Zabbix adding Linux and windows templates

*Go to Configuration -> Templates -> Create template and add your template name, group, and description.

*Add macros

We want to monitor these three parameters:

*number of processes, with alerting if it less than a certain value

*memory usage, with alerting on high usage

*CPU usage, with alerting on high load

So, let’s create default values for it. We can use macros as placeholders to be able re-define this values in host configuration.

we created 6 macros:

{$PROC_CPU_MAX} => 70

{$PROC_MEM_MAX} => 2000000000

{$PROC_COUNT_MIN} => 1

{$PROC_NAME} => apache2

{$PROC_CPU_NORM} => 10

{$PROC_MEM_NORM} => 1000000000

Here you can see CPU max usage 70%, max memory limit 2G, minimum 1 process running, and process name apache2 for example. But we should also define normal values for trigger hysteresis to avoid a flapping state (see below). So we also defined {$PROC_CPU_NORM} as 10% and {$PROC_MEM_NORM} as 1G.

*Add items

Now we need to add incoming data items. Go to the Items menu under the current template and click Create item button. Create 3 items:

*number of process

*CPU usage

*memory usage

*Triggers with hysteresis

Now we need to create triggers. Let’s construct it. Go to template Triggers menu. You can use the built-in Zabbix constructor by clicking Problem expression -> Add button, select item and function. For example last (most recent) T value. But it’s only one value. It can change every time. To detect hard status, when the same value will repeat several times, it is better to use the count function.

So we want to create a trigger problem expression that will be fired when memory usage will greater than {$PROC_MEM_MAX} 3 times in a row.

#{Linux process monitoring:proc.mem[{$PROC_NAME}].count(#3,{$PROC_MEM_MAX},gt)}>=3

You can read this expression as: “count of last 3 values (#3) which greater (gt) than {$PROC_MEM_MAX} was >= 3 times”. This means that the last (most recent) 3 item values were greater than PROC_MEM_MAX 3 times in a row. So each of these three values was greater than the maximum. It is a good solution to detect the hard state of the problem.

Every 5-10 minutes it’s flipping between greater and less than critical value! It gets 3 overloaded values and fires a trigger, then it gets 3 normal values and marks trigger as RESOLVED! What we shall do? We need to create hysteresis with normal values. The trigger will be in a PROBLEM state till the item value will decrease to ${PROC_MEM_NORM}.

So click to OK event generation -> Recovery expression and add this expression:

#{Linux process monitoring:proc.mem[{$PROC_NAME}].count(#3,{$PROC_MEM_NORM},le)}>=3

we can add according expressions to other triggers (MEM and Number of process):

{Linux process monitoring:proc.mem[{$PROC_NAME}].count(#3,{$PROC_MEM_MAX},gt)}>=3

{Linux process monitoring:proc.mem[{$PROC_NAME}].count(#3,{$PROC_MEM_NORM},le)}>=3

{Linux process monitoring:proc.cpu.util[{$PROC_NAME}].count(#3,{$PROC_CPU_MAX},gt)>=3

{Linux process monitoring:proc.cpu.util[{$PROC_NAME}].count(#3,{$PROC_CPU_NORM},le)}>=3

{Linux process monitoring:proc.num[{$PROC_NAME}].count(#3,{$PROC_COUNT_MIN},lt)}>=3

{Linux process monitoring:proc.num[{$PROC_NAME}].count(#3,{$PROC_COUNT_MIN},ge)}>=3

*Configure host

Now we can add this template to our host. Go to Configuration -> Hosts -> your server -> Templates. And add your brand new template to the server.