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication lines, network interface cards and other peripheral devices. This is an easy way to identify a potential hardware failure. This should never be higher than 20%. dependencies: - name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)' expression: 'min(/Windows CPU by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' - uuid: 49073e4ccf964d349945824888ec46b0 name: 'CPU privileged time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows® Operating System. tags: - tag: Application value: CPU triggers: - uuid: 150f35f3b43c48eb995a1e8f1211e9b3 expression: 'min(/Windows CPU by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Privileged Time"],5m)>{$CPU.PRIV.CRIT.MAX}' name: 'CPU privileged time is too high (over {$CPU.PRIV.CRIT.MAX}% for 5m)' priority: WARNING description: 'The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.' dependencies: - name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)' expression: 'min(/Windows CPU by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}' - name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)' expression: 'min(/Windows CPU by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' - uuid: bebffbf027bb48feba459e7f344d67f2 name: 'CPU user time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Processor Information(_total)\% User Time"]' history: 7d value_type: FLOAT units: '%' description: | The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing in User mode. tags: - tag: Application value: CPU - uuid: 8d1d279c74324690a1ee37dbc90a7f88 name: 'Context switches per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Context Switches/sec"]' history: 7d value_type: FLOAT description: | Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service. It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches. There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval. tags: - tag: Application value: CPU - uuid: b7a1b8f5c4664195921d459a60f09d57 name: 'CPU queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Processor Queue Length"]' history: 7d value_type: FLOAT description: | The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed. tags: - tag: Application value: CPU - uuid: 6f3c6b7312be445eb54e0851447a879e name: 'CPU utilization' type: ZABBIX_ACTIVE key: system.cpu.util history: 7d value_type: FLOAT units: '%' description: 'CPU utilization in %' tags: - tag: Application value: CPU triggers: - uuid: 5f1bdb9eb4c44e8a8f33afee709b0667 expression: 'min(/Windows CPU by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)' opdata: 'Current utilization: {ITEM.LASTVALUE1}' priority: WARNING description: 'CPU utilization is too high. The system might be slow to respond.' - uuid: cb071eb5cc82471c83e88b9125c2832a name: 'Number of cores' type: ZABBIX_ACTIVE key: 'wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]' history: 7d description: 'The number of logical processors available on the computer.' tags: - tag: Application value: CPU macros: - macro: '{$CPU.INTERRUPT.CRIT.MAX}' value: '50' description: 'The critical threshold of the % Interrupt Time counter.' - macro: '{$CPU.PRIV.CRIT.MAX}' value: '30' description: 'The threshold of the % Privileged Time counter.' - macro: '{$CPU.QUEUE.CRIT.MAX}' value: '3' description: 'The threshold of the Processor Queue Length counter.' - macro: '{$CPU.UTIL.CRIT}' value: '90' description: 'The critical threshold of the CPU utilization in %.' - uuid: 1b04ac025fcf474cb97e6c8c95855eeb template: 'Windows filesystems by Zabbix agent active' name: 'Windows filesystems by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules discovery_rules: - uuid: c6af2bf05ad2458babf0a3533d6c36f3 name: 'Mounted filesystem discovery' type: ZABBIX_ACTIVE key: vfs.fs.discovery delay: 1h filter: evaltype: AND conditions: - macro: '{#FSTYPE}' value: '{$VFS.FS.FSTYPE.MATCHES}' formulaid: E - macro: '{#FSTYPE}' value: '{$VFS.FS.FSTYPE.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: F - macro: '{#FSNAME}' value: '{$VFS.FS.FSNAME.MATCHES}' formulaid: C - macro: '{#FSNAME}' value: '{$VFS.FS.FSNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D - macro: '{#FSDRIVETYPE}' value: '{$VFS.FS.FSDRIVETYPE.MATCHES}' formulaid: A - macro: '{#FSDRIVETYPE}' value: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of file systems of different types.' item_prototypes: - uuid: 6d3c76d7f4644e07a351aacc0c2b0651 name: '{#FSLABEL}({#FSNAME}): Space utilization' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},pused]' history: 7d value_type: FLOAT units: '%' description: 'Space utilization in % for {#FSNAME}' tags: - tag: Application value: 'Filesystem {#FSNAME}' - uuid: 4ca1e75a143f4b1c9cb1b1e9d0d02286 name: '{#FSLABEL}({#FSNAME}): Total space' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},total]' history: 7d units: B description: 'Total space in Bytes' tags: - tag: Application