
# macOS by Zabbix agent

## Overview

This is an official MacOS template. It requires Zabbix agent 7.0 or newer.

#### Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
  - Utilization formula: `pused = 100 - 100 * (available / total - free + available)`
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.

## Requirements

Zabbix version: 7.0 and higher.

## Tested versions

This template has been tested on:
- macOS operating system

## Configuration

> Zabbix should be configured according to the instructions in the [Templates out of the box](https://www.zabbix.com/documentation/7.0/manual/config/templates_out_of_the_box) section.

## Setup

Install Zabbix agent on macOS according to Zabbix documentation.

### Macros used

|Name|Description|Default|
|----|-----------|-------|
|{$AGENT.TIMEOUT}|
Timeout after which the agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (in passive mode).
|`3m`|
|{$VFS.FS.FSNAME.NOT_MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`^(/dev\|/sys\|/run\|/proc\|.+/shm$)`|
|{$VFS.FS.FSNAME.MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`.+`|
|{$VFS.FS.FSTYPE.MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`Macro too long. Please see the template.`|
|{$VFS.FS.FSTYPE.NOT_MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`^\s$`|
|{$VFS.FS.INODE.PFREE.MIN.CRIT}|
The critical threshold of the filesystem metadata utilization.
|`10`|
|{$VFS.FS.INODE.PFREE.MIN.WARN}|
The warning threshold of the filesystem metadata utilization.
|`20`|
|{$VFS.FS.PUSED.MAX.CRIT}|
The critical threshold of the filesystem utilization.
|`90`|
|{$VFS.FS.PUSED.MAX.WARN}|
The warning threshold of the filesystem utilization.
|`80`|

### Items

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Maximum number of opened files|
May be increased by using the `sysctl` utility or modifying the file `/etc/sysctl.conf`.
|Zabbix agent|kernel.maxfiles|
|Maximum number of processes|
May be increased by using the `sysctl` utility or modifying the file `/etc/sysctl.conf`.
|Zabbix agent|kernel.maxproc|
|Incoming network traffic on en0||Zabbix agent|net.if.in[en0]
**Preprocessing**

- Change per second
- 
Custom multiplier: `8`

|
|Outgoing network traffic on en0||Zabbix agent|net.if.out[en0]
**Preprocessing**

- Change per second
- 
Custom multiplier: `8`

|
|Host boot time||Zabbix agent|system.boottime|
|Processor load (1 min average per core)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent|system.cpu.load[percpu,avg1]|
|Processor load (5 min average per core)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent|system.cpu.load[percpu,avg5]|
|Processor load (15 min average per core)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent|system.cpu.load[percpu,avg15]|
|Host name|
The host name of the system.
|Zabbix agent|system.hostname
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Host local time|
The local system time of the host.
|Zabbix agent|system.localtime|
|System information|
Information as normally returned by `uname -a`.
|Zabbix agent|system.uname
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|System uptime|
The system uptime expressed in the following format: "N days, hh:mm:ss".
|Zabbix agent|system.uptime|
|Number of logged in users|
The number of users who are currently logged in.
|Zabbix agent|system.users.num|
|Checksum of /etc/passwd||Zabbix agent|vfs.file.cksum[/etc/passwd,sha256]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|Available memory|
Defined as free + cached + buffers.
|Zabbix agent|vm.memory.size[available]|
|Total memory|
Total memory expressed in bytes.
|Zabbix agent|vm.memory.size[total]|
|Version of Zabbix agent running||Zabbix agent|agent.version
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Host name of Zabbix agent running||Zabbix agent|agent.hostname
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Zabbix agent ping|
The agent always returns "1" for this item. May be used in combination with `nodata()` for the availability check.
|Zabbix agent|agent.ping|
|Zabbix agent availability|
Used for monitoring the availability status of the agent.
|Zabbix internal|zabbix[host,agent,available]|
|Get filesystems|
The `vfs.fs.get` key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.
|Zabbix agent|vfs.fs.get|

