3.4
2018-06-11T11:38:42Z
Templates
OS Windows
OS Windows
Base OS Windows template.
Version: 1.0.4 (2018-06-04)
URL: https://github.com/kloczek/zabbix-templates/tree/master/OS%20Windows
Notes:
Templates
BLOC
CPU
CSC
DSK
GPU
HW
HW::CPU
HW::NIC
LOG
MEM
NET
NET::DRT
NET::PNR
NTP
OBJ
PROC
SEC
SIND
SMB
SVC
SYS
SYS::SRV
THRD
TSS
-
LOG::APP::Errors
7
eventlog[Application,,"Error"]
1m
2w
0
0
2
0
0
0
0
captures Application (event log) errors
0
LOG
-
LOG::APP::zabbix_agent::all
7
eventlog[Application,,,"Zabbix Agent"]
1m
2w
0
0
2
0
0
0
0
captures Zabbix Agent Application (event log) messages
0
LOG
-
LOG::SEC::Errors
7
eventlog[Security,,"Error"]
1m
2w
0
0
2
0
0
0
0
captures security (event log) errors
0
LOG
-
LOG::SET::Errors
7
eventlog[Setup,,"Error"]
1m
2w
0
0
2
0
0
0
0
captures setup (event log) errors
0
LOG
-
LOG::SYS::Errors
7
eventlog[System,,"Error"]
1m
2w
0
0
2
0
0
0
0
captures system (event log) errors
0
LOG
-
MEM::CAC::Copy Read Hits
7
perf_counter[\Cache\Copy Read Hits %]
1m
2w
365d
0
3
%
0
0
0
0
Counter for hit rates and miss rates. Any value over 80 percent indicates that the application uses the cache very efficiently. Compare this counter against Cache\Copy Reads/sec to see how many hits you are really getting. Even though the hit percentage is small, if the rate of operations is high, this might indicate better cache effectiveness than a high percentage with a low rate of operations.
0
MEM
-
MEM::CAC::Copy Reads
7
perf_counter[\Cache\Copy Reads/sec]
1m
2w
365d
0
0
0
0
0
0
Counter to see the rate at which the file system attempts to find application data in the cache without accessing the disk. This is a count of all copy read calls to the cache, including hits and misses. Copy reads are the usual method by which file data found in the cache is copied into an applications memory buffers.
0
MEM
-
MEM::CAC::Data Flushes
7
perf_counter[\Cache\Data Flushes/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which cache data is being written back to disk. This counter reports application requests to flush data from the cache and is an indirect indicator of the volume and frequency of application data changes.
0
MEM
-
MEM::CAC::Data Flush Pages
7
perf_counter[\Cache\Data Flush Pages/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which both applications change pages of cached data and the pages are written back to disk. This includes pages that have been written by the system process when many changed pages have accumulated, pages that have been flushed so that the cache can be trimmed, and disk writes that are caused by an application write-through request.
0
MEM
-
MEM::CAC::Data Maps
7
perf_counter[\Cache\Data Maps/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which file systems map pages of a file into the cache for reading. This counter reports read-only access to file system directories, the file allocation table (FAT) in the FAT file system, and the Master File Table in the NTFS file system. This counter does not reflect cache use by applications.
0
MEM
-
MEM::CAC::Fast Reads
7
perf_counter[\Cache\Fast Reads/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which applications bypass the file system and access data directly from the cache. A value over 50 percent indicates the application is behaving efficiently. Fast reads reduce processor overhead and are preferable to I/O requests.
0
MEM
-
MEM::CAC::Lazy Write Flushes
7
perf_counter[\Cache\Lazy Write Flushes/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which an application changes data, causing the cache to write to the disk and flush the data. If this value reflects an upward trend, memory might be becoming low. Lazy write flushes are a subset of data flushes. The lazy writer thread in the system process periodically writes changed pages from the modified page list back to disk and flushes them from the cache. This thread is activated more often when memory needs to be released for other uses. This counter counts the number of write and flush operations, regardless of the amount of data written.