value: 'Filesystem {#FSNAME}' - uuid: c221010d5aef4bb182681092d0df3586 name: '{#FSLABEL}({#FSNAME}): Used space' type: ZABBIX_ACTIVE key: 'vfs.fs.size[{#FSNAME},used]' history: 7d units: B description: 'Used storage in Bytes' tags: - tag: Application value: 'Filesystem {#FSNAME}' trigger_prototypes: - uuid: d09b152f2b53451b9daec16eadeaa0ee expression: | last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<5G or timeleft(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)' opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})' priority: AVERAGE description: | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than 5G. - The disk will be full in less than 24 hours. manual_close: 'YES' - uuid: c3e9ee6d771d4047b4351e5870b8ca01 expression: | last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and ((last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<10G or timeleft(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) name: '{#FSLABEL}({#FSNAME}): Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%)' opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})' priority: WARNING description: | Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}. Second condition should be one of the following: - The disk free space is less than 10G. - The disk will be full in less than 24 hours. manual_close: 'YES' dependencies: - name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)' expression: | last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and ((last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},used]))<5G or timeleft(/Windows filesystems by Zabbix agent active/vfs.fs.size[{#FSNAME},pused],1h,100)<1d) graph_prototypes: - uuid: 112006f664834dcf932373b57900425c name: '{#FSLABEL}({#FSNAME}): Disk space usage' width: '600' height: '340' type: PIE show_3d: 'YES' graph_items: - color: '969696' calc_fnc: LAST type: GRAPH_SUM item: host: 'Windows filesystems by Zabbix agent active' key: 'vfs.fs.size[{#FSNAME},total]' - sortorder: '1' color: C80000 calc_fnc: LAST item: host: 'Windows filesystems by Zabbix agent active' key: 'vfs.fs.size[{#FSNAME},used]' macros: - macro: '{$VFS.FS.FSDRIVETYPE.MATCHES}' value: fixed description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}' value: ^\s$ description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSNAME.MATCHES}' value: '.*' description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSNAME.NOT_MATCHES}' value: ^(/dev|/sys|/run|/proc|.+/shm$) description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSTYPE.MATCHES}' value: '.*' description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.FSTYPE.NOT_MATCHES}' value: ^\s$ description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.FS.PUSED.MAX.CRIT}' value: '90' description: 'The critical threshold of the filesystem utilization in percent.' - macro: '{$VFS.FS.PUSED.MAX.WARN}' value: '80' description: 'The warning threshold of the filesystem utilization in percent.' - uuid: 6dd37a415f4c40aa960d7ba91b6b5143 template: 'Windows generic by Zabbix agent active' name: 'Windows generic by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules items: - uuid: 09ff6e03432f4db58e5f43697d0333e8 name: 'Number of threads' type: ZABBIX_ACTIVE key: 'perf_counter_en["\System\Threads"]' history: 7d description: 'The number of threads used by all running processes.' tags: - tag: Application value: General - uuid: 665093a48f39404e9ae3221657a5e962 name: 'Number of processes' type: ZABBIX_ACTIVE key: 'proc.num[]' history: 7d description: 'The number of processes.' tags: - tag: Application value: General - uuid: 73b821a638a74e6d86be642952d2d6fe name: 'System name' type: ZABBIX_ACTIVE key: system.hostname delay: 1h history: 2w trends: '0' value_type: CHAR description: 'System host name.' inventory_link: NAME preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: Application value: General triggers: - uuid: 2f5aa644755c4d18a3eafc74bde2d3ad expression: 'last(/Windows generic by Zabbix agent active/system.hostname,#1)<>last(/Windows generic by Zabbix agent active/system.hostname,#2) and length(last(/Windows generic by Zabbix agent active/system.hostname))>0' name: 'System name has changed (new name: {ITEM.VALUE})' priority: INFO description: 'System name has changed. Ack to close.' manual_close: 'YES' - uuid: 78f2089b58f54042ac70fd9ac3b2aa7e name: 'System local time' key: system.localtime history: 7d status: DISABLED units: unixtime description: 'System local time of the host.' tags: - tag: Application value: General triggers: - uuid: ed8075fd5332427ca0f9b56d55f4912b expression: 'fuzzytime(/Windows generic by Zabbix agent active/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0' name: 'System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s)' priority: WARNING description: 'The host system time is different from the Zabbix server time.' manual_close: 'YES' - uuid: 0522b89bdee248c5aad6ff77d9a68311 name: 'Operating system architecture' type: ZABBIX_ACTIVE key: system.sw.arch delay: 1h history: 2w trends: '0' value_type: CHAR description: 'Operating system architecture of the host.