Zabbix Template: Windows by Zabbix agent active

This is an official Windows template. It requires Zabbix agent 7.0 or newer.

You can discuss this template or leave feedback on our forum https://www.zabbix.com/forum/zabbix-suggestions-and-feedback/387224-discussion-thread-for-official-zabbix-template-for-windows

Generated by official Zabbix template tool "Templator"

Items

Item: Host name of Zabbix agent running

agent.hostname

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: Zabbix agent ping

The agent always returns "1" for this item. May be used in combination with nodata() for the availability check.

agent.ping

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Version of Zabbix agent running

agent.version

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: Cache bytes

Cache Bytes is the sum of the Memory\System Cache Resident Bytes, Memory\System Driver Resident Bytes, Memory\System Code Resident Bytes, and Memory\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average.

perf_counter_en["\Memory\Cache Bytes"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Free system page table entries

This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may be a memory leak or you running out of memory.

perf_counter_en["\Memory\Free System Page Table Entries"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Memory page faults per second

Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays.

perf_counter_en["\Memory\Page Faults/sec"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT
History	7d

Item: Memory pages per second

This measures the rate at which pages are read from or written to disk to resolve hard page faults. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.

perf_counter_en["\Memory\Pages/sec"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT
History	7d

Item: Memory pool non-paged

This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated. There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). Consequently, Event ID 2019 is recorded in the system event log.

perf_counter_en["\Memory\Pool Nonpaged Bytes"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Used swap space in %

The used space of swap volume/file in percent.

perf_counter_en["\Paging file(_Total)\% Usage"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: CPU DPC time

Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is sustained, there may be a processor bottleneck or an application or hardware related issue that can significantly diminish overall system performance.

perf_counter_en["\Processor Information(_total)\% DPC Time"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: CPU interrupt time

The processor information % Interrupt Time counter indicates how much time the processor spends handling hardware interrupts during sample intervals. It reflects the activity of devices like the system clock, mouse, disk drivers, and network cards. A value above 20% suggests possible hardware issues.

perf_counter_en["\Processor Information(_total)\% Interrupt Time"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: CPU privileged time

The processor information % Privileged Time counter shows the percent of time that the processor is spent executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode functions of the Windows Operating System.

perf_counter_en["\Processor Information(_total)\% Privileged Time"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: CPU user time

The processor information % User Time counter shows the percent of time that the processor(s) is spent executing in User mode.

perf_counter_en["\Processor Information(_total)\% User Time"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: Context switches per second

Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another. Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service. It is the sum of Thread\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches. There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.

perf_counter_en["\System\Context Switches/sec"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT
History	7d

Item: CPU queue length

The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue and are waiting to be executed.

perf_counter_en["\System\Processor Queue Length"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT
History	7d

Item: Number of threads

The number of threads used by all running processes.

perf_counter_en["\System\Threads"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Number of processes

The number of processes.

proc.num[]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: CPU utilization

CPU utilization expressed in %.

system.cpu.util

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %
History	7d

Item: System name

The host name of the system.

system.hostname

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: System local time

The local system time of the host.

system.localtime

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Operating system architecture

The architecture of the operating system.

system.sw.arch

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: Operating system

system.sw.os

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: Free swap space

The free space of the swap volume/file expressed in bytes.

system.swap.free

Settings:

Item Setting	Value
Type	CALCULATED
History	7d

Item: Free swap space in %

The free space of the swap volume/file expressed in %.

system.swap.pfree

Settings:

Item Setting	Value
Type	DEPENDENT
Value type	FLOAT in %
History	7d
Source item	`perf_counter_en["\Paging file(_Total)\% Usage"]`

Preprocessing steps:

Type	Parameters
JAVASCRIPT	`["return (100 - value)"]`

Item: Total swap space

The total space of the swap volume/file expressed in bytes.

system.swap.size[,total]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: System description

System description of the host.

system.uname

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	CHAR
History	7d

Item: Uptime

The system uptime expressed in the following format: "N days, hh:mm:ss".

system.uptime

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Get filesystems

The vfs.fs.get key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.

vfs.fs.get

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	TEXT

Item: Total memory

Total memory expressed in bytes.

vm.memory.size[total]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Used memory

Used memory in bytes.

