
# Linux by Zabbix agent active

## Overview

This is an official Linux template. It requires Zabbix agent 7.0 or newer.

#### Notes on filesystem (FS) discovery:
- The ext4/3/2 FS reserves space for privileged usage, typically set at 5% by default.
- BTRFS allocates a default of 10% of the volume for its own needs.
- To mitigate potential disasters, FS usage triggers are based on the maximum available space.
  - Utilization formula: `pused = 100 - 100 * (available / total - free + available)`
- The FS utilization chart, derived from graph prototypes, reflects FS reserved space as the difference between used and available space from the total volume.

## Requirements

Zabbix version: 7.0 and higher.

## Tested versions

This template has been tested on:
- Linux OS

## Configuration

> Zabbix should be configured according to the instructions in the [Templates out of the box](https://www.zabbix.com/documentation/7.0/manual/config/templates_out_of_the_box) section.

## Setup

Install Zabbix agent on Linux OS following Zabbix [documentation](https://www.zabbix.com/documentation/7.0/manual/concepts/agent#agent-on-unix-like-systems).

### Macros used

|Name|Description|Default|
|----|-----------|-------|
|{$AGENT.NODATA_TIMEOUT}|
No data timeout for active agents. Consider to keep it relatively high.
|`30m`|
|{$AGENT.TIMEOUT}|
Timeout after which agent is considered unavailable.
|`5m`|
|{$CPU.UTIL.CRIT}|
Critical threshold of CPU utilization expressed in %.
|`90`|
|{$LOAD_AVG_PER_CPU.MAX.WARN}|
The CPU load per core is considered sustainable. If necessary, it can be tuned.
|`1.5`|
|{$VFS.FS.FSNAME.NOT_MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`^(/dev\|/sys\|/run\|/proc\|.+/shm$)`|
|{$VFS.FS.FSNAME.MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`.+`|
|{$VFS.FS.FSTYPE.MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`Macro too long. Please see the template.`|
|{$VFS.FS.FSTYPE.NOT_MATCHES}|
Used for filesystem discovery. Can be overridden on the host or linked template level.
|`^\s$`|
|{$VFS.FS.INODE.PFREE.MIN.CRIT}|
The critical threshold of the filesystem metadata utilization.
|`10`|
|{$VFS.FS.INODE.PFREE.MIN.WARN}|
The warning threshold of the filesystem metadata utilization.
|`20`|
|{$VFS.FS.PUSED.MAX.CRIT}|
The critical threshold of the filesystem utilization.
|`90`|
|{$VFS.FS.PUSED.MAX.WARN}|
The warning threshold of the filesystem utilization.
|`80`|
|{$MEMORY.UTIL.MAX}|
Used as a thresholdin the memory utilization trigger.
|`90`|
|{$MEMORY.AVAILABLE.MIN}|
Used as a thresholdin the memory available trigger.
|`20M`|
|{$SWAP.PFREE.MIN.WARN}|
The warning threshold of the minimum free swap.
|`50`|
|{$VFS.DEV.READ.AWAIT.WARN}|
The average response time (in ms) of disk read before the trigger fires.
|`20`|
|{$VFS.DEV.WRITE.AWAIT.WARN}|
The average response time (in ms) of disk write before the trigger fires.
|`20`|
|{$VFS.DEV.DEVNAME.NOT_MATCHES}|
Used for block device discovery. Can be overridden on the host or linked template level.
|`Macro too long. Please see the template.`|
|{$VFS.DEV.DEVNAME.MATCHES}|
Used for block device discovery. Can be overridden on the host or linked template level.
|`.+`|
|{$IF.ERRORS.WARN}|
Warning threshold of error packet rate. Can be used with interface name as context.
|`2`|
|{$IFCONTROL}|
Link status trigger will be fired only for interfaces where the context macro equals "1".
|`1`|
|{$NET.IF.IFNAME.MATCHES}|
Used for network interface discovery. Can be overridden on the host or linked template level.
|`^.*$`|
|{$NET.IF.IFNAME.NOT_MATCHES}|
Filters out `loopbacks`, `nulls`, docker `veth` links and `docker0` bridge by default.
|`Macro too long. Please see the template.`|
|{$IF.UTIL.MAX}|
Used as a threshold in the interface utilization trigger.
|`90`|
|{$KERNEL.MAXPROC.MIN}||`1024`|
|{$KERNEL.MAXFILES.MIN}||`256`|

### Items

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Version of Zabbix agent running||Zabbix agent (active)|agent.version
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Host name of Zabbix agent running||Zabbix agent (active)|agent.hostname
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Zabbix agent ping|
The agent always returns "1" for this item. May be used in combination with `nodata()` for the availability check.
|Zabbix agent (active)|agent.ping|
|Active agent availability|
Availability of active checks on the host. The value of this item corresponds to availability icons in the host list.