0
MEM
-
MEM::CAC::Lazy Write Pages
7
perf_counter[\Cache\Lazy Write Pages/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which pages are changed by an application and written to the disk. If the counter value is increasing, this can indicate that memory is becoming low. Cache\Lazy Write Pages are a subset of Data Flush Pages.
0
MEM
-
MEM::CAC::Read Aheads
7
perf_counter[\Cache\Read Aheads/sec]
1m
2w
365d
0
0
0
0
0
0
Counter to monitor the rate at which the Cache Manager detects that the file is being accessed sequentially. Sequential file access is a very efficient strategy in most cases. During sequential file access, the Cache Manager can read larger blocks of data into the cache on each I/O, thereby reducing the overhead per access.
0
MEM
-
GPU::Local Adapter Memory Usage
7
perf_counter[\GPU Local Adapter Memory(*)\Local Usage]
1m
2w
365d
1
0
%
0
0
0
0
WIP, as (*) expands to something which does not have total values like processor.
TypePerf.exe -qx on cmd prompt
\GPU Local Adapter Memory(luid_0x00000000_0x00007E53_phys_0_part_0)\Local Usage
\GPU Local Adapter Memory(luid_0x00000000_0x000073F5_phys_0)\Local Usage
0
GPU
-
DSK::Logical Disk Average Read
7
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Read]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
DSK::Logical Disk Average Transfer
7
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Transfer]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
DSK::Logical Disk Average Write
7
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Write]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
MEM::Committed Used
7
perf_counter[\Memory\% Committed Bytes In Use]
1m
2w
365d
0
0
%
0
0
0
0
Ratio of Memory \ Committed Bytes to the Memory \ Commit Limit.
Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive.
https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/
0
MEM
-
MEM::Available
7
perf_counter[\Memory\Available Bytes]
1m
2w
365d
0
3
B
0
0
0
0
Amount of physical memory immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. Can also be indication of how much physical memory is remaining after the working sets of running processes and the cache have been served.
0
MEM
-
MEM::CAC::Faults
7
perf_counter[\Memory\Cache Faults/sec]
1m
2w
365d
0
0
0
0
0
0
Counter for the rate at which pages sought in the cache were not found there and had to be obtained elsewhere in memory or on the disk. Compare this counter against Memory\Page Faults/sec and Pages Input/sec to determine the number of hard page faults, if any.
0
MEM
-
MEM::Commit Limit
7
perf_counter[\Memory\Commit Limit]
1m
2w
365d
0
3
B
0
0
0
0
The system commit limit of Windows and Windows Server is the sum of physical memory and the size of all of the page files combined on the system. It is the maximum amount of physical resources that the system can use to back committed memory. It is a factitious resource that prevents the system from over committing or over "promising" too much physical resources. With that said, when the system is unable to commit anymore memory, then applications may fail to function and the system may hang indefinitely.
https://social.technet.microsoft.com/wiki/contents/articles/2248.perfguide-out-of-system-committed-memory.aspx
https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/
0
MEM
-
MEM::Committed
7
perf_counter[\Memory\Committed Bytes]
1m
2w
365d
0
3
B
0
0
0
0
Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive.
https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/
0
MEM
-
MEM::Demand Zero Faults
7
perf_counter[\Memory\Demand Zero Faults/sec]
1m
2w
365d
0
0
0
0
0
0
WIP...
0
MEM
-
MEM::PTE::Free entries
7
perf_counter[\Memory\Free System Page Table Entries]
10m
2w
365d
0
3
0
0
0
0
A page table is the data structure used by the Windows Virtual Memory Manager (VMM) to store the mapping between virtual addresses and physical addresses in memory. The performance counter Free System Page Table Entries is the number of page table entries not currently used by the system. More important to observe with 32-bit Windows OS.
https://blogs.technet.microsoft.com/clint_huffman/2008/04/07/free-system-page-table-entries-ptes/
0
MEM
-
MEM::Page Faults
7
perf_counter[\Memory\Page Faults/sec]
1m
2w
365d
0
0
pages/s
0
0
0
0
0
MEM
-
MEM::Page Reads
7
perf_counter[\Memory\Page Reads/sec]
1m
2w
365d
0
0
pages/s
0
0
0
0
0
MEM
-
MEM::Pages
7
perf_counter[\Memory\Pages/sec]
1m
2w
365d
0
0
0
0
0
0
Indicates the number of requested pages that were not immediately available in RAM and had to be read from the disk or had to be written to the disk to make room in RAM for other pages. If your system experiences a high rate of hard page faults, the value for Memory\Pages/sec can be high.