vm.memory.size[used]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Memory utilization

Memory utilization in %.

vm.memory.util

Settings:

Item Setting	Value
Type	CALCULATED
Value type	FLOAT in %
History	7d

Item: Windows: Network interfaces WMI get

Raw data of win32_networkadapter.

wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	TEXT

Item: Number of cores

The number of logical processors available on the computer.

wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
History	7d

Item: Active agent availability

Availability of active checks on the host. The value of this item corresponds to availability icons in the host list. Possible values: 0 - unknown 1 - available 2 - not available

zabbix[host,active_agent,available]

Settings:

Item Setting	Value
Type	INTERNAL
History	7d

Triggers

Trigger: Zabbix agent is not available

For active agents, nodata() with agent.ping is used with {$AGENT.NODATA_TIMEOUT} as a time threshold. Settings:

Trigger Setting	Values
Priority	AVERAGE
Manual close	YES

nodata(/Windows by Zabbix agent active/agent.ping,{$AGENT.NODATA_TIMEOUT})=1

Trigger: Number of free system page table entries is too low

Memory\Free System Page Table Entries has been less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may be a memory leak. Settings:

Trigger Setting	Values
Priority	WARNING

max(/Windows by Zabbix agent active/perf_counter_en["\Memory\Free System Page Table Entries"],5m)<{$MEM.PAGE_TABLE_CRIT.MIN}

Trigger: The Memory Pages/sec is too high

The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. Settings:

Trigger Setting	Values
Priority	WARNING

min(/Windows by Zabbix agent active/perf_counter_en["\Memory\Pages/sec"],5m)>{$MEM.PAGE_SEC.CRIT.MAX}

Trigger: CPU interrupt time is too high

The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%. Settings:

Trigger Setting	Values
Priority	WARNING

min(/Windows by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}

Trigger: CPU privileged time is too high

The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%. Settings:

Trigger Setting	Values
Priority	WARNING

min(/Windows by Zabbix agent active/perf_counter_en["\Processor Information(_total)\% Privileged Time"],5m)>{$CPU.PRIV.CRIT.MAX}

Trigger: High CPU utilization

CPU utilization is too high. The system might be slow to respond. Settings:

Trigger Setting	Values
Priority	WARNING

min(/Windows by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}

Trigger: System name has changed

The name of the system has changed. Acknowledge to close the problem manually. Settings:

Trigger Setting	Values
Priority	INFO
Manual close	YES

change(/Windows by Zabbix agent active/system.hostname) and length(last(/Windows by Zabbix agent active/system.hostname))>0

Trigger: Operating system description has changed

The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually. Settings:

Trigger Setting	Values
Priority	INFO
Manual close	YES

change(/Windows by Zabbix agent active/system.sw.os) and length(last(/Windows by Zabbix agent active/system.sw.os))>0

Trigger: Host has been restarted

The device uptime is less than 10 minutes. Settings:

Trigger Setting	Values
Priority	WARNING
Manual close	YES

last(/Windows by Zabbix agent active/system.uptime)<10m

Trigger: High memory utilization

The system is running out of free memory. Settings:

Trigger Setting	Values
Priority	AVERAGE

min(/Windows by Zabbix agent active/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}

Trigger: Active checks are not available

Active checks are considered unavailable. Agent has not sent a heartbeat for a prolonged time. Settings:

Trigger Setting	Values
Priority	HIGH

min(/Windows by Zabbix agent active/zabbix[host,active_agent,available],{$AGENT.TIMEOUT})=2

Discovery Rules

Discovery Rule: Network interfaces discovery

Discovery of installed network interfaces.

net.if.discovery

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]`

Preprocessing steps:

Type	Parameters
JAVASCRIPT	`["output = JSON.parse(value).map(function(net){\n\treturn {\n\t\t\"{#IFNAME}\": net.Name,\n\t\t\"{#IFDESCR}\": net.Description,\n\t\t\"{#IFALIAS}\": net.NetConnectionID,\n\t\t\"{#IFGUID}\": net.GUID\n\t}})\nreturn JSON.stringify({\"data\": output})\n"]`
DISCARD_UNCHANGED_HEARTBEAT	`["1h"]`

