path: root/templates/module/windows_agent/template_module_windows_agent.yaml

zabbix_export:
  version: '6.0'
  date: '2022-04-08T09:22:42Z'
  groups:
    -
      uuid: 57b7ae836ca64446ba2c296389c009b7
      name: Modules
  templates:
    -
      uuid: e358504d59404f688e236444dd82d2c3
      template: 'Windows CPU by Zabbix agent'
      name: 'Windows CPU by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      items:
        -
          uuid: 8362346c013546f39f8140061f7b3f01
          name: 'CPU DPC time'
          key: 'perf_counter_en["\Processor Information(_total)\% DPC Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure
            calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a
            component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is
            sustained, there may be a processor bottleneck or an application or hardware related issue that can
            significantly diminish overall system performance.
          tags:
            -
              tag: component
              value: cpu
        -
          uuid: 609619e2b6364d9e90bef828610b23f8
          name: 'CPU interrupt time'
          key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
            hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
            devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
            lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
            hardware failure. This should never be higher than 20%.
          tags:
            -
              tag: component
              value: cpu
          triggers:
            -
              uuid: 3f6cca07bc6c48f0b21fee3aeb89bf6b
              expression: 'min(/Windows CPU by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}'
              name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)'
              priority: WARNING
              description: |
                "The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."
                The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
                hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
                devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
                lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
                hardware failure. This should never be higher than 20%.
              dependencies:
                -
                  name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
                  expression: 'min(/Windows CPU by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              tags:
                -
                  tag: scope
                  value: performance
        -
          uuid: eb5144d1e3cb4417ae0abcdeca10e0ed
          name: 'CPU privileged time'
          key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent
            executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt
            Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode
            functions of the Windows® Operating System.
          tags:
            -
              tag: component
              value: cpu
          triggers:
            -
              uuid: 999464a5a73540d3b7b7cd86efa5488e
              expression: 'min(/Windows CPU by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Privileged Time"],5m)>{$CPU.PRIV.CRIT.MAX}'
              name: 'CPU privileged time is too high (over {$CPU.PRIV.CRIT.MAX}% for 5m)'
              priority: WARNING
              description: 'The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.'
              dependencies:
                -
                  name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)'
                  expression: 'min(/Windows CPU by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}'
                -
                  name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
                  expression: 'min(/Windows CPU by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              tags:
                -
                  tag: scope
                  value: performance
        -
          uuid: 5611c125bf01479fadc2e59db073cc9c
          name: 'CPU user time'
          key: 'perf_counter_en["\Processor Information(_total)\% User Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing
            in User mode.
          tags:
            -
              tag: component
              value: cpu
        -
          uuid: 8ee61e8919984a3d9a7125fd4fe7c397
          name: 'Context switches per second'
          key: 'perf_counter_en["\System\Context Switches/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.
            Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.
            It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.
            There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
          tags:
            -
              tag: component
              value: cpu
        -
          uuid: 1a2b85fb8355459e9c5c723164d09d41
          name: 'CPU queue length'
          key: 'perf_counter_en["\System\Processor Queue Length"]'
          history: 7d
          value_type: FLOAT
          description: |
            The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue
            and are waiting to be executed.
          tags:
            -
              tag: component
              value: cpu
        -
          uuid: 177e472955434cb19dadb06c0f34eb31
          name: 'CPU utilization'
          key: system.cpu.util
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'CPU utilization in %.'
          tags:
            -
              tag: component
              value: cpu
          triggers:
            -
              uuid: afd1711dca1542a5bec9091cbae2bcf0
              expression: 'min(/Windows CPU by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: WARNING
              description: 'CPU utilization is too high. The system might be slow to respond.'
              tags:
                -
                  tag: scope
                  value: performance
        -
          uuid: d6b17d211ed746aaabac591a3dad5813
          name: 'Number of cores'
          key: 'wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]'
          history: 7d
          description: 'The number of logical processors available on the computer.'
          tags:
            -
              tag: component
              value: cpu
      macros:
        -
          macro: '{$CPU.INTERRUPT.CRIT.MAX}'
          value: '50'
          description: 'The critical threshold of the % Interrupt Time counter.'
        -
          macro: '{$CPU.PRIV.CRIT.MAX}'
          value: '30'
          description: 'The threshold of the % Privileged Time counter.'
        -
          macro: '{$CPU.QUEUE.CRIT.MAX}'
          value: '3'
          description: 'The threshold of the Processor Queue Length counter.'
        -
          macro: '{$CPU.UTIL.CRIT}'
          value: '90'
          description: 'The critical threshold of the CPU utilization in %.'