Possible values:

0 - unknown

1 - available

2 - not available
|Zabbix internal|zabbix[host,active_agent,available]|
|Number of CPUs||Zabbix agent (active)|system.cpu.num
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Load average (1m avg)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent (active)|system.cpu.load[all,avg1]|
|Load average (5m avg)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent (active)|system.cpu.load[all,avg5]|
|Load average (15m avg)|
Calculated as the system CPU load divided by the number of CPU cores.
|Zabbix agent (active)|system.cpu.load[all,avg15]|
|CPU utilization|
CPU utilization expressed in %.
|Dependent item|system.cpu.util
**Preprocessing**

- 
JavaScript: `//Calculate utilization<br>return (100 - value)`

|
|CPU idle time|
Time the CPU has spent doing nothing.
|Zabbix agent (active)|system.cpu.util[,idle]|
|CPU system time|
Time the CPU has spent running the kernel and its processes.
|Zabbix agent (active)|system.cpu.util[,system]|
|CPU user time|
Time the CPU has spent running users' processes that are not niced.
|Zabbix agent (active)|system.cpu.util[,user]|
|CPU nice time|
Time the CPU has spent running users' processes that have been niced.
|Zabbix agent (active)|system.cpu.util[,nice]|
|CPU iowait time|
Time the CPU has been waiting for I/O to complete.
|Zabbix agent (active)|system.cpu.util[,iowait]|
|CPU steal time|
The amount of "stolen" CPU from this virtual machine by the hypervisor for other tasks, such as running another virtual machine.
|Zabbix agent (active)|system.cpu.util[,steal]|
|CPU interrupt time|
Time the CPU has spent servicing hardware interrupts.
|Zabbix agent (active)|system.cpu.util[,interrupt]|
|CPU softirq time|
Time the CPU has been servicing software interrupts.
|Zabbix agent (active)|system.cpu.util[,softirq]|
|CPU guest time|
Time spent on running a virtual CPU for a guest operating system.
|Zabbix agent (active)|system.cpu.util[,guest]|
|CPU guest nice time|
Time spent on running a niced guest (a virtual CPU for guest operating systems under the control of the Linux kernel).
|Zabbix agent (active)|system.cpu.util[,guest_nice]|
|Context switches per second|
The combined rate at which all processors on the computer are switched from one thread to another.
|Zabbix agent (active)|system.cpu.switches
**Preprocessing**

- Change per second
|
|Interrupts per second|
Number of interrupts processed.
|Zabbix agent (active)|system.cpu.intr
**Preprocessing**

- Change per second
|
|Get filesystems|
The `vfs.fs.get` key acquires raw information set about the filesystems. Later to be extracted by preprocessing in dependent items.
|Zabbix agent (active)|vfs.fs.get|
|Memory utilization|
The percentage of used memory is calculated as `100-pavailable`.
|Dependent item|vm.memory.utilization
**Preprocessing**

- 
JavaScript: `return (100-value);`

|
|Available memory in %|
The available memory as percentage of the total. See also Appendixes in Zabbix Documentation about parameters of the `vm.memory.size` item.
|Zabbix agent (active)|vm.memory.size[pavailable]|
|Total memory|
Total memory expressed in bytes.
|Zabbix agent (active)|vm.memory.size[total]|
|Available memory|
The available memory:

- in Linux = free + buffers + cache;

- on other platforms calculation may vary.