Discovery Rule: Network interfaces discovery: Item Prototypes

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded

The number of incoming packets dropped on the network interface.

net.if.in["{#IFGUID}",dropped]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors

The number of incoming packets with errors on the network interface.

net.if.in["{#IFGUID}",errors]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Bits received

Incoming traffic on the network interface.

net.if.in["{#IFGUID}"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded

The number of outgoing packets dropped on the network interface.

net.if.out["{#IFGUID}",dropped]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors

The number of outgoing packets with errors on the network interface.

net.if.out["{#IFGUID}",errors]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Bits sent

Outgoing traffic on the network interface.

net.if.out["{#IFGUID}"]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Speed

Estimated bandwidth of the network interface if any.

net.if.speed["{#IFGUID}"]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$[?(@.GUID == \"{#IFGUID}\")].Speed.first()"]`
JAVASCRIPT	`["return (value=='9223372036854775807' ? 0 : value)"]`
DISCARD_UNCHANGED_HEARTBEAT	`["1h"]`

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Operational status

The operational status of the network interface.

net.if.status["{#IFGUID}"]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$[?(@.GUID == \"{#IFGUID}\")].NetConnectionStatus.first()"]`
DISCARD_UNCHANGED_HEARTBEAT	`["1d"]`

Discovery Rule: Network interfaces discovery: Item Prototype: Interface {#IFNAME}({#IFALIAS}): Interface type

The type of the network interface.

net.if.type["{#IFGUID}"]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$[?(@.GUID == \"{#IFGUID}\")].AdapterTypeId.first()"]`
DISCARD_UNCHANGED_HEARTBEAT	`["1d"]`

Discovery Rule: Network interfaces discovery: Discovery Triggers

Discovery Rule: Network interfaces discovery: Trigger Prototype: Interface {#IFNAME}({#IFALIAS}): Link down

This trigger expression works as follows: 1. It can be triggered if the operations status is down. 2. {$IFCONTROL:"{#IFNAME}"}=1 - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down. 3. last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2) - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.

Settings:

Trigger Setting	Values
Priority	AVERAGE
Manual close	YES

{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent active/net.if.status["{#IFGUID}"],#2))

Discovery Rule: Network interfaces discovery: Graph Prototypes

The following graph prototypes are defined by this Template

Interface {#IFNAME}({#IFALIAS}): Network traffic

Discovery Rule: Physical disks discovery

Discovery of installed physical disks.

perf_instance_en.discovery[PhysicalDisk]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Physical disks discovery: Item Prototypes

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk utilization by idle time

This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.

perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in %

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Average disk read queue length

Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk read request avg waiting time

The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in s

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk write request avg waiting time

The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in s

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Average disk write queue length

Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk average queue size (avgqu-sz)

The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk read rate

Rate of read operations on the disk.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in !r/s

Discovery Rule: Physical disks discovery: Item Prototype: {#DEVNAME}: Disk write rate

Rate of write operations on the disk.

perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE
Value type	FLOAT in !w/s

Discovery Rule: Physical disks discovery: Discovery Triggers

Discovery Rule: Physical disks discovery: Trigger Prototype: {#DEVNAME}: Disk is overloaded

The disk appears to be under heavy load. Settings:

Trigger Setting	Values
Priority	WARNING
Manual close	YES

min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60],15m)>{$VFS.DEV.UTIL.MAX.WARN}

Discovery Rule: Physical disks discovery: Trigger Prototype: {#DEVNAME}: Disk read request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation. Settings:

Trigger Setting	Values
Priority	WARNING
Manual close	YES

min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}

Discovery Rule: Physical disks discovery: Trigger Prototype: {#DEVNAME}: Disk write request responses are too high

This trigger might indicate the disk {#DEVNAME} saturation. Settings:

Trigger Setting	Values
Priority	WARNING
Manual close	YES

min(/Windows by Zabbix agent active/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}

Discovery Rule: Physical disks discovery: Graph Prototypes

The following graph prototypes are defined by this Template

{#DEVNAME}: Disk average queue length
{#DEVNAME}: Disk average waiting time
{#DEVNAME}: Disk read/write rates
{#DEVNAME}: Disk utilization and queue

Discovery Rule: Windows services discovery

Used for the discovery of Windows services of different types as defined in the template's macros.