### Triggers

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|macOS: Configured max number of opened files is too low||`last(/macOS by Zabbix agent/kernel.maxfiles)<1024`|Info||
|macOS: Configured max number of processes is too low||`last(/macOS by Zabbix agent/kernel.maxproc)<256`|Info||
|macOS: Processor load is too high||`avg(/macOS by Zabbix agent/system.cpu.load[percpu,avg1],5m)>5`|Warning||
|macOS: Hostname was changed||`last(/macOS by Zabbix agent/system.hostname,#1)<>last(/macOS by Zabbix agent/system.hostname,#2)`|Info||
|macOS: Host information was changed||`last(/macOS by Zabbix agent/system.uname,#1)<>last(/macOS by Zabbix agent/system.uname,#2)`|Info||
|macOS: Server has just been restarted||`change(/macOS by Zabbix agent/system.uptime)<0`|Info||
|macOS: /etc/passwd has been changed||`last(/macOS by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/macOS by Zabbix agent/vfs.file.cksum[/etc/passwd,sha256],#2)`|Warning||
|macOS: Lack of available memory on server||`last(/macOS by Zabbix agent/vm.memory.size[available])<20M`|Average||
|macOS: Zabbix agent is not available|
For passive checks only; the availability of the agent(s) and a host is used with `{$AGENT.TIMEOUT}` as the time threshold.
|`max(/macOS by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0`|Average|**Manual close**: Yes|

### LLD rule Mounted filesystem discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Mounted filesystem discovery|
The discovery of mounted filesystems with different types. Note that the option to exclude dmg software images from discovery is available only with Zabbix agents 6.4 and higher.
|Dependent item|vfs.fs.dependent.discovery
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Mounted filesystem discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|FS [{#FSNAME}]: Get data|
Intermediate data of `{#FSNAME}` filesystem.
|Dependent item|vfs.fs.dependent[{#FSNAME},data]
**Preprocessing**

- 
JSON Path: `$.[?(@.fsname=='{#FSNAME}')].first()`

|
|FS [{#FSNAME}]: Inodes: Free, in %|
Free metadata space expressed in %.
|Dependent item|vfs.fs.dependent.inode[{#FSNAME},pfree]
**Preprocessing**

- 
JSON Path: `$.inodes.pfree`

|
|FS [{#FSNAME}]: Space: Available|
Available storage space expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},free]
**Preprocessing**

- 
JSON Path: `$.bytes.free`

|
|FS [{#FSNAME}]: Space: Available, in %|
Deprecated metric.

Space availability expressed as a percentage, calculated using the current and maximum available spaces.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},pfree]
**Preprocessing**

- 
JSON Path: `$.bytes.pfree`

|
|FS [{#FSNAME}]: Space: Used, in %|
Calculated as the percentage of currently used space compared to the maximum available space.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},pused]
**Preprocessing**

- 
JSON Path: `$.bytes.pused`

|
|FS [{#FSNAME}]: Space: Total|
Total space expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},total]
**Preprocessing**

- 
JSON Path: `$.bytes.total`

|
|FS [{#FSNAME}]: Space: Used|
Used storage expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},used]
**Preprocessing**

- 
JSON Path: `$.bytes.used`

|

### Trigger prototypes for Mounted filesystem discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|macOS: FS [{#FSNAME}]: Running out of free inodes|
Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.
|`min(/macOS by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}`|Average||
|macOS: FS [{#FSNAME}]: Running out of free inodes|
Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.
|`min(/macOS by Zabbix agent/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"}`|Warning|**Depends on**:

- macOS: FS [{#FSNAME}]: Running out of free inodes
|
|macOS: FS [{#FSNAME}]: Space is critically low|
The volume's space usage exceeds the `{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%` limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.
|`min(/macOS by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}`|Average|**Manual close**: Yes|
|macOS: FS [{#FSNAME}]: Space is low|
The volume's space usage exceeds the `{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%` limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.
|`min(/macOS by Zabbix agent/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}`|Warning|**Manual close**: Yes
**Depends on**:

- macOS: FS [{#FSNAME}]: Space is critically low
|

## Feedback

Please report any issues with the template at [`https://support.zabbix.com`](https://support.zabbix.com)

You can also provide feedback, discuss the template, or ask for help at [`ZABBIX forums`](https://www.zabbix.com/forum/zabbix-suggestions-and-feedback)