0
MEM
-
MEM::Pages Input
7
perf_counter[\Memory\Pages Input/sec]
1m
2w
365d
0
0
0
0
0
0
0
MEM
-
MEM::Pages Output
7
perf_counter[\Memory\Pages Output/sec]
1m
2w
365d
0
0
0
0
0
0
0
MEM
-
MEM::Pool Paged
7
perf_counter[\Memory\Pool Paged Bytes]
1m
2w
365d
0
0
0
0
0
0
Area of system memory (physical memory used by the operating system) for objects that can be written to disk when they are not being used. Memory \ Pool Paged Bytes is calculated differently than Process \ Pool Paged Bytes, so it might not equal Process \ Pool Paged Bytes \ _Total.
https://blogs.technet.microsoft.com/askperf/2008/01/25/an-overview-of-troubleshooting-memory-issues/
0
MEM
-
MEM::Transition Faults
7
perf_counter[\Memory\Transition Faults/sec]
1m
2w
365d
0
0
0
0
0
0
TBC...
0
MEM
-
MEM::Transition Pages Repurposed
7
perf_counter[\Memory\Transition Pages RePurposed/sec]
1m
2w
365d
0
0
0
0
0
0
TBC...
0
MEM
-
MEM::Write Copies
7
perf_counter[\Memory\Write Copies/sec]
1m
2w
365d
0
0
0
0
0
0
WIP
0
MEM
-
OBJ::Object Events
7
perf_counter[\Objects\Events]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
OBJ::Object Mutexes
7
perf_counter[\Objects\Mutexes]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
OBJ::Object Processes
7
perf_counter[\Objects\Processes]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
OBJ::Object Sections
7
perf_counter[\Objects\Sections]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
OBJ::Object Semaphores
7
perf_counter[\Objects\Semaphores]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
OBJ::Object Threads
7
perf_counter[\Objects\Threads]
1m
2w
365d
0
3
0
0
0
0
0
OBJ
-
DSK::Average disk read queue length
7
perf_counter[\PhysicalDisk(_Total)\Avg. Disk Read Queue Length]
1m
2w
365d
0
0
0
0
0
0
0
DSK
-
DSK::Physical Disk Average Read
7
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Read]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
DSK::Physical Disk Average Transfer
7
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Transfer]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
DSK::Physical Disk Average Write
7
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Write]
1m
2w
365d
0
0
Bps
0
0
0
0
0
DSK
-
DSK::Average disk write queue length
7
perf_counter[\PhysicalDisk(_Total)\Avg. Disk Write Queue Length]
1m
2w
365d
0
0
0
0
0
0
0
DSK
-
Process Privileged Time
7
perf_counter[\Process(_Total)\% Privileged Time]
1m
2w
365d
0
0
%
0
0
0
0
Shows the percentage of elapsed time that the threads of the process have spent executing code in privileged mode. When a Windows 2000 system service is called, the service often runs in Privileged Mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows 2000 uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 on behalf of your application might appear in other subsystem processes in addition to the privileged time in your process.
0
PROC
-
Process Processor Time
7
perf_counter[\Process(_Total)\% Processor Time]
1m
2w
365d
0
0
%
0
0
0
0
Shows the percentage of elapsed time that all of the threads of this process used the processor to execute instructions. An instruction is the basic unit of execution in a computer; a thread is the object that executes instructions; and a process is the object created when a program is run. Code executed to handle some hardware interrupts and trap conditions are included in this count.
0
PROC
-
Process User Time
7
perf_counter[\Process(_Total)\% User Time]
1m
2w
365d
0
0
%
0
0
0
0
Shows the percentage of elapsed time that this process's threads have spent executing code in user mode. Applications, environment subsystems, and integral subsystems execute in user mode. Code executing in user mode cannot damage the integrity of the Windows NT Executive, kernel, or and device drivers. Unlike some early operating systems, Windows 2000 uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. These subsystem processes provide additional protection. Therefore, some work done by Windows 2000 on behalf of your application might appear in other subsystem processes in addition to the privileged time in your process.