service.discovery

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Windows services discovery: Item Prototypes

Discovery Rule: Windows services discovery: Item Prototype: State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})

service.info["{#SERVICE.NAME}",state]

Settings:

Item Setting	Value
Type	ZABBIX_ACTIVE

Discovery Rule: Windows services discovery: Discovery Triggers

Discovery Rule: Windows services discovery: Trigger Prototype: "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running

The service has a state other than "Running" for the last three times. Settings:

Trigger Setting	Values
Priority	AVERAGE

min(/Windows by Zabbix agent active/service.info["{#SERVICE.NAME}",state],#3)<>0

Discovery Rule: Mounted filesystem discovery

Discovery of filesystems of different types.

vfs.fs.dependent.discovery

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`vfs.fs.get`

Preprocessing steps:

Type	Parameters
JAVASCRIPT	`["var filesystems = JSON.parse(value);\n\nresult = filesystems.map(function (filesystem) {\n\treturn {\n\t\t'fsname': filesystem.fsname,\n\t\t'fstype': filesystem.fstype,\n\t\t'fslabel': filesystem.fslabel,\n\t\t'fsdrivetype': filesystem.fsdrivetype\n\t};\n});\n\nreturn JSON.stringify(result);\n"]`
DISCARD_UNCHANGED_HEARTBEAT	`["1h"]`

Discovery Rule: Mounted filesystem discovery: Item Prototypes

Discovery Rule: Mounted filesystem discovery: Item Prototype: FS [{#FSLABEL}({#FSNAME})]: Space: Available

Available storage space expressed in bytes.

vfs.fs.dependent.size[{#FSNAME},free]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`vfs.fs.dependent[{#FSNAME},data]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$.bytes.free"]`

Discovery Rule: Mounted filesystem discovery: Item Prototype: FS [{#FSLABEL}({#FSNAME})]: Space: Used, in %

Calculated as the percentage of currently used space compared to the maximum available space.

vfs.fs.dependent.size[{#FSNAME},pused]

Settings:

Item Setting	Value
Type	DEPENDENT
Value type	FLOAT in %
Source item	`vfs.fs.dependent[{#FSNAME},data]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$.bytes.pused"]`

Discovery Rule: Mounted filesystem discovery: Item Prototype: FS [{#FSLABEL}({#FSNAME})]: Space: Total

Total space expressed in bytes.

vfs.fs.dependent.size[{#FSNAME},total]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`vfs.fs.dependent[{#FSNAME},data]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$.bytes.total"]`

Discovery Rule: Mounted filesystem discovery: Item Prototype: FS [{#FSLABEL}({#FSNAME})]: Space: Used

Used storage expressed in bytes.

vfs.fs.dependent.size[{#FSNAME},used]

Settings:

Item Setting	Value
Type	DEPENDENT
Source item	`vfs.fs.dependent[{#FSNAME},data]`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$.bytes.used"]`

Discovery Rule: Mounted filesystem discovery: Item Prototype: FS [{#FSLABEL}({#FSNAME})]: Get data

Intermediate data of {#FSNAME} filesystem.

vfs.fs.dependent[{#FSNAME},data]

Settings:

Item Setting	Value
Type	DEPENDENT
Value type	TEXT
History	1h
Source item	`vfs.fs.get`

Preprocessing steps:

Type	Parameters
JSONPATH	`["$.[?(@.fsname=='{#FSNAME}')].first()"]`

Discovery Rule: Mounted filesystem discovery: Discovery Triggers

Discovery Rule: Mounted filesystem discovery: Trigger Prototype: FS [{#FSLABEL}({#FSNAME})]: Space is critically low

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}% limit. The trigger expression is based on the current used and maximum available spaces. Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

Settings:

Trigger Setting	Values
Priority	AVERAGE
Manual close	YES

min(/Windows by Zabbix agent active/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSLABEL}({#FSNAME})"}

Discovery Rule: Mounted filesystem discovery: Trigger Prototype: FS [{#FSLABEL}({#FSNAME})]: Space is low

The volume's space usage exceeds the {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}% limit. The trigger expression is based on the current used and maximum available spaces. Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.