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: Application value: Inventory - uuid: 383c3f59afee455d8981fe85e46c94dd name: 'System description' type: ZABBIX_ACTIVE key: system.uname delay: 15m history: 2w trends: '0' value_type: CHAR description: 'System description of the host.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d tags: - tag: Application value: General - uuid: e5342587828d40ed8feafdccdd6d92e3 name: Uptime type: ZABBIX_ACTIVE key: system.uptime delay: 30s history: 2w trends: 0d units: uptime description: 'System uptime in ''N days, hh:mm:ss'' format.' tags: - tag: Application value: Status triggers: - uuid: 13f9c722d9664d988a97a1c8123ad17a expression: 'last(/Windows generic by Zabbix agent active/system.uptime)<10m' name: 'Host has been restarted (uptime < 10m)' priority: WARNING description: 'The device uptime is less than 10 minutes.' manual_close: 'YES' macros: - macro: '{$SYSTEM.FUZZYTIME.MAX}' value: '60' description: 'The threshold for difference of system time in seconds.' - uuid: e6535f54a0554463889fb8c65db11250 template: 'Windows memory by Zabbix agent active' name: 'Windows memory by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules items: - uuid: 50610f9c46a848bdbdc08ed5b9c2a156 name: 'Cache bytes' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Cache Bytes"]' history: 7d units: B description: | Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average. tags: - tag: Application value: Memory - uuid: 6faf395b5bb14456a33e6689b7618613 name: 'Free system page table entries' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Free System Page Table Entries"]' history: 7d description: | This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may well be a memory leak or you running out of memory. tags: - tag: Application value: Memory triggers: - uuid: 24fd9695799846b3ba812f8ec6148972 expression: 'max(/Windows memory by Zabbix agent active/perf_counter_en["\Memory\Free System Page Table Entries"],5m)<{$MEM.PAGE_TABLE_CRIT.MIN}' name: 'Number of free system page table entries is too low (less {$MEM.PAGE_TABLE_CRIT.MIN} for 5m)' priority: WARNING description: 'The Memory Free System Page Table Entries is less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.' dependencies: - name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)' expression: 'min(/Windows memory by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' - uuid: 9529c721229841f78362b4759cf2a910 name: 'Memory page faults per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Page Faults/sec"]' history: 7d value_type: FLOAT description: | Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays. tags: - tag: Application value: Memory - uuid: f6c50f669f59467e9c5dca1c54f11ba6 name: 'Memory pages per second' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Pages/sec"]' history: 7d value_type: FLOAT description: | This measures the rate at which pages are read from or written to disk to resolve hard page faults. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. tags: - tag: Application value: Memory triggers: - uuid: 655191afccad4673a641808be5500b46 expression: 'min(/Windows memory by Zabbix agent active/perf_counter_en["\Memory\Pages/sec"],5m)>{$MEM.PAGE_SEC.CRIT.MAX}' name: 'The Memory Pages/sec is too high (over {$MEM.PAGE_SEC.CRIT.MAX} for 5m)' priority: WARNING description: 'The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.' dependencies: - name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)' expression: 'min(/Windows memory by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' - uuid: 46dbc910c830421f9a95e0da1e467b39 name: 'Memory pool non-paged' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Memory\Pool Nonpaged Bytes"]' history: 7d units: B description: | This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated. There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). A typical Event ID 2019 is recorded in the system event log. tags: - tag: Application value: Memory - uuid: 81b54eadc3c546858982dc8cf9228dd4 name: 'Used swap space in %' type: ZABBIX_ACTIVE key: 'perf_counter_en["\Paging file(_Total)\% Usage"]' history: 7d value_type: FLOAT units: '%' description: 'The used space of swap volume/file in percent.' tags: - tag: Application value: Memory - uuid: 2eec55a22cf74c16b06eb6f9028637f8 name: 'Free swap space' type: CALCULATED key: system.swap.free history: 7d units: B params: 'last(//system.swap.size[,total]) - last(//system.swap.size[,total]) / 100 * last(//perf_counter_en["\Paging file(_Total)\% Usage"])' description: 'The free space of swap volume/file in bytes.' tags: - tag: Application value: Memory - uuid: 5f86e2a308a342769cb5bf91da3976ef name: 'Free swap space in %' type: DEPENDENT key: system.swap.pfree delay: '0' history: 7d value_type: FLOAT units: '%' description: 'The free space of swap volume/file in percent.' preprocessing: - type: JAVASCRIPT parameters: - 'return (100 - value)' master_item: key: 'perf_counter_en["\Paging file(_Total)\% Usage"]' tags: - tag: Application value: Memory - uuid: 9a73bfe24f884eea9bb9a13042b6dbfd name: 'Total swap space' type: ZABBIX_ACTIVE key: 'system.swap.size[,total]' history: 7d units: B description: 'The total space of swap volume/file in bytes.' tags: - tag: Application value: Memory - uuid: b6b897e08b0f4dd1b858304d5456ab86 name: 'Total memory' type: ZABBIX_ACTIVE key: 'vm.memory.size[total]' history: 7d units: B description: 'Total memory in Bytes' tags: - tag: Application value: Memory - uuid: 7b6b29a6d984476785e77b9604874ed5 name: 'Used memory' type: ZABBIX_ACTIVE key: 'vm.memory.size[used]' history: 7d units: B description: 'Used memory in Bytes' tags: - tag: Application value: Memory - uuid: 5731f496327c422e8fb33a1db6412d74 name: 'Memory utilization' type: CALCULATED key: vm.memory.util history: 7d value_type: FLOAT units: '%' params: 'last(//vm.memory.size[used]) / last(//vm.memory.size[total]) * 100' description: 'Memory utilization in %' tags: - tag: Application value: Memory triggers: - uuid: df816288349743ad9b2015dda9066abb expression: 'min(/Windows memory by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)' priority: AVERAGE description: 'The system is running out of free memory.' macros: - macro: '{$MEM.PAGE_SEC.CRIT.MAX}' value: '1000' description: 'The warning threshold of the Memory Pages/sec counter.' - macro: '{$MEM.PAGE_TABLE_CRIT.MIN}' value: '5000' description: 'The warning threshold of the Free System Page Table Entries counter.' - macro: '{$MEMORY.UTIL.MAX}' value: '90' description: 'The warning threshold of the Memory util item.' - macro: '{$SWAP.PFREE.MIN.WARN}' value: '20' description: 'The warning threshold of the minimum free swap.' - uuid: 792cb76a1a6340d8acb36d8802d22c00 template: 'Windows network by Zabbix agent active' name: 'Windows network by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules items: - uuid: 7c115b04b8904cc187aa3c8bbf456a57 name: 'Network interfaces WMI get' type: ZABBIX_ACTIVE key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' history: '0' trends: '0' value_type: TEXT description: 'Raw data of win32_networkadapter.' preprocessing: - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h tags: - tag: Application value: 'Zabbix raw items' discovery_rules: - uuid: 876e793097d949e49d23b6c4e7df4988 name: 'Network interfaces discovery' type: DEPENDENT key: net.if.discovery delay: '0' filter: evaltype: AND conditions: - macro: '{#IFNAME}' value: '{$NET.IF.IFNAME.MATCHES}' formulaid: E - macro: '{#IFNAME}' value: '{$NET.IF.IFNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: F - macro: '{#IFDESCR}' value: '{$NET.IF.IFDESCR.MATCHES}' formulaid: C - macro: '{#IFDESCR}' value: '{$NET.IF.IFDESCR.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D - macro: '{#IFALIAS}' value: '{$NET.IF.IFALIAS.MATCHES}' formulaid: A - macro: '{#IFALIAS}' value: '{$NET.IF.IFALIAS.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of installed network interfaces.' item_prototypes: - uuid: a1c5afacb66f4c9abf4f8e901f42cb64 name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}",dropped]' delay: 3m history: 7d description: 'The number of incoming packets dropped on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: 3ee5bf3e405c4de2856bfaa729b0f469 name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}",errors]' delay: 3m history: 7d description: 'The number of incoming packets with errors on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: ea8b2a4901254965b40e57f7bdf1ea3f name: 'Interface {#IFNAME}({#IFALIAS}): Bits received' type: ZABBIX_ACTIVE key: 'net.if.in["{#IFGUID}"]' delay: 3m history: 7d units: bps description: 'Incoming traffic on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' - type: MULTIPLIER parameters: - '8' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: 8feffdee85e2486191de0968ec7918b7 name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}",dropped]' delay: 3m history: 7d description: 'The number of outgoing packets dropped on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: 84d1943e15c046f894bf0219288671e4 name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}",errors]' delay: 3m history: 7d description: 'The number of outgoing packets with errors on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: fb0785a7e7e54743bef715fb60dbe890 name: 'Interface {#IFNAME}({#IFALIAS}): Bits sent' type: ZABBIX_ACTIVE key: 'net.if.out["{#IFGUID}"]' delay: 3m history: 7d units: bps description: 'Outgoing traffic on the network interface.' preprocessing: - type: CHANGE_PER_SECOND parameters: - '' - type: MULTIPLIER parameters: - '8' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: 27bf112e7c1f4652aa326fa240215e41 name: 'Interface {#IFNAME}({#IFALIAS}): Speed' type: DEPENDENT key: 'net.if.speed["{#IFGUID}"]' delay: '0' history: 7d trends: 0d units: bps description: 'Estimated bandwidth of the network interface if any.' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].Speed.first()' error_handler: CUSTOM_VALUE error_handler_params: '0' - type: JAVASCRIPT parameters: - 'return (value==''9223372036854775807'' ? 0 : value)' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' - uuid: 44fd303ebab348ceb99c74599c587cb4 name: 'Interface {#IFNAME}({#IFALIAS}): Operational status' type: DEPENDENT key: 'net.if.status["{#IFGUID}"]' delay: '0' history: 7d trends: '0' description: 'The operational status of the network interface.' valuemap: name: 'Win32_NetworkAdapter::NetConnectionStatus' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' trigger_prototypes: - uuid: d2af1fae64c940f2b2b923e159b836e6 expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_mode: RECOVERY_EXPRESSION recovery_expression: 'last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' name: 'Interface {#IFNAME}({#IFALIAS}): Link down' opdata: 'Current state: {ITEM.LASTVALUE1}' priority: AVERAGE description: | This trigger expression works as follows: 1. Can be triggered if operations status is down. 2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important. No new trigger will be fired if this interface is down. 3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2). WARNING: if closed manually - won't fire again on next poll, because of .diff. manual_close: 'YES' - uuid: 14f7982f0a1a49799646fe4685df7db8 name: 'Interface {#IFNAME}({#IFALIAS}): Interface type' type: DEPENDENT key: 'net.if.type["{#IFGUID}"]' delay: '0' history: 7d trends: 0d description: 'The type of the network interface.' valuemap: name: 'Win32_NetworkAdapter::AdapterTypeId' preprocessing: - type: JSONPATH parameters: - '$[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()' - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1d master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' tags: - tag: Application value: 'Interface {#IFNAME}({#IFALIAS})' trigger_prototypes: - uuid: d2629ca744034cf7b92a39d7f847195a expression: | change(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"])<0 and last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"])>0 and last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])=2 name: 'Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before' opdata: 'Current reported speed: {ITEM.LASTVALUE1}' priority: INFO description: 'This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' - uuid: 3bdd014bdaf04f0885816cbf1da11309 expression: | (avg(/Windows network by Zabbix agent active/net.if.in["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"]) or avg(/Windows network by Zabbix agent active/net.if.out["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"])) and last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"])>0 recovery_mode: RECOVERY_EXPRESSION recovery_expression: | avg(/Windows network by Zabbix agent active/net.if.in["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"]) and avg(/Windows network by Zabbix agent active/net.if.out["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows network by Zabbix agent active/net.if.speed["{#IFGUID}"]) name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%)' opdata: 'In: {ITEM.LASTVALUE1}, out: {ITEM.LASTVALUE3}, speed: {ITEM.LASTVALUE2}' priority: WARNING description: 'The network interface utilization is close to its estimated maximum bandwidth.' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' - uuid: e29c3aa283d74838b45040394a3eabe1 expression: | min(/Windows network by Zabbix agent active/net.if.in["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Windows network by Zabbix agent active/net.if.out["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} recovery_mode: RECOVERY_EXPRESSION recovery_expression: | max(/Windows network by Zabbix agent active/net.if.in["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 and max(/Windows network by Zabbix agent active/net.if.out["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8 name: 'Interface {#IFNAME}({#IFALIAS}): High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m)' opdata: 'errors in: {ITEM.LASTVALUE1}, errors out: {ITEM.LASTVALUE2}' priority: WARNING description: 'Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold' manual_close: 'YES' dependencies: - name: 'Interface {#IFNAME}({#IFALIAS}): Link down' expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"],#2))' recovery_expression: 'last(/Windows network by Zabbix agent active/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0' graph_prototypes: - uuid: 5042d069d9364413bc594f2a22a31cb6 name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows network by Zabbix agent