See also Appendixes in Zabbix Documentation about parameters of the `vm.memory.size` item.
|Zabbix agent (active)|vm.memory.size[available]|
|Total swap space|
The total space of the swap volume/file expressed in bytes.
|Zabbix agent (active)|system.swap.size[,total]|
|Free swap space|
The free space of the swap volume/file expressed in bytes.
|Zabbix agent (active)|system.swap.size[,free]|
|Free swap space in %|
The free space of the swap volume/file expressed in %.
|Zabbix agent (active)|system.swap.size[,pfree]|
|System uptime|
The system uptime expressed in the following format: "N days, hh:mm:ss".
|Zabbix agent (active)|system.uptime|
|System boot time||Zabbix agent (active)|system.boottime
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|System local time|
The local system time of the host.
|Zabbix agent (active)|system.localtime|
|System name|
The host name of the system.
|Zabbix agent (active)|system.hostname
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|System description|
The information as normally returned by `uname -a`.
|Zabbix agent (active)|system.uname
**Preprocessing**

- 
Discard unchanged with heartbeat: `12h`

|
|Number of logged in users|
The number of users who are currently logged in.
|Zabbix agent (active)|system.users.num|
|Maximum number of open file descriptors|
May be increased by using the `sysctl` utility or modifying the file `/etc/sysctl.conf`.
|Zabbix agent (active)|kernel.maxfiles
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Maximum number of processes|
May be increased by using the `sysctl` utility or modifying the file `/etc/sysctl.conf`.
|Zabbix agent (active)|kernel.maxproc
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Number of processes||Zabbix agent (active)|proc.num|
|Number of running processes||Zabbix agent (active)|proc.num[,,run]|
|Checksum of /etc/passwd||Zabbix agent (active)|vfs.file.cksum[/etc/passwd,sha256]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1h`

|
|Operating system||Zabbix agent (active)|system.sw.os
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Operating system architecture|
The architecture of the operating system.
|Zabbix agent (active)|system.sw.arch
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Number of installed packages||Zabbix agent (active)|system.sw.packages.get
**Preprocessing**

- 
JSON Path: `$.length()`

- 
Discard unchanged with heartbeat: `12h`

|

### Triggers

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Linux: Zabbix agent is not available|
For active agents, `nodata()` with `agent.ping` is used with `{$AGENT.NODATA_TIMEOUT}` as a time threshold.
|`nodata(/Linux by Zabbix agent active/agent.ping,{$AGENT.NODATA_TIMEOUT})=1`|Average|**Manual close**: Yes|
|Linux: Active checks are not available|
Active checks are considered unavailable. Agent has not sent a heartbeat for a prolonged time.
|`min(/Linux by Zabbix agent active/zabbix[host,active_agent,available],{$AGENT.TIMEOUT})=2`|High||
|Linux: Load average is too high|
The load average per CPU is too high. The system may be slow to respond.
|`min(/Linux by Zabbix agent active/system.cpu.load[all,avg1],5m)/last(/Linux by Zabbix agent active/system.cpu.num)>{$LOAD_AVG_PER_CPU.MAX.WARN} and last(/Linux by Zabbix agent active/system.cpu.load[all,avg5])>0 and last(/Linux by Zabbix agent active/system.cpu.load[all,avg15])>0`|Average||
|Linux: High CPU utilization|
CPU utilization is too high. The system might be slow to respond.
|`min(/Linux by Zabbix agent active/system.cpu.util,5m)>{$CPU.UTIL.CRIT}`|Warning|**Depends on**:

- Linux: Load average is too high
|
|Linux: High memory utilization|
The system is running out of free memory.
|`min(/Linux by Zabbix agent active/vm.memory.utilization,5m)>{$MEMORY.UTIL.MAX}`|Average|**Depends on**:

- Linux: Lack of available memory
|
|Linux: Lack of available memory|
The system is running out of memory.
|`max(/Linux by Zabbix agent active/vm.memory.size[available],5m)<{$MEMORY.AVAILABLE.MIN} and last(/Linux by Zabbix agent active/vm.memory.size[total])>0`|Average||
|Linux: High swap space usage|
If there is no swap configured, this trigger is ignored.
|`max(/Linux by Zabbix agent active/system.swap.size[,pfree],5m)<{$SWAP.PFREE.MIN.WARN} and last(/Linux by Zabbix agent active/system.swap.size[,total])>0`|Warning|**Depends on**:

- Linux: Lack of available memory
- Linux: High memory utilization
|
|Linux: {HOST.NAME} has been restarted|
The host uptime is less than 10 minutes.
|`last(/Linux by Zabbix agent active/system.uptime)<10m`|Warning|**Manual close**: Yes|
|Linux: System name has changed|
The name of the system has changed. Acknowledge to close the problem manually.
|`change(/Linux by Zabbix agent active/system.hostname) and length(last(/Linux by Zabbix agent active/system.hostname))>0`|Info|**Manual close**: Yes|
|Linux: Configured max number of open filedescriptors is too low||`last(/Linux by Zabbix agent active/kernel.maxfiles)<{$KERNEL.MAXFILES.MIN}`|Info||
|Linux: Configured max number of processes is too low||`last(/Linux by Zabbix agent active/kernel.maxproc)<{$KERNEL.MAXPROC.MIN}`|Info|**Depends on**:

- Linux: Getting closer to process limit
|
|Linux: Getting closer to process limit||`last(/Linux by Zabbix agent active/proc.num)/last(/Linux by Zabbix agent active/kernel.maxproc)*100>80`|Warning||
|Linux: /etc/passwd has been changed||`last(/Linux by Zabbix agent active/vfs.file.cksum[/etc/passwd,sha256],#1)<>last(/Linux by Zabbix agent active/vfs.file.cksum[/etc/passwd,sha256],#2)`|Info|**Manual close**: Yes
**Depends on**:

- Linux: System name has changed
- Linux: Operating system description has changed
|
|Linux: Operating system description has changed|
The description of the operating system has changed. Possible reasons are that the system has been updated or replaced. Acknowledge to close the problem manually.
|`change(/Linux by Zabbix agent active/system.sw.os) and length(last(/Linux by Zabbix agent active/system.sw.os))>0`|Info|**Manual close**: Yes
**Depends on**:

- Linux: System name has changed
|
|Linux: Number of installed packages has been changed||`change(/Linux by Zabbix agent active/system.sw.packages.get)<>0`|Warning|**Manual close**: Yes|

### LLD rule Mounted filesystem discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Mounted filesystem discovery|
The discovery of mounted filesystems with different types.
|Dependent item|vfs.fs.dependent.discovery
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

- 
Discard unchanged with heartbeat: `1h`

|

### Item prototypes for Mounted filesystem discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|FS [{#FSNAME}]: Get data|
Intermediate data of `{#FSNAME}` filesystem.
|Dependent item|vfs.fs.dependent[{#FSNAME},data]
**Preprocessing**

- 
JSON Path: `$.[?(@.fsname=='{#FSNAME}')].first()`

|
|FS [{#FSNAME}]: Option: Read-only|
The filesystem is mounted as read-only. It is available only for Zabbix agents 6.4 and higher.
|Dependent item|vfs.fs.dependent[{#FSNAME},readonly]
**Preprocessing**

- 
JSON Path: `$.options`

⛔️Custom on fail: Discard value

- 
Regular expression: `(?:^|,)ro\b 1`

⛔️Custom on fail: Set value to: `0`

|
|FS [{#FSNAME}]: Space: Used|
Used storage expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},used]
**Preprocessing**

- 
JSON Path: `$.bytes.used`

|
|FS [{#FSNAME}]: Space: Total|
Total space expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},total]
**Preprocessing**

- 
JSON Path: `$.bytes.total`

|
|FS [{#FSNAME}]: Space: Available|
Available storage space expressed in bytes.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},free]
**Preprocessing**

- 
JSON Path: `$.bytes.free`

|
|FS [{#FSNAME}]: Space: Used, in %|
Calculated as the percentage of currently used space compared to the maximum available space.
|Dependent item|vfs.fs.dependent.size[{#FSNAME},pused]
**Preprocessing**

- 
JSON Path: `$.bytes.pused`

|
|FS [{#FSNAME}]: Inodes: Free, in %|
Free metadata space expressed in %.
|Dependent item|vfs.fs.dependent.inode[{#FSNAME},pfree]
**Preprocessing**

- 
JSON Path: `$.inodes.pfree`

|

### Trigger prototypes for Mounted filesystem discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Linux: FS [{#FSNAME}]: Filesystem has become read-only|
The filesystem has become read-only, possibly due to an I/O error. Available only for Zabbix agents 6.4 and higher.
|`last(/Linux by Zabbix agent active/vfs.fs.dependent[{#FSNAME},readonly],#2)=0 and last(/Linux by Zabbix agent active/vfs.fs.dependent[{#FSNAME},readonly])=1`|Average|**Manual close**: Yes|
|Linux: FS [{#FSNAME}]: Space is critically low|
The volume's space usage exceeds the `{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%` limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.
|`min(/Linux by Zabbix agent active/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}`|Average|**Manual close**: Yes|
|Linux: FS [{#FSNAME}]: Space is low|
The volume's space usage exceeds the `{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%` limit.
The trigger expression is based on the current used and maximum available spaces.
Event name represents the total volume space, which can differ from the maximum available space, depending on the filesystem type.
|`min(/Linux by Zabbix agent active/vfs.fs.dependent.size[{#FSNAME},pused],5m)>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}`|Warning|**Manual close**: Yes
**Depends on**:

- Linux: FS [{#FSNAME}]: Space is critically low
|
|Linux: FS [{#FSNAME}]: Running out of free inodes|
Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.
|`min(/Linux by Zabbix agent active/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.CRIT:"{#FSNAME}"}`|Average||
|Linux: FS [{#FSNAME}]: Running out of free inodes|
Disk writing may fail if index nodes are exhausted, leading to error messages like "No space left on device" or "Disk is full", despite available free space.
|`min(/Linux by Zabbix agent active/vfs.fs.dependent.inode[{#FSNAME},pfree],5m)<{$VFS.FS.INODE.PFREE.MIN.WARN:"{#FSNAME}"}`|Warning|**Depends on**:

- Linux: FS [{#FSNAME}]: Running out of free inodes
|

### LLD rule Block devices discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Block devices discovery||Zabbix agent (active)|vfs.dev.discovery|

### Item prototypes for Block devices discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|{#DEVNAME}: Get stats|
The contents of get `/sys/block/{#DEVNAME}/stat` to get the disk statistics.
|Zabbix agent (active)|vfs.file.contents[/sys/block/{#DEVNAME}/stat]
**Preprocessing**

- 
JavaScript: `return JSON.stringify(value.trim().split(/ +/));`

|
|{#DEVNAME}: Disk read rate|
r/s (read operations per second) - the number (after merges) of read requests completed per second for the device.
|Dependent item|vfs.dev.read.rate[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[0]`

- Change per second
|
|{#DEVNAME}: Disk write rate|
w/s (write operations per second) - the number (after merges) of write requests completed per second for the device.
|Dependent item|vfs.dev.write.rate[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[4]`

- Change per second
|
|{#DEVNAME}: Disk read time (rate)|
The rate of total read time counter; used in `r_await` calculation.
|Dependent item|vfs.dev.read.time.rate[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[3]`

- Change per second
- 
Custom multiplier: `0.001`

|
|{#DEVNAME}: Disk write time (rate)|
The rate of total write time counter; used in `w_await` calculation.
|Dependent item|vfs.dev.write.time.rate[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[7]`

- Change per second
- 
Custom multiplier: `0.001`

|
|{#DEVNAME}: Disk read request avg waiting time (r_await)|
This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.
|Calculated|vfs.dev.read.await[{#DEVNAME}]|
|{#DEVNAME}: Disk write request avg waiting time (w_await)|
This formula contains two Boolean expressions that evaluate to 1 or 0 in order to set the calculated metric to zero and to avoid the exception - division by zero.
|Calculated|vfs.dev.write.await[{#DEVNAME}]|
|{#DEVNAME}: Disk average queue size (avgqu-sz)|
The current average disk queue; the number of requests outstanding on the disk while the performance data is being collected.
|Dependent item|vfs.dev.queue_size[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[10]`

- Change per second
- 
Custom multiplier: `0.001`

|
|{#DEVNAME}: Disk utilization|
The percentage of elapsed time during which the selected disk drive was busy while servicing read or write requests.
|Dependent item|vfs.dev.util[{#DEVNAME}]
**Preprocessing**

- 
JSON Path: `$[9]`

- Change per second
- 
Custom multiplier: `0.1`

|

### Trigger prototypes for Block devices discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Linux: {#DEVNAME}: Disk read/write request responses are too high|
This trigger might indicate the disk `{#DEVNAME}` saturation.
|`min(/Linux by Zabbix agent active/vfs.dev.read.await[{#DEVNAME}],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"} or min(/Linux by Zabbix agent active/vfs.dev.write.await[{#DEVNAME}],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}`|Warning|**Manual close**: Yes|

### LLD rule Network interface discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Network interface discovery|
The discovery of network interfaces.
|Zabbix agent (active)|net.if.discovery|

### Item prototypes for Network interface discovery

|Name|Description|Type|Key and additional info|
|----|-----------|----|-----------------------|
|Interface {#IFNAME}: Bits received||Zabbix agent (active)|net.if.in["{#IFNAME}"]
**Preprocessing**

- Change per second
- 
Custom multiplier: `8`

|
|Interface {#IFNAME}: Bits sent||Zabbix agent (active)|net.if.out["{#IFNAME}"]
**Preprocessing**