    -
      uuid: cb28abff977b4b6eb34665ff2218163b
      template: 'Windows filesystems by Zabbix agent'
      name: 'Windows filesystems by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      discovery_rules:
        -
          uuid: f603eb3367ad4326a1f1ec7b9c14c07a
          name: 'Mounted filesystem discovery'
          key: vfs.fs.discovery
          delay: 1h
          filter:
            evaltype: AND
            conditions:
              -
                macro: '{#FSTYPE}'
                value: '{$VFS.FS.FSTYPE.MATCHES}'
                formulaid: E
              -
                macro: '{#FSTYPE}'
                value: '{$VFS.FS.FSTYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
              -
                macro: '{#FSNAME}'
                value: '{$VFS.FS.FSNAME.MATCHES}'
                formulaid: C
              -
                macro: '{#FSNAME}'
                value: '{$VFS.FS.FSNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              -
                macro: '{#FSDRIVETYPE}'
                value: '{$VFS.FS.FSDRIVETYPE.MATCHES}'
                formulaid: A
              -
                macro: '{#FSDRIVETYPE}'
                value: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
          description: 'Discovery of file systems of different types.'
          item_prototypes:
            -
              uuid: 84c999eefbdd43319d0b992aff43f3c5
              name: '{#FSLABEL}({#FSNAME}): Space utilization'
              key: 'vfs.fs.size[{#FSNAME},pused]'
              history: 7d
              value_type: FLOAT
              units: '%'
              description: 'Space utilization in % for {#FSNAME}'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: filesystem
                  value: '{#FSNAME}'
            -
              uuid: a1661dae47c640be9cfa9e807e125ff3
              name: '{#FSLABEL}({#FSNAME}): Total space'
              key: 'vfs.fs.size[{#FSNAME},total]'
              history: 7d
              units: B
              description: 'Total space in Bytes'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: filesystem
                  value: '{#FSNAME}'
            -
              uuid: ed0c1057b2704ab098847ae62fec9064
              name: '{#FSLABEL}({#FSNAME}): Used space'
              key: 'vfs.fs.size[{#FSNAME},used]'
              history: 7d
              units: B
              description: 'Used storage in Bytes'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: filesystem
                  value: '{#FSNAME}'
          trigger_prototypes:
            -
              uuid: 68544e02e3cc4d389269448f34ca66e1
              expression: |
                last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and
                ((last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)'
              opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})'
              priority: AVERAGE
              description: |
                Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.
                 Second condition should be one of the following:
                 - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}.
                 - The disk will be full in less than 24 hours.
              manual_close: 'YES'
              tags:
                -
                  tag: scope
                  value: capacity
            -
              uuid: ba0e859e58c34107a792098cfe9d31a4
              expression: |
                last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and
                ((last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or timeleft(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              name: '{#FSLABEL}({#FSNAME}): Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%)'
              opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})'
              priority: WARNING
              description: |
                Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}.
                 Second condition should be one of the following:
                 - The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}.
                 - The disk will be full in less than 24 hours.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)'
                  expression: |
                    last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and
                    ((last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows filesystems by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              tags:
                -
                  tag: scope
                  value: capacity
          graph_prototypes:
            -
              uuid: 78d604a4bde244c38bcfbabd7ef5e09d
              name: '{#FSLABEL}({#FSNAME}): Disk space usage'
              width: '600'
              height: '340'
              type: PIE
              show_3d: 'YES'
              graph_items:
                -
                  color: '969696'
                  calc_fnc: LAST
                  type: GRAPH_SUM
                  item:
                    host: 'Windows filesystems by Zabbix agent'
                    key: 'vfs.fs.size[{#FSNAME},total]'
                -
                  sortorder: '1'
                  color: C80000
                  calc_fnc: LAST
                  item:
                    host: 'Windows filesystems by Zabbix agent'
                    key: 'vfs.fs.size[{#FSNAME},used]'
      macros:
        -
          macro: '{$VFS.FS.FREE.MIN.CRIT}'
          value: 5G
          description: 'The critical threshold of the filesystem utilization.'
        -
          macro: '{$VFS.FS.FREE.MIN.WARN}'
          value: 10G
          description: 'The warning threshold of the filesystem utilization.'
        -
          macro: '{$VFS.FS.FSDRIVETYPE.MATCHES}'
          value: fixed
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}'
          value: ^\s$
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.FSNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.FSNAME.NOT_MATCHES}'
          value: '^(?:/dev|/sys|/run|/proc|.+/shm$)'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.FSTYPE.MATCHES}'
          value: '.*'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.FSTYPE.NOT_MATCHES}'
          value: ^\s$
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.FS.PUSED.MAX.CRIT}'
          value: '90'
          description: 'The critical threshold of the filesystem utilization in percent.'
        -
          macro: '{$VFS.FS.PUSED.MAX.WARN}'
          value: '80'
          description: 'The warning threshold of the filesystem utilization in percent.'
    -
      uuid: 95c4026f8ade4fa7b72f8140fc152aea
      template: 'Windows generic by Zabbix agent'
      name: 'Windows generic by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      items:
        -
          uuid: 1245fca060fb424897387d56d29fe030
          name: 'Number of threads'
          key: 'perf_counter_en["\System\Threads"]'
          history: 7d
          description: 'The number of threads used by all running processes.'
          tags:
            -
              tag: component
              value: os
        -
          uuid: 8401ea3152ea45269eeb6cc7fa70f1aa
          name: 'Number of processes'
          key: 'proc.num[]'
          history: 7d
          description: 'The number of processes.'
          tags:
            -
              tag: component
              value: os
        -
          uuid: 78ae4dbd2d894819a36a7d3d00f2e508
          name: 'System name'
          key: system.hostname
          delay: 1h
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'System host name.'
          inventory_link: NAME
          preprocessing:
            -
              type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            -
              tag: component
              value: system
          triggers:
            -
              uuid: 13c5f9c0f7f645cc9dde522ff20a1860
              expression: 'last(/Windows generic by Zabbix agent/system.hostname,#1)<>last(/Windows generic by Zabbix agent/system.hostname,#2) and length(last(/Windows generic by Zabbix agent/system.hostname))>0'
              name: 'System name has changed (new name: {ITEM.VALUE})'
              priority: INFO
              description: 'System name has changed. Ack to close.'