0
PROC
-
Process Creating Process ID
7
perf_counter[\Process(_Total)\Creating Process ID]
1m
2w
365d
0
0
0
0
0
0
Shows the identifier of the process that created the current process. Note that the creating process may have terminated since this process was created and so this value may no longer identify a running process.
0
PROC
-
Process Elapsed Time
7
perf_counter[\Process(_Total)\Elapsed Time]
1m
2w
365d
0
0
0
0
0
0
Shows the total elapsed time, in seconds, that this process has been running.
0
PROC
-
Process Handle Count
7
perf_counter[\Process(_Total)\Handle Count]
1m
2w
365d
0
0
0
0
0
0
Shows the total number of handles currently open by this process. This number is the equal to the sum of the handles currently open by each thread in this process.
0
PROC
-
Process ID Process
7
perf_counter[\Process(_Total)\ID Process]
1m
2w
365d
0
0
0
0
0
0
Shows the unique identifier of this process. ID Process numbers are reused, so they only identify a process for the lifetime of that process.
0
PROC
-
Process IO Data Bytes
7
perf_counter[\Process(_Total)\IO Data Bytes/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is reading and writing bytes in I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Data
7
perf_counter[\Process(_Total)\IO Data Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is issuing read and write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Other Bytes
7
perf_counter[\Process(_Total)\IO Other Bytes/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is issuing bytes to I/O operations that don't involve data such as control operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Other
7
perf_counter[\Process(_Total)\IO Other Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is issuing I/O operations that are neither a read or a write operation. An example of this type of operation would be a control function. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Read Bytes
7
perf_counter[\Process(_Total)\IO Read Bytes/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is reading bytes from I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Read Operations
7
perf_counter[\Process(_Total)\IO Read Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is issuing read I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Write Bytes
7
perf_counter[\Process(_Total)\IO Write Bytes/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate the process is writing bytes to I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process IO Write Operations
7
perf_counter[\Process(_Total)\IO Write Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which the process is issuing write I/O operations. This counter counts all I/O activity generated by the process to include file, network and device I/O's.
0
PROC
-
Process Page Faults
7
perf_counter[\Process(_Total)\Page Faults/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which page faults by the threads executing in this process are occurring. A page fault occurs when a thread refers to a virtual memory page that is not in its working set in main memory. This does not cause the page to be fetched from disk if it is on the standby list and hence already in main memory, or if it is in use by another process with whom the page is shared.
0
PROC
-
SYS::Page File Bytes
7
perf_counter[\Process(_Total)\Page File Bytes]
1m
2w
365d
0
3
0
0
0
0
Shows the current number of bytes that this process has used in the paging file(s). Paging files are used to store pages of memory used by the process that are not contained in other files. Paging files are shared by all processes, and lack of space in paging files can prevent other processes from allocating memory.
0
SYS
-
Process Pool Nonpaged Bytes
7
perf_counter[\Process(_Total)\Pool Nonpaged Bytes]
1m
2w
365d
0
0
0
0
0
0
Shows the number of bytes in the nonpaged pool, a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Nonpaged pool pages cannot be paged out to the paging file, but instead remain in main memory as long as they are allocated.
0
PROC
-
Process Pool Paged Bytes
7
perf_counter[\Process(_Total)\Pool Paged Bytes]
1m
2w
365d
0
0
0
0
0
0
Shows the number of bytes in the Paged Pool, a system memory area where space is acquired by operating system components as they accomplish their appointed tasks. Paged Pool pages can be paged out to the paging file when not accessed by the system for sustained periods of time.
0
PROC
-
Process Priority Base
7
perf_counter[\Process(_Total)\Priority Base]
1m
2w
365d
0
0
0
0
0
0
Shows the current base priority of this process. Threads within a process can raise and lower their own base priority relative to the process's base priority.
0
PROC
-
Process Private Bytes
7
perf_counter[\Process(_Total)\Private Bytes]
1m
2w
365d
0
0
0
0
0
0
Shows the current number of bytes that this process has allocated that cannot be shared with other processes.