active' key: 'net.if.in["{#IFGUID}"]' - sortorder: '1' drawtype: BOLD_LINE color: 2774A4 item: host: 'Windows network by Zabbix agent active' key: 'net.if.out["{#IFGUID}"]' - sortorder: '2' color: F63100 yaxisside: RIGHT item: host: 'Windows network by Zabbix agent active' key: 'net.if.out["{#IFGUID}",errors]' - sortorder: '3' color: A54F10 yaxisside: RIGHT item: host: 'Windows network by Zabbix agent active' key: 'net.if.in["{#IFGUID}",errors]' - sortorder: '4' color: FC6EA3 yaxisside: RIGHT item: host: 'Windows network by Zabbix agent active' key: 'net.if.out["{#IFGUID}",dropped]' - sortorder: '5' color: 6C59DC yaxisside: RIGHT item: host: 'Windows network by Zabbix agent active' key: 'net.if.in["{#IFGUID}",dropped]' master_item: key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]' preprocessing: - type: JAVASCRIPT parameters: - | output = JSON.parse(value).map(function(net){ return { "{#IFNAME}": net.Name, "{#IFDESCR}": net.Description, "{#IFALIAS}": net.NetConnectionID, "{#IFGUID}": net.GUID }}) return JSON.stringify({"data": output}) - type: DISCARD_UNCHANGED_HEARTBEAT parameters: - 1h macros: - macro: '{$IF.ERRORS.WARN}' value: '2' - macro: '{$IF.UTIL.MAX}' value: '90' - macro: '{$IFCONTROL}' value: '1' - macro: '{$NET.IF.IFALIAS.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFALIAS.NOT_MATCHES}' value: CHANGE_THIS description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFDESCR.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFDESCR.NOT_MATCHES}' value: CHANGE_THIS description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFNAME.MATCHES}' value: '.*' description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' - macro: '{$NET.IF.IFNAME.NOT_MATCHES}' value: Miniport|Virtual|Teredo|Kernel|Loopback|Bluetooth|HTTPS|6to4|QoS|Layer description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.' dashboards: - uuid: 1f4737b4a5364b35a8358dccedf6a492 name: 'Network interfaces' pages: - widgets: - type: GRAPH_PROTOTYPE width: '24' height: '5' fields: - type: INTEGER name: source_type value: '2' - type: INTEGER name: columns value: '1' - type: INTEGER name: rows value: '1' - type: GRAPH_PROTOTYPE name: graphid value: name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic' host: 'Windows network by Zabbix agent active' valuemaps: - uuid: 7300d3f66dec4f90bcd6889d206db89f name: 'Win32_NetworkAdapter::AdapterTypeId' mappings: - value: '0' newvalue: 'Ethernet 802.3' - value: '1' newvalue: 'Token Ring 802.5' - value: '2' newvalue: 'Fiber Distributed Data Interface (FDDI)' - value: '3' newvalue: 'Wide Area Network (WAN)' - value: '4' newvalue: LocalTalk - value: '5' newvalue: 'Ethernet using DIX header format' - value: '6' newvalue: ARCNET - value: '7' newvalue: 'ARCNET (878.2)' - value: '8' newvalue: ATM - value: '9' newvalue: Wireless - value: '10' newvalue: 'Infrared Wireless' - value: '11' newvalue: Bpc - value: '12' newvalue: CoWan - value: '13' newvalue: '1394' - uuid: a1e647b6b26547bfbc044d213150c71b name: 'Win32_NetworkAdapter::NetConnectionStatus' mappings: - value: '0' newvalue: Disconnected - value: '1' newvalue: Connecting - value: '2' newvalue: Connected - value: '3' newvalue: Disconnecting - value: '4' newvalue: 'Hardware Not Present' - value: '5' newvalue: 'Hardware Disabled' - value: '6' newvalue: 'Hardware Malfunction' - value: '7' newvalue: 'Media Disconnected' - value: '8' newvalue: Authenticating - value: '9' newvalue: 'Authentication Succeeded' - value: '10' newvalue: 'Authentication Failed' - value: '11' newvalue: 'Invalid Address' - value: '12' newvalue: 'Credentials Required' - uuid: 222cf73cb40941f6be62db0540524e5e template: 'Windows physical disks by Zabbix agent active' name: 'Windows physical disks by Zabbix agent active' description: 'Template tooling version used: 0.39' groups: - name: Templates/Modules discovery_rules: - uuid: 355a9297d1fb4cb0b587e40ef152dc0f name: 'Physical disks discovery' type: ZABBIX_ACTIVE key: 'perf_instance_en.discovery[PhysicalDisk]' delay: 1h filter: evaltype: AND conditions: - macro: '{#DEVNAME}' value: '{$VFS.DEV.DEVNAME.MATCHES}' formulaid: A - macro: '{#DEVNAME}' value: '{$VFS.DEV.DEVNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B description: 'Discovery of installed physical disks.' item_prototypes: - uuid: 7d6ab9b1b76041869d7818652b5c5b0e name: '{#DEVNAME}: Disk utilization' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Disk Time",60]' history: 7d value_type: FLOAT units: '%' description: 'This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests.' tags: - tag: Application value: 'Disk {#DEVNAME}' trigger_prototypes: - uuid: 6baacd2fab15466ab3b12dcfb7e2980a expression: 'min(/Windows physical disks by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\% Disk Time",60],15m)>{$VFS.DEV.UTIL.MAX.WARN}' name: '{#DEVNAME}: Disk is overloaded (util > {$VFS.DEV.UTIL.MAX.WARN}% for 15m)' priority: WARNING description: 'The