              manual_close: 'YES'
              tags:
                -
                  tag: scope
                  value: notice
        -
          uuid: 25454c401bea41a4b3c49da3165f3d3d
          name: 'System local time'
          key: system.localtime
          history: 7d
          units: unixtime
          description: 'System local time of the host.'
          tags:
            -
              tag: component
              value: system
          triggers:
            -
              uuid: 3144a1b15227479e9ea4ce858faea74b
              expression: 'fuzzytime(/Windows generic by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0'
              name: 'System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s)'
              priority: WARNING
              description: 'The host system time is different from the Zabbix server time.'
              manual_close: 'YES'
              tags:
                -
                  tag: scope
                  value: notice
        -
          uuid: 5ed680dff3154af58e7adc0571a6ee9d
          name: 'Operating system architecture'
          key: system.sw.arch
          delay: 1h
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'Operating system architecture of the host.'
          preprocessing:
            -
              type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            -
              tag: component
              value: os
        -
          uuid: 76ef3297b4b740bfaf891e039f7d4dff
          name: 'System description'
          key: system.uname
          delay: 15m
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'System description of the host.'
          preprocessing:
            -
              type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            -
              tag: component
              value: system
        -
          uuid: 24411175d64f48a195ee4a2323d8e799
          name: Uptime
          key: system.uptime
          delay: 30s
          history: 2w
          trends: 0d
          units: uptime
          description: 'System uptime in ''N days, hh:mm:ss'' format.'
          tags:
            -
              tag: component
              value: system
          triggers:
            -
              uuid: d24a0366e99c4e31815bbbaa3af71ac6
              expression: 'last(/Windows generic by Zabbix agent/system.uptime)<10m'
              name: 'Host has been restarted (uptime < 10m)'
              priority: WARNING
              description: 'The device uptime is less than 10 minutes.'
              manual_close: 'YES'
              tags:
                -
                  tag: scope
                  value: notice
      macros:
        -
          macro: '{$SYSTEM.FUZZYTIME.MAX}'
          value: '60'
          description: 'The threshold for difference of system time in seconds.'
    -
      uuid: 539b4b98f6fb4e12bbdf3bcdb85df2d1
      template: 'Windows memory by Zabbix agent'
      name: 'Windows memory by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      items:
        -
          uuid: dbbd157ca9464e858bcfbf9a88cac775
          name: 'Cache bytes'
          key: 'perf_counter_en["\Memory\Cache Bytes"]'
          history: 7d
          units: B
          description: |
            Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes,
            Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays
            the last observed value only; it is not an average.
          tags:
            -
              tag: component
              value: memory
        -
          uuid: bea4109baa6e425eaa7b8cb3bbb1c01a
          name: 'Free system page table entries'
          key: 'perf_counter_en["\Memory\Free System Page Table Entries"]'
          history: 7d
          description: |
            This indicates the number of page table entries not currently in use by the system. If the number is less
            than 5,000, there may well be a memory leak or you running out of memory.
          tags:
            -
              tag: component
              value: memory
          triggers:
            -
              uuid: 5055a8fdc127479cbe97fdfd849831ea
              expression: 'max(/Windows memory by Zabbix agent/perf_counter_en["\Memory\Free System Page Table Entries"],5m)<{$MEM.PAGE_TABLE_CRIT.MIN}'
              name: 'Number of free system page table entries is too low (less {$MEM.PAGE_TABLE_CRIT.MIN} for 5m)'
              priority: WARNING
              description: 'The Memory Free System Page Table Entries is less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.'
              dependencies:
                -
                  name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
                  expression: 'min(/Windows memory by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              tags:
                -
                  tag: scope
                  value: capacity
        -
          uuid: c54782d0e8384d9cba8fe79af050e7ac
          name: 'Memory page faults per second'
          key: 'perf_counter_en["\Memory\Page Faults/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages
            faulted per second because only one page is faulted in each fault operation, hence this is also equal
            to the number of page fault operations. This counter includes both hard faults (those that require
            disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most
            processors can handle large numbers of soft faults without significant consequence. However, hard faults,
            which require disk access, can cause significant delays.
          tags:
            -
              tag: component
              value: memory
        -
          uuid: 1ce3e64002424f29b73a5159152ae529
          name: 'Memory pages per second'
          key: 'perf_counter_en["\Memory\Pages/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            This measures the rate at which pages are read from or written to disk to resolve hard page faults.
            If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.
          tags:
            -
              tag: component
              value: memory
          triggers:
            -
              uuid: 045574e4dd814b7e97d292b134f0a755
              expression: 'min(/Windows memory by Zabbix agent/perf_counter_en["\Memory\Pages/sec"],5m)>{$MEM.PAGE_SEC.CRIT.MAX}'
              name: 'The Memory Pages/sec is too high (over {$MEM.PAGE_SEC.CRIT.MAX} for 5m)'
              priority: WARNING
              description: 'The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.'
              dependencies:
                -
                  name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
                  expression: 'min(/Windows memory by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              tags:
                -
                  tag: scope
                  value: capacity
        -
          uuid: b4ae2ff5830b47f882744f5fbcfcca05
          name: 'Memory pool non-paged'
          key: 'perf_counter_en["\Memory\Pool Nonpaged Bytes"]'
          history: 7d
          units: B
          description: |
            This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects
            that cannot be written to disk but instead must remain in physical memory as long as they are allocated.