- Change per second
- 
Custom multiplier: `8`

|
|Interface {#IFNAME}: Outbound packets with errors||Zabbix agent (active)|net.if.out["{#IFNAME}",errors]
**Preprocessing**

- Change per second
|
|Interface {#IFNAME}: Inbound packets with errors||Zabbix agent (active)|net.if.in["{#IFNAME}",errors]
**Preprocessing**

- Change per second
|
|Interface {#IFNAME}: Outbound packets discarded||Zabbix agent (active)|net.if.out["{#IFNAME}",dropped]
**Preprocessing**

- Change per second
|
|Interface {#IFNAME}: Inbound packets discarded||Zabbix agent (active)|net.if.in["{#IFNAME}",dropped]
**Preprocessing**

- Change per second
|
|Interface {#IFNAME}: Operational status|
Reference: https://www.kernel.org/doc/Documentation/networking/operstates.txt
|Zabbix agent (active)|vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"]
**Preprocessing**

- 
JavaScript: `The text is too long. Please see the template.`

|
|Interface {#IFNAME}: Interface type|
It indicates the interface protocol type as a decimal value.

See `include/uapi/linux/if_arp.h` for all possible values.

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net
|Zabbix agent (active)|vfs.file.contents["/sys/class/net/{#IFNAME}/type"]
**Preprocessing**

- 
Discard unchanged with heartbeat: `1d`

|
|Interface {#IFNAME}: Speed|
It indicates the latest or current speed value of the interface. The value is an integer representing the link speed expressed in bits/sec.

This attribute is only valid for the interfaces that implement the ethtool `get_link_ksettings` method (mostly Ethernet).

Reference: https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-class-net
|Zabbix agent (active)|vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]
**Preprocessing**

- 
Custom multiplier: `1000000`

- 
Discard unchanged with heartbeat: `1h`

|

### Trigger prototypes for Network interface discovery

|Name|Description|Expression|Severity|Dependencies and additional info|
|----|-----------|----------|--------|--------------------------------|
|Linux: Interface {#IFNAME}: High bandwidth usage|
The utilization of the network interface is close to its estimated maximum bandwidth.
|`(avg(/Linux by Zabbix agent active/net.if.in["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"]) or avg(/Linux by Zabbix agent active/net.if.out["{#IFNAME}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])) and last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0`|Warning|**Manual close**: Yes
**Depends on**:

- Linux: Interface {#IFNAME}: Link down
|
|Linux: Interface {#IFNAME}: High error rate|
It recovers when it is below 80% of the `{$IF.ERRORS.WARN:"{#IFNAME}"}` threshold.
|`min(/Linux by Zabbix agent active/net.if.in["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"} or min(/Linux by Zabbix agent active/net.if.out["{#IFNAME}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}`|Warning|**Manual close**: Yes
**Depends on**:

- Linux: Interface {#IFNAME}: Link down
|
|Linux: Interface {#IFNAME}: Link down|
This trigger expression works as follows:
1. It can be triggered if the operations status is down.
2. `{$IFCONTROL:"{#IFNAME}"}=1` - a user can redefine the context macro to "0", marking this interface as not important. No new trigger will be fired if this interface is down.
3. `last(/TEMPLATE_NAME/METRIC,#1)<>last(/TEMPLATE_NAME/METRIC,#2)` - the trigger fires only if the operational status was up to (1) sometime before (so, does not fire for "eternal off" interfaces.)

WARNING: if closed manually - it will not fire again on the next poll, because of .diff.
|`{$IFCONTROL:"{#IFNAME}"}=1 and last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])=2 and (last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#1)<>last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"],#2))`|Average|**Manual close**: Yes|
|Linux: Interface {#IFNAME}: Ethernet has changed to lower speed than it was before|
This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Acknowledge to close the problem manually.
|`change(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])<0 and last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/speed"])>0 and (last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=6 or last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/type"])=1) and (last(/Linux by Zabbix agent active/vfs.file.contents["/sys/class/net/{#IFNAME}/operstate"])<>2)`|Info|**Manual close**: Yes
**Depends on**:

- Linux: Interface {#IFNAME}: Link down
|

## Feedback

Please report any issues with the template at [`https://support.zabbix.com`](https://support.zabbix.com)

You can also provide feedback, discuss the template, or ask for help at [`ZABBIX forums`](https://www.zabbix.com/forum/zabbix-suggestions-and-feedback)