disk appears to be under heavy load' manual_close: 'YES' dependencies: - name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m' expression: 'min(/Windows physical disks by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}' - name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)' expression: 'min(/Windows physical disks by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}' - uuid: ee3e17e348f84f8bb4eb9675cb0ef045 name: '{#DEVNAME}: Average disk read queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]' history: 7d value_type: FLOAT description: 'Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: Application value: 'Disk {#DEVNAME}' - uuid: 83bc066220ec47bb898351e8d20fb81d name: '{#DEVNAME}: Disk read request avg waiting time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]' history: 7d value_type: FLOAT units: s description: 'The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.' tags: - tag: Application value: 'Disk {#DEVNAME}' trigger_prototypes: - uuid: 32f7d131336348178069bbafbdabcfee expression: 'min(/Windows physical disks by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}' name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m' priority: WARNING description: 'This trigger might indicate disk {#DEVNAME} saturation.' manual_close: 'YES' - uuid: 9f906bcb67f847b7bfbca098659063d4 name: '{#DEVNAME}: Disk write request avg waiting time' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]' history: 7d value_type: FLOAT units: s description: 'The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.' tags: - tag: Application value: 'Disk {#DEVNAME}' trigger_prototypes: - uuid: d7116046921d441dba5830140f8bf433 expression: 'min(/Windows physical disks by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}' name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)' priority: WARNING description: 'This trigger might indicate disk {#DEVNAME} saturation.' manual_close: 'YES' - uuid: 584f4a8fba0b4e3cba7f37cba42cd97c name: '{#DEVNAME}: Average disk write queue length' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]' history: 7d value_type: FLOAT description: 'Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: Application value: 'Disk {#DEVNAME}' - uuid: 1201592953094d48af20a0e420bfa846 name: '{#DEVNAME}: Disk average queue size (avgqu-sz)' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]' history: 7d value_type: FLOAT description: 'Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.' tags: - tag: Application value: 'Disk {#DEVNAME}' - uuid: e0f052d64ea544b09dfe619cb91f28c8 name: '{#DEVNAME}: Disk read rate' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]' history: 7d value_type: FLOAT units: '!r/s' description: 'Rate of read operations on the disk.' tags: - tag: Application value: 'Disk {#DEVNAME}' - uuid: 33e5e9eccad84737bf428fc54b25fc5c name: '{#DEVNAME}: Disk write rate' type: ZABBIX_ACTIVE key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]' history: 7d value_type: FLOAT units: '!w/s' description: 'Rate of write operations on the disk.' tags: - tag: Application value: 'Disk {#DEVNAME}' graph_prototypes: - uuid: b84e9fa116434ec8ba9ab9bb7a2aa6d2 name: '{#DEVNAME}: Disk average queue length' graph_items: - color: 1A7C11 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]' - sortorder: '1' color: 2774A4 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]' - uuid: ece6c5cbff6e4997b52ea1d7652b7680 name: '{#DEVNAME}: Disk average waiting time' graph_items: - color: 1A7C11 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]' - uuid: 681afbf26ef340c682f8deffd921ae2d name: '{#DEVNAME}: Disk read/write rates' graph_items: - color: 1A7C11 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]' - uuid: 58fb9ac4f2864730aaeda6a035b1591e name: '{#DEVNAME}: Disk utilization and queue' graph_items: - color: 1A7C11 yaxisside: RIGHT item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]' - sortorder: '1' drawtype: GRADIENT_LINE color: 2774A4 item: host: 'Windows physical disks by Zabbix agent active' key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Disk Time",60]' preprocessing: - type: STR_REPLACE parameters: - '{#INSTANCE}' - '{#DEVNAME}' macros: - macro: '{$VFS.DEV.DEVNAME.MATCHES}' value: '.