            There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).
            A typical Event ID 2019 is recorded in the system event log.
          tags:
            -
              tag: component
              value: memory
        -
          uuid: d24566c5c0fc4c219f521a1d4ae18546
          name: 'Used swap space in %'
          key: 'perf_counter_en["\Paging file(_Total)\% Usage"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'The used space of swap volume/file in percent.'
          tags:
            -
              tag: component
              value: memory
            -
              tag: component
              value: storage
        -
          uuid: 3b8acdfa9b744fb595590daa370b16a9
          name: 'Free swap space'
          type: CALCULATED
          key: system.swap.free
          history: 7d
          units: B
          params: 'last(//system.swap.size[,total]) - last(//system.swap.size[,total]) / 100 * last(//perf_counter_en["\Paging file(_Total)\% Usage"])'
          description: 'The free space of swap volume/file in bytes.'
          tags:
            -
              tag: component
              value: memory
            -
              tag: component
              value: storage
        -
          uuid: 88eb59f25fde40a49f3b35f576fab29d
          name: 'Free swap space in %'
          type: DEPENDENT
          key: system.swap.pfree
          delay: '0'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'The free space of swap volume/file in percent.'
          preprocessing:
            -
              type: JAVASCRIPT
              parameters:
                - 'return (100 - value)'
          master_item:
            key: 'perf_counter_en["\Paging file(_Total)\% Usage"]'
          tags:
            -
              tag: component
              value: memory
            -
              tag: component
              value: storage
        -
          uuid: 711aae9de25e43728bfc9c26f06c800a
          name: 'Total swap space'
          key: 'system.swap.size[,total]'
          history: 7d
          units: B
          description: 'The total space of swap volume/file in bytes.'
          tags:
            -
              tag: component
              value: memory
            -
              tag: component
              value: storage
        -
          uuid: 35f397ade625477eba0b557a58113761
          name: 'Total memory'
          key: 'vm.memory.size[total]'
          history: 7d
          units: B
          description: 'Total memory in Bytes.'
          tags:
            -
              tag: component
              value: memory
        -
          uuid: 69f61ded5de04623be01a77e160a41e6
          name: 'Used memory'
          key: 'vm.memory.size[used]'
          history: 7d
          units: B
          description: 'Used memory in Bytes.'
          tags:
            -
              tag: component
              value: memory
        -
          uuid: 97295c0987bd44f1af578a2e37f469f4
          name: 'Memory utilization'
          type: CALCULATED
          key: vm.memory.util
          history: 7d
          value_type: FLOAT
          units: '%'
          params: 'last(//vm.memory.size[used]) / last(//vm.memory.size[total]) * 100'
          description: 'Memory utilization in %.'
          tags:
            -
              tag: component
              value: memory
          triggers:
            -
              uuid: 2766be7a10d444be9893dcdfab75f3be
              expression: 'min(/Windows memory by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
              priority: AVERAGE
              description: 'The system is running out of free memory.'
              tags:
                -
                  tag: scope
                  value: capacity
                -
                  tag: scope
                  value: performance
      macros:
        -
          macro: '{$MEM.PAGE_SEC.CRIT.MAX}'
          value: '1000'
          description: 'The warning threshold of the Memory Pages/sec counter.'
        -
          macro: '{$MEM.PAGE_TABLE_CRIT.MIN}'
          value: '5000'
          description: 'The warning threshold of the Free System Page Table Entries counter.'
        -
          macro: '{$MEMORY.UTIL.MAX}'
          value: '90'
          description: 'The warning threshold of the Memory util item.'
        -
          macro: '{$SWAP.PFREE.MIN.WARN}'
          value: '20'
          description: 'The warning threshold of the minimum free swap.'
    -
      uuid: 6ad6a4d1e677461ca6d1d5b2dcaba6d2
      template: 'Windows network by Zabbix agent'
      name: 'Windows network by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      items:
        -
          uuid: 52d75ac9adc347959053860a7e0ac199
          name: 'Network interfaces WMI get'
          key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
          history: '0'
          trends: '0'
          value_type: TEXT
          description: 'Raw data of win32_networkadapter.'
          preprocessing:
            -
              type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          tags:
            -
              tag: component
              value: raw
      discovery_rules:
        -
          uuid: e4ea554f9a1c4d3db0233c8babdf9bc1
          name: 'Network interfaces discovery'
          type: DEPENDENT
          key: net.if.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              -
                macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.MATCHES}'
                formulaid: E
              -
                macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
              -
                macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.MATCHES}'
                formulaid: C
              -
                macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              -
                macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.MATCHES}'
                formulaid: A
              -
                macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
          description: 'Discovery of installed network interfaces.'