0
PROC
-
Process Thread Count
7
perf_counter[\Process(_Total)\Thread Count]
1m
2w
365d
0
0
0
0
0
0
Shows the number of threads currently active in this process. An instruction is the basic unit of execution in a processor, and a thread is the object that executes instructions. Every running process has at least one thread.
0
PROC
-
Process Virtual Bytes
7
perf_counter[\Process(_Total)\Virtual Bytes]
1m
2w
365d
0
0
0
0
0
0
Shows the current size, in bytes, of the virtual address space that the process is using. Use of virtual address space does not necessarily imply corresponding use of either disk or main memory pages. Virtual space is finite, and by using too much, the process can limit its ability to load libraries.
0
PROC
-
Process Working Set Private
7
perf_counter[\Process(_Total)\Working Set - Private]
1m
2w
365d
0
0
0
0
0
0
0
PROC
-
Process Working Set
7
perf_counter[\Process(_Total)\Working Set]
1m
2w
365d
0
0
0
0
0
0
Shows the current number of bytes in the working set of this process. The working set is the set of memory pages touched recently by the threads in the process. If free memory in the computer is above a certain threshold, pages are left in the working set of a process even if they are not in use. When free memory falls below a certain threshold, pages are trimmed from working sets. If they are needed, they are then soft-faulted back into the working set before they leave main memory.
https://msdn.microsoft.com/en-us/library/ms804621.aspx
0
PROC
-
CPU::Processor::C1 Time
7
perf_counter[\Processor(_Total)\% C1 Time]
1m
2w
365d
0
0
%
0
0
0
0
%C1 Time – C1 is a power saving mode in a CPU. This counter keeps track of how often the process is able to enter a power saving state when idle. So %C1 Time is the percentage of time the LP is in the C1 state and for _Total the average percentage across all LP.
0
HW::CPU
-
CPU::Processor::C2 Time
7
perf_counter[\Processor(_Total)\% C2 Time]
1m
2w
365d
0
0
%
0
0
0
0
%C2 Time – C2 is a power saving mode in a CPU. This counter keeps track of how often the process is able to enter a power saving state when idle. So %C2 Time is the percentage of time the LP is in the C1 state and for _Total the average percentage across all LP. C2 is a deeper power state than C1
0
HW::CPU
-
CPU::Processor::C3 Time
7
perf_counter[\Processor(_Total)\% C3 Time]
1m
2w
365d
0
0
%
0
0
0
0
%C3 Time – C3 is a power saving mode in a CPU. This counter keeps track of how often the process is able to enter a power saving state when idle. So %C3 Time is the percentage of time the LP is in the C1 state and for _Total the average percentage across all LP. C3 is a deeper power state than C2
0
HW::CPU
-
SYS::Interrupt Time
7
perf_counter[\Processor(_Total)\% Interrupt Time]
1m
2w
365d
0
0
%
0
0
0
0
System interrupts per second
0
SYS
-
CPU::Privileged Time
7
perf_counter[\Processor(_Total)\% Privileged Time]
1m
2w
365d
0
0
%
0
0
0
0
Amount of time being spent in the Windows kernel executing system calls such as drivers, IRPs (I/O Request Packets), context switching, etc. If the operating system is spending more than 30% of it’s time in privileged mode, then it means that it is likely doing a high amount of I/O and one or more of the drivers are executing to manage that I/O.
https://blogs.technet.microsoft.com/perfguide/2010/09/28/user-mode-versus-privileged-mode-processor-usage/
0
CPU
-
CPU::Processor Time
7
perf_counter[\Processor(_Total)\% Processor Time]
1m
2w
365d
0
0
%
0
0
0
0
0
CPU
-
CPU::Processor User Time
7
perf_counter[\Processor(_Total)\% User Time]
1m
2w
365d
0
0
%
0
0
0
0
0
CPU
-
CPU::Processor::C1 Transitions
7
perf_counter[\Processor(_Total)\C1 Transitions/sec]
1m
2w
365d
0
0
0
0
0
0
C1 Transitions / Sec – Number of times the LP has entered the C1 state in one second or for _Total the number of C1 transitions across all LP.