*' description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.DEV.DEVNAME.NOT_MATCHES}' value: _Total description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.' - macro: '{$VFS.DEV.READ.AWAIT.WARN}' value: '0.02' description: 'Disk read average response time (in s) before the trigger would fire.' - macro: '{$VFS.DEV.UTIL.MAX.WARN}' value: '95' description: 'The warning threshold of disk time utilization in percent.' - macro: '{$VFS.DEV.WRITE.AWAIT.WARN}' value: '0.02' description: 'Disk write average response time (in s) before the trigger would fire.' - uuid: 3366a65bbc3e46348bec303e84e23b15 template: 'Windows services by Zabbix agent active' name: 'Windows services by Zabbix agent active' description: | Template Services OS Windows Template tooling version used: 0.39 groups: - name: Templates/Modules discovery_rules: - uuid: 25e19e75eb4d4fd68df976323c7fac21 name: 'Windows services discovery' type: ZABBIX_ACTIVE key: service.discovery delay: 1h filter: evaltype: AND conditions: - macro: '{#SERVICE.NAME}' value: '{$SERVICE.NAME.MATCHES}' formulaid: A - macro: '{#SERVICE.NAME}' value: '{$SERVICE.NAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: B - macro: '{#SERVICE.STARTUPNAME}' value: '{$SERVICE.STARTUPNAME.MATCHES}' formulaid: C - macro: '{#SERVICE.STARTUPNAME}' value: '{$SERVICE.STARTUPNAME.NOT_MATCHES}' operator: NOT_MATCHES_REGEX formulaid: D description: 'Discovery of Windows services of different types as defined in template''s macros.' item_prototypes: - uuid: c1606f1f7c9e4eb494c0c5e4e4f21ea5 name: 'State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})' type: ZABBIX_ACTIVE key: 'service.info["{#SERVICE.NAME}",state]' history: 7d valuemap: name: 'Windows service state' tags: - tag: Application value: Services trigger_prototypes: - uuid: df3247515e2e4b48b2decd8401c11736 expression: 'min(/Windows services by Zabbix agent active/service.info["{#SERVICE.NAME}",state],#3)<>0' name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME})' priority: AVERAGE description: 'The service has a state other than "Running" for the last three times.' macros: - macro: '{$SERVICE.NAME.MATCHES}' value: '^.*$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.NAME.NOT_MATCHES}' value: '^RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.STARTUPNAME.MATCHES}' value: '^automatic|automatic delayed$' description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' - macro: '{$SERVICE.STARTUPNAME.NOT_MATCHES}' value: ^manual|disabled$ description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.' valuemaps: - uuid: af7bd46d70ed4058afa4961d130dc0b2 name: 'Windows service state' mappings: - value: '0' newvalue: Running - value: '1' newvalue: Paused - value: '2' newvalue: 'Start pending' - value: '3' newvalue: 'Pause pending' - value: '4' newvalue: 'Continue pending' - value: '5' newvalue: 'Stop pending' - value: '6' newvalue: Stopped - value: '7' newvalue: Unknown - value: '255' newvalue: 'No such service' triggers: - uuid: dfba6b17ab94449181584c8a4410f50f expression: 'min(/Windows CPU by Zabbix agent active/perf_counter_en["\System\Processor Queue Length"],5m) - last(/Windows CPU by Zabbix agent active/wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]) * 2 > {$CPU.QUEUE.CRIT.MAX}' name: 'CPU queue length is too high (over {$CPU.QUEUE.CRIT.MAX} for 5m)' priority: WARNING description: 'The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.' dependencies: - name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)' expression: 'min(/Windows CPU by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}' - uuid: 237760596cd647bca82044e843992d87 expression: 'min(/Windows memory by Zabbix agent active/system.swap.pfree,5m)<{$SWAP.PFREE.MIN.WARN} and last(/Windows memory by Zabbix agent active/system.swap.size[,total])>0' name: 'High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free)' opdata: 'Free: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}' priority: WARNING description: 'This trigger is ignored, if there is no swap configured' dependencies: - name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)' expression: 'min(/Windows memory by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}' graphs: - uuid: 12c859baa46044a0a439f26d2eb50436 name: 'CPU jumps' graph_items: - color: 1A7C11 item: host: 'Windows CPU by Zabbix agent active' key: 'perf_counter_en["\System\Context Switches/sec"]' - sortorder: '1' color: 2774A4 item: host: 'Windows CPU by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]' - uuid: 523969311486483e93b4704c544861d6 name: 'CPU usage' type: STACKED ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - color: 1A7C11 item: host: 'Windows CPU by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% User Time"]' - sortorder: '1' color: 2774A4 item: host: 'Windows CPU by Zabbix agent active' key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]' - uuid: 33392bbdf1d146e2ad347fafa4f9a5d2 name: 'CPU utilization' ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows CPU by Zabbix agent active' key: system.cpu.util - uuid: 3c50693dde6c4f6fa1487e3969a1c87d name: 'Memory utilization' ymin_type_1: FIXED ymax_type_1: FIXED graph_items: - drawtype: GRADIENT_LINE color: 1A7C11 item: host: 'Windows memory by Zabbix agent active' key: vm.memory.util - uuid: 1d27499155b04933a51e4e0f419ea9e8 name: 'Swap usage' graph_items: - color: 1A7C11 item: host: 'Windows memory by Zabbix agent active' key: system.swap.free - sortorder: '1' color: 2774A4 item: host: 'Windows memory by Zabbix agent active' key: 'system.swap.size[,total]'