          item_prototypes:
            -
              uuid: 9e9fdb17beee45ef9bc0eac67c512da4
              name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded'
              key: 'net.if.in["{#IFGUID}",dropped]'
              delay: 3m
              history: 7d
              description: 'The number of incoming packets dropped on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: 29d94ac228794aa9a89a4147014c35d1
              name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors'
              key: 'net.if.in["{#IFGUID}",errors]'
              delay: 3m
              history: 7d
              description: 'The number of incoming packets with errors on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: 18cb6d1cde06482a8adb10e78576b512
              name: 'Interface {#IFNAME}({#IFALIAS}): Bits received'
              key: 'net.if.in["{#IFGUID}"]'
              delay: 3m
              history: 7d
              units: bps
              description: 'Incoming traffic on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                -
                  type: MULTIPLIER
                  parameters:
                    - '8'
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: e3065d25674045938470ce2e10fbd6c0
              name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded'
              key: 'net.if.out["{#IFGUID}",dropped]'
              delay: 3m
              history: 7d
              description: 'The number of outgoing packets dropped on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: b3472a08272143bead7b9dc366b4992f
              name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors'
              key: 'net.if.out["{#IFGUID}",errors]'
              delay: 3m
              history: 7d
              description: 'The number of outgoing packets with errors on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: 2e208f1d9ca949f582f24015350395b6
              name: 'Interface {#IFNAME}({#IFALIAS}): Bits sent'
              key: 'net.if.out["{#IFGUID}"]'
              delay: 3m
              history: 7d
              units: bps
              description: 'Outgoing traffic on the network interface.'
              preprocessing:
                -
                  type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                -
                  type: MULTIPLIER
                  parameters:
                    - '8'
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: db8d1c51fdcc4cffbff0c8974b5233f9
              name: 'Interface {#IFNAME}({#IFALIAS}): Speed'
              type: DEPENDENT
              key: 'net.if.speed["{#IFGUID}"]'
              delay: '0'
              history: 7d
              trends: 0d
              units: bps
              description: 'Estimated bandwidth of the network interface if any.'
              preprocessing:
                -
                  type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].Speed.first()'
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                -
                  type: JAVASCRIPT
                  parameters:
                    - 'return (value==''9223372036854775807'' ? 0 : value)'
                -
                  type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
            -
              uuid: efe5e7b10dbe4b5c8f86a60e6611c22f
              name: 'Interface {#IFNAME}({#IFALIAS}): Operational status'
              type: DEPENDENT
              key: 'net.if.status["{#IFGUID}"]'
              delay: '0'
              history: 7d
              trends: '0'
              description: 'The operational status of the network interface.'
              valuemap:
                name: 'Win32_NetworkAdapter::NetConnectionStatus'
              preprocessing:
                -
                  type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()'
                -
                  type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1d
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
              trigger_prototypes:
                -
                  uuid: 36effba3975c408aba50096464719479
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  opdata: 'Current state: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. Can be triggered if operations status is down.
                    2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important.
                        No new trigger will be fired if this interface is down.
                    3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2).
                    
                    WARNING: if closed manually - won't fire again on next poll, because of .diff.
                  manual_close: 'YES'
                  tags:
                    -
                      tag: scope
                      value: availability
            -
              uuid: 9ea1818be4d7423fb7799b9cf1546491
              name: 'Interface {#IFNAME}({#IFALIAS}): Interface type'
              type: DEPENDENT
              key: 'net.if.type["{#IFGUID}"]'
              delay: '0'
              history: 7d
              trends: 0d
              description: 'The type of the network interface.'
              valuemap:
                name: 'Win32_NetworkAdapter::AdapterTypeId'
              preprocessing:
                -
                  type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()'
                -
                  type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1d
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                -
                  tag: component
                  value: network
                -
                  tag: description
                  value: '{#IFALIAS}'
                -
                  tag: interface
                  value: '{#IFNAME}'
          trigger_prototypes:
            -
              uuid: 81cea5af79844f298849ca5ef6cde4b3
              expression: |
                change(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"])<0 and
                last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"])>0 and
                last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])=2
              name: 'Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before'
              opdata: 'Current reported speed: {ITEM.LASTVALUE1}'
              priority: INFO
              description: 'This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.'
              manual_close: 'YES'
              dependencies:
                -
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                -
                  tag: scope
                  value: capacity
            -
              uuid: c0e8e89730f04d92b26dd5da215894e1
              expression: |
                (avg(/Windows network by Zabbix agent/net.if.in["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"]) or
                avg(/Windows network by Zabbix agent/net.if.out["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"])) and
                last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"])>0
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                avg(/Windows network by Zabbix agent/net.if.in["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"]) and
                avg(/Windows network by Zabbix agent/net.if.out["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows network by Zabbix agent/net.if.speed["{#IFGUID}"])
              name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%)'
              opdata: 'In: {ITEM.LASTVALUE1}, out: {ITEM.LASTVALUE3}, speed: {ITEM.LASTVALUE2}'
              priority: WARNING
              description: 'The network interface utilization is close to its estimated maximum bandwidth.'