Settings:

Trigger Setting	Values
Priority	WARNING
Manual close	YES

min(/Windows by Zabbix agent active/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSLABEL}({#FSNAME})"}

Discovery Rule: Mounted filesystem discovery: Graph Prototypes

The following graph prototypes are defined by this Template

FS [{#FSLABEL}({#FSNAME})]: Space usage graph, in %
FS [{#FSLABEL}({#FSNAME})]: Space utilization chart

Macros

The following Zabbix macros are configured via this template.

Macro: `{$AGENT.NODATA_TIMEOUT}`

No data timeout for active agents. Consider to keep it relatively high.

Default:

30m

Macro: `{$AGENT.TIMEOUT}`

Timeout after which agent is considered unavailable.

Default:

5m

Macro: `{$CPU.INTERRUPT.CRIT.MAX}`

The critical threshold of the % Interrupt Time counter.

Default:

Macro: `{$CPU.PRIV.CRIT.MAX}`

The threshold of the % Privileged Time counter.

Default:

Macro: `{$CPU.QUEUE.CRIT.MAX}`

The threshold of the Processor Queue Length counter.

Default:

Macro: `{$CPU.UTIL.CRIT}`

The critical threshold of the CPU utilization expressed in %.

Default:

Macro: `{$IF.ERRORS.WARN}`

Warning threshold of error packet rate. Can be used with interface name as context.

Default:

Macro: `{$IF.UTIL.MAX}`

Used as a threshold in the interface utilization trigger.

Default:

Macro: `{$IFCONTROL}`

Macro for the interface operational state for the "link down" trigger. Can be used with interface name as context.

Default:

Macro: `{$MEM.PAGE_SEC.CRIT.MAX}`

The warning threshold of the Memory Pages/sec counter.

Default:

Macro: `{$MEM.PAGE_TABLE_CRIT.MIN}`

The warning threshold of the Free System Page Table Entries counter.

Default:

Macro: `{$MEMORY.UTIL.MAX}`

The warning threshold of the Memory util item.

Default:

Macro: `{$NET.IF.IFALIAS.MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

.*

Macro: `{$NET.IF.IFALIAS.NOT_MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

CHANGE_THIS

Macro: `{$NET.IF.IFDESCR.MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

.*

Macro: `{$NET.IF.IFDESCR.NOT_MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

CHANGE_THIS

Macro: `{$NET.IF.IFNAME.MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

.*

Macro: `{$NET.IF.IFNAME.NOT_MATCHES}`

Used in Network interface discovery. Can be overridden on the host or linked template level.

Default:

Miniport|Virtual|Teredo|Kernel|Loopback|Bluetooth|HTTPS|6to4|QoS|Layer

Macro: `{$SERVICE.NAME.MATCHES}`

Used in Service discovery. Can be overridden on the host or linked template level.

Default:

^.*$

Macro: `{$SERVICE.NAME.NOT_MATCHES}`

Used in Service discovery. Can be overridden on the host or linked template level.

Default:

^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc|wuauserv|edgeupdate|cbdhsvc_.+)$

Macro: `{$SERVICE.STARTUPNAME.MATCHES}`

Used in Service discovery. Can be overridden on the host or linked template level.

Default:

^(?:automatic|automatic delayed)$

Macro: `{$SERVICE.STARTUPNAME.NOT_MATCHES}`

Used in Service discovery. Can be overridden on the host or linked template level.

Default:

^(?:manual|disabled)$

Macro: `{$SWAP.PFREE.MIN.WARN}`

The warning threshold of the minimum free swap.

Default:

Macro: `{$VFS.DEV.DEVNAME.MATCHES}`

Used in physical disk discovery. Can be overridden on the host or linked template level.

Default:

.*

Macro: `{$VFS.DEV.DEVNAME.NOT_MATCHES}`

Used in physical disk discovery. Can be overridden on the host or linked template level.

Default:

_Total

Macro: `{$VFS.DEV.READ.AWAIT.WARN}`

Disk read average response time (in s) before the trigger fires.

Default:

0.02

Macro: `{$VFS.DEV.UTIL.MAX.WARN}`

The warning threshold of disk time utilization in percent.

Default:

Macro: `{$VFS.DEV.WRITE.AWAIT.WARN}`

Disk write average response time (in s) before the trigger fires.

Default:

0.02