              manual_close: 'YES'
              dependencies:
                -
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                -
                  tag: scope
                  value: performance
            -
              uuid: 2a59eec0032a41e48e2443507cbd173d
              expression: |
                min(/Windows network by Zabbix agent/net.if.in["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}
                or min(/Windows network by Zabbix agent/net.if.out["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                max(/Windows network by Zabbix agent/net.if.in["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8
                and max(/Windows network by Zabbix agent/net.if.out["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8
              name: 'Interface {#IFNAME}({#IFALIAS}): High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m)'
              opdata: 'errors in: {ITEM.LASTVALUE1}, errors out: {ITEM.LASTVALUE2}'
              priority: WARNING
              description: 'Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold'
              manual_close: 'YES'
              dependencies:
                -
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows network by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                -
                  tag: scope
                  value: availability
          graph_prototypes:
            -
              uuid: 08ea837e8c2448018cff873dacd95dcb
              name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic'
              graph_items:
                -
                  drawtype: GRADIENT_LINE
                  color: 1A7C11
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}"]'
                -
                  sortorder: '1'
                  drawtype: BOLD_LINE
                  color: 2774A4
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}"]'
                -
                  sortorder: '2'
                  color: F63100
                  yaxisside: RIGHT
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}",errors]'
                -
                  sortorder: '3'
                  color: A54F10
                  yaxisside: RIGHT
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}",errors]'
                -
                  sortorder: '4'
                  color: FC6EA3
                  yaxisside: RIGHT
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}",dropped]'
                -
                  sortorder: '5'
                  color: 6C59DC
                  yaxisside: RIGHT
                  item:
                    host: 'Windows network by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}",dropped]'
          master_item:
            key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
          preprocessing:
            -
              type: JAVASCRIPT
              parameters:
                - |
                  output = JSON.parse(value).map(function(net){
                      return {
                          "{#IFNAME}": net.Name,
                          "{#IFDESCR}": net.Description,
                          "{#IFALIAS}": net.NetConnectionID,
                          "{#IFGUID}": net.GUID
                      }})
                  return JSON.stringify({"data": output})
            -
              type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
      macros:
        -
          macro: '{$IF.ERRORS.WARN}'
          value: '2'
        -
          macro: '{$IF.UTIL.MAX}'
          value: '90'
        -
          macro: '{$IFCONTROL}'
          value: '1'
        -
          macro: '{$NET.IF.IFALIAS.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$NET.IF.IFALIAS.NOT_MATCHES}'
          value: CHANGE_THIS
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$NET.IF.IFDESCR.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$NET.IF.IFDESCR.NOT_MATCHES}'
          value: CHANGE_THIS
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$NET.IF.IFNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$NET.IF.IFNAME.NOT_MATCHES}'
          value: Miniport|Virtual|Teredo|Kernel|Loopback|Bluetooth|HTTPS|6to4|QoS|Layer
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
      dashboards:
        -
          uuid: 9ddc1ce7e9ea4d7dba8e282366084f3b
          name: 'Network interfaces'
          pages:
            -
              widgets:
                -
                  type: GRAPH_PROTOTYPE
                  width: '24'
                  height: '5'
                  fields:
                    -
                      type: INTEGER
                      name: source_type
                      value: '2'
                    -
                      type: INTEGER
                      name: columns
                      value: '1'
                    -
                      type: INTEGER
                      name: rows
                      value: '1'
                    -
                      type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic'
                        host: 'Windows network by Zabbix agent'
      valuemaps:
        -
          uuid: dd37c51d4ded48ceb449fa633dd707e2
          name: 'Win32_NetworkAdapter::AdapterTypeId'
          mappings:
            -
              value: '0'
              newvalue: 'Ethernet 802.3'
            -
              value: '1'
              newvalue: 'Token Ring 802.5'
            -
              value: '2'
              newvalue: 'Fiber Distributed Data Interface (FDDI)'
            -
              value: '3'
              newvalue: 'Wide Area Network (WAN)'
            -
              value: '4'
              newvalue: LocalTalk
            -
              value: '5'
              newvalue: 'Ethernet using DIX header format'
            -
              value: '6'
              newvalue: ARCNET
            -
              value: '7'
              newvalue: 'ARCNET (878.2)'
            -
              value: '8'
              newvalue: ATM
            -
              value: '9'
              newvalue: Wireless
            -
              value: '10'
              newvalue: 'Infrared Wireless'
            -
              value: '11'
              newvalue: Bpc
            -
              value: '12'
              newvalue: CoWan
            -
              value: '13'
              newvalue: '1394'
        -
          uuid: 3265d77e34ba44f688b7aaceeeccda6b
          name: 'Win32_NetworkAdapter::NetConnectionStatus'
          mappings:
            -
              value: '0'
              newvalue: Disconnected
            -
              value: '1'
              newvalue: Connecting
            -
              value: '2'
              newvalue: Connected
            -
              value: '3'
              newvalue: Disconnecting
            -
              value: '4'
              newvalue: 'Hardware Not Present'
            -
              value: '5'
              newvalue: 'Hardware Disabled'
            -
              value: '6'
              newvalue: 'Hardware Malfunction'
            -
              value: '7'
              newvalue: 'Media Disconnected'
            -
              value: '8'
              newvalue: Authenticating
            -
              value: '9'
              newvalue: 'Authentication Succeeded'
            -
              value: '10'
              newvalue: 'Authentication Failed'
            -
              value: '11'
              newvalue: 'Invalid Address'
            -
              value: '12'
              newvalue: 'Credentials Required'
    -
      uuid: 4026647be95a47de98b0f09dc36ce72f
      template: 'Windows physical disks by Zabbix agent'
      name: 'Windows physical disks by Zabbix agent'
      description: 'Template tooling version used: 0.41'
      groups:
        -
          name: Modules
      discovery_rules:
        -
          uuid: d03f20ec394e4725a5dfdceecb79c8bd
          name: 'Physical disks discovery'
          key: 'perf_instance_en.discovery[PhysicalDisk]'
          delay: 1h
          filter:
            evaltype: AND
            conditions:
              -
                macro: '{#DEVNAME}'
                value: '{$VFS.DEV.DEVNAME.MATCHES}'
                formulaid: A
              -
                macro: '{#DEVNAME}'
                value: '{$VFS.DEV.DEVNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
          description: 'Discovery of installed physical disks.'
          item_prototypes:
            -
              uuid: 44d9353d47274309bb3edaa34b7b3470
              name: '{#DEVNAME}: Disk utilization by idle time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]'
              history: 7d
              value_type: FLOAT
              units: '%'
              description: 'This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.'
              preprocessing:
                -
                  type: JAVASCRIPT
                  parameters:
                    - 'return (100 - value)'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                -
                  uuid: c194f813f0c5417aaac56875b955637a
                  expression: 'min(/Windows physical disks by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60],15m)>{$VFS.DEV.UTIL.MAX.WARN}'
                  name: '{#DEVNAME}: Disk is overloaded (util > {$VFS.DEV.UTIL.MAX.WARN}% for 15m)'
                  priority: WARNING
                  description: 'The disk appears to be under heavy load'
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m'
                      expression: 'min(/Windows physical disks by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}'
                    -
                      name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)'
                      expression: 'min(/Windows physical disks by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}'
                  tags:
                    -
                      tag: scope
                      value: performance
            -
              uuid: 8122d6fd46a54d5f8b23c4b21a333959
              name: '{#DEVNAME}: Average disk read queue length'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
            -
              uuid: f6896b69665d4a9bb160b23a322919d4
              name: '{#DEVNAME}: Disk read request avg waiting time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]'
              history: 7d
              value_type: FLOAT
              units: s
              description: 'The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                -
                  uuid: d96338f9104a4eb4bc7725a5736c96d0
                  expression: 'min(/Windows physical disks by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}'
                  name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m'
                  priority: WARNING
                  description: 'This trigger might indicate disk {#DEVNAME} saturation.'
                  manual_close: 'YES'
                  tags:
                    -
                      tag: scope
                      value: performance
            -
              uuid: 704680610f6a42dc9373db929a3d0d53
              name: '{#DEVNAME}: Disk write request avg waiting time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]'
              history: 7d
              value_type: FLOAT
              units: s
              description: 'The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                -
                  uuid: 205acd9a37424bd78618ebdc197f251f
                  expression: 'min(/Windows physical disks by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}'
                  name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)'
                  priority: WARNING
                  description: 'This trigger might indicate disk {#DEVNAME} saturation.'
                  manual_close: 'YES'
                  tags:
                    -
                      tag: scope
                      value: performance
            -
              uuid: 9f5d1cdb629847ad97e0fa0804883e91
              name: '{#DEVNAME}: Average disk write queue length'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
            -
              uuid: 3565ad70600d4c8aa5ebbbebd3f67270
              name: '{#DEVNAME}: Disk average queue size (avgqu-sz)'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
            -
              uuid: 3485202f1e6b42ce8099ce6d6347a994
              name: '{#DEVNAME}: Disk read rate'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]'
              history: 7d
              value_type: FLOAT
              units: '!r/s'
              description: 'Rate of read operations on the disk.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
            -
              uuid: 66e312629db1460c8b215d34d29f7418
              name: '{#DEVNAME}: Disk write rate'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]'
              history: 7d
              value_type: FLOAT
              units: '!w/s'
              description: 'Rate of write operations on the disk.'
              tags:
                -
                  tag: component
                  value: storage
                -
                  tag: disk
                  value: '{#DEVNAME}'
          graph_prototypes:
            -
              uuid: 5fcd9dc53cd34e4981bf5e48a88951a0
              name: '{#DEVNAME}: Disk average queue length'
              graph_items:
                -
                  color: 1A7C11
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]'
                -
                  sortorder: '1'
                  color: 2774A4
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]'
            -
              uuid: 6561058a9cd748728bb46d8d04a5b74b
              name: '{#DEVNAME}: Disk average waiting time'
              graph_items:
                -
                  color: 1A7C11
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]'
                -
                  sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]'
            -
              uuid: 83dee3e21b2f4b3c8c7552f87ebec81c
              name: '{#DEVNAME}: Disk read/write rates'
              graph_items:
                -
                  color: 1A7C11
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]'
                -
                  sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]'
            -
              uuid: d3b5ccf4530447c2aee84fb23a6934d0
              name: '{#DEVNAME}: Disk utilization and queue'
              graph_items:
                -
                  color: 1A7C11
                  yaxisside: RIGHT
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]'
                -
                  sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows physical disks by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]'
          preprocessing:
            -
              type: STR_REPLACE
              parameters:
                - '{#INSTANCE}'
                - '{#DEVNAME}'
      macros:
        -
          macro: '{$VFS.DEV.DEVNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.DEV.DEVNAME.NOT_MATCHES}'
          value: _Total
          description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$VFS.DEV.READ.AWAIT.WARN}'
          value: '0.02'
          description: 'Disk read average response time (in s) before the trigger would fire.'
        -
          macro: '{$VFS.DEV.UTIL.MAX.WARN}'
          value: '95'
          description: 'The warning threshold of disk time utilization in percent.'
        -
          macro: '{$VFS.DEV.WRITE.AWAIT.WARN}'
          value: '0.02'
          description: 'Disk write average response time (in s) before the trigger would fire.'
    -
      uuid: dfd6f32510a840c29f9cb4b974977770
      template: 'Windows services by Zabbix agent'
      name: 'Windows services by Zabbix agent'
      description: |
        Template Services OS Windows
        
        Template tooling version used: 0.41
      groups:
        -
          name: Modules
      discovery_rules:
        -
          uuid: d4fb5efff5494013b452e5a47ac265f5
          name: 'Windows services discovery'
          key: service.discovery
          delay: 1h
          filter:
            evaltype: AND
            conditions:
              -
                macro: '{#SERVICE.NAME}'
                value: '{$SERVICE.NAME.MATCHES}'
                formulaid: A
              -
                macro: '{#SERVICE.NAME}'
                value: '{$SERVICE.NAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              -
                macro: '{#SERVICE.STARTUPNAME}'
                value: '{$SERVICE.STARTUPNAME.MATCHES}'
                formulaid: C
              -
                macro: '{#SERVICE.STARTUPNAME}'
                value: '{$SERVICE.STARTUPNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
          description: 'Discovery of Windows services of different types as defined in template''s macros.'
          item_prototypes:
            -
              uuid: 934d8e7f237d42739e880803f02f0da9
              name: 'State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})'
              key: 'service.info["{#SERVICE.NAME}",state]'
              history: 7d
              valuemap:
                name: 'Windows service state'
              tags:
                -
                  tag: component
                  value: system
                -
                  tag: name
                  value: '{#SERVICE.DISPLAYNAME}'
                -
                  tag: service
                  value: '{#SERVICE.NAME}'
              trigger_prototypes:
                -
                  uuid: 9fab20eab61d48c09682fe5c142cc917
                  expression: 'min(/Windows services by Zabbix agent/service.info["{#SERVICE.NAME}",state],#3)<>0'
                  name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME})'
                  priority: AVERAGE
                  description: 'The service has a state other than "Running" for the last three times.'
                  tags:
                    -
                      tag: scope
                      value: notice
      macros:
        -
          macro: '{$SERVICE.NAME.MATCHES}'
          value: '^.*$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$SERVICE.NAME.NOT_MATCHES}'
          value: '^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$SERVICE.STARTUPNAME.MATCHES}'
          value: '^(?:automatic|automatic delayed)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        -
          macro: '{$SERVICE.STARTUPNAME.NOT_MATCHES}'
          value: '^(?:manual|disabled)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
      valuemaps:
        -
          uuid: 5d9a045df1df48daaa6752bd75f1681d
          name: 'Windows service state'
          mappings:
            -
              value: '0'
              newvalue: Running
            -
              value: '1'
              newvalue: Paused
            -
              value: '2'
              newvalue: 'Start pending'
            -
              value: '3'
              newvalue: 'Pause pending'
            -
              value: '4'
              newvalue: 'Continue pending'
            -
              value: '5'
              newvalue: 'Stop pending'
            -
              value: '6'
              newvalue: Stopped
            -
              value: '7'
              newvalue: Unknown
            -
              value: '255'
              newvalue: 'No such service'
  triggers:
    -
      uuid: cc301d844a7b42e79756d1bc74adf307
      expression: 'min(/Windows CPU by Zabbix agent/perf_counter_en["\System\Processor Queue Length"],5m) - last(/Windows CPU by Zabbix agent/wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]) * 2 > {$CPU.QUEUE.CRIT.MAX}'
      name: 'CPU queue length is too high (over {$CPU.QUEUE.CRIT.MAX} for 5m)'
      priority: WARNING
      description: 'The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.'
      dependencies:
        -
          name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
          expression: 'min(/Windows CPU by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
      tags:
        -
          tag: scope
          value: performance
    -
      uuid: b2a97432e79e4a999324d3fde7dacdeb
      expression: 'min(/Windows memory by Zabbix agent/system.swap.pfree,5m)<{$SWAP.PFREE.MIN.WARN} and last(/Windows memory by Zabbix agent/system.swap.size[,total])>0'
      name: 'High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free)'
      opdata: 'Free: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}'
      priority: WARNING
      description: 'This trigger is ignored, if there is no swap configured'
      dependencies:
        -
          name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
          expression: 'min(/Windows memory by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
      tags:
        -
          tag: scope
          value: performance
  graphs:
    -
      uuid: e3029427b9124e30a9aa06000219f572
      name: 'CPU jumps'
      graph_items:
        -
          color: 1A7C11
          item:
            host: 'Windows CPU by Zabbix agent'
            key: 'perf_counter_en["\System\Context Switches/sec"]'
        -
          sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows CPU by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]'
    -
      uuid: 0b520e68348e4c17983672c5ca4dffb1
      name: 'CPU usage'
      type: STACKED
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        -
          color: 1A7C11
          item:
            host: 'Windows CPU by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% User Time"]'
        -
          sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows CPU by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]'
    -
      uuid: d7543150b21e4678a29ca1072c8660df
      name: 'CPU utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        -
          drawtype: GRADIENT_LINE
          color: 1A7C11
          item:
            host: 'Windows CPU by Zabbix agent'
            key: system.cpu.util
    -
      uuid: 61a375b6875641bf93145be801809ece
      name: 'Memory utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        -
          drawtype: GRADIENT_LINE
          color: 1A7C11
          item:
            host: 'Windows memory by Zabbix agent'
            key: vm.memory.util
    -
      uuid: 8891c435d3df489ea18847abb82054ca
      name: 'Swap usage'
      graph_items:
        -
          color: 1A7C11
          item:
            host: 'Windows memory by Zabbix agent'
            key: system.swap.free
        -
          sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows memory by Zabbix agent'
            key: 'system.swap.size[,total]'