0
HW::CPU
-
CPU::Processor::C2 Transitions
7
perf_counter[\Processor(_Total)\C2 Transitions/sec]
1m
2w
365d
0
0
0
0
0
0
C2 Transitions / Sec – Number of times the LP has entered the C2 state in one second or for _Total the number of C2 transitions across all LP. Deeper power state than C1.
0
HW::CPU
-
CPU::Processor::C3 Transitions
7
perf_counter[\Processor(_Total)\C3 Transitions/sec]
1m
2w
365d
0
0
0
0
0
0
C3 Transitions / Sec – Number of times the LP has entered the C3 state in one second or for _Total the number of C3 transitions across all LP. Deeper power state than C2.
0
HW::CPU
-
CPU::Processor::DPC Time
7
perf_counter[\Processor Information(_Total)\% DPC Time]
1m
2w
365d
0
0
%
0
0
0
0
Deferred Procedure Call (DPC) is a Windows OS mechanism which allows high-priority tasks (e.g. an interrupt handler) to defer required but lower-priority tasks for later execution. This permits device drivers and other low-level event consumers to perform the high-priority part of their processing quickly, and schedule non-critical additional processing for execution at a lower priority.
https://en.wikipedia.org/wiki/Deferred_Procedure_Call
https://technet.microsoft.com/en-us/library/cc938646.aspx
http://www.osronline.com/article.cfm?article=529
0
HW::CPU
-
CPU::Processor::Performance Limit
7
perf_counter[\Processor Information(_Total)\% Performance Limit]
1m
2w
365d
0
0
%
0
0
0
0
0
HW::CPU
-
CPU::Processor::DPC Rate
7
perf_counter[\Processor Information(_Total)\DPC Rate]
1m
2w
365d
0
0
0
0
0
0
Deferred Procedure Call (DPC) is a Windows OS mechanism which allows high-priority tasks (e.g. an interrupt handler) to defer required but lower-priority tasks for later execution. This permits device drivers and other low-level event consumers to perform the high-priority part of their processing quickly, and schedule non-critical additional processing for execution at a lower priority.
https://en.wikipedia.org/wiki/Deferred_Procedure_Call
https://technet.microsoft.com/en-us/library/cc938646.aspx
http://www.osronline.com/article.cfm?article=529
0
HW::CPU
-
CPU::Processor::DPCs Queued
7
perf_counter[\Processor Information(_Total)\DPCs Queued/sec]
1m
2w
365d
0
0
0
0
0
0
Deferred Procedure Call (DPC) is a Windows OS mechanism which allows high-priority tasks (e.g. an interrupt handler) to defer required but lower-priority tasks for later execution. This permits device drivers and other low-level event consumers to perform the high-priority part of their processing quickly, and schedule non-critical additional processing for execution at a lower priority.
https://en.wikipedia.org/wiki/Deferred_Procedure_Call
https://technet.microsoft.com/en-us/library/cc938646.aspx
http://www.osronline.com/article.cfm?article=529
0
HW::CPU
-
CPU::Processor::Performance Limit Flags
7
perf_counter[\Processor Information(_Total)\Performance Limit Flags]
1m
2w
365d
0
0
0
0
0
0
0
HW::CPU
-
CPU::Processor::Frequency
7
perf_counter[\Processor Information(_Total)\Processor Frequency]
1m
2w
365d
0
3
GHz
0
0
0
0
0
HW::CPU
-
CPU::Processor::State Flags
7
perf_counter[\Processor Information(_Total)\Processor State Flags]
1m
2w
365d
0
0
0
0
0
0
0
HW::CPU
-
SIND::SystemIndex::Index Active Connections
7
perf_counter[\Search Indexer(SystemIndex)\Active Connections]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Clean WidSets
7
perf_counter[\Search Indexer(SystemIndex)\Clean WidSets]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Dirty WidSets
7
perf_counter[\Search Indexer(SystemIndex)\Dirty WidSets]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Documents Filtered
7
perf_counter[\Search Indexer(SystemIndex)\Documents Filtered]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Index Size
7
perf_counter[\Search Indexer(SystemIndex)\Index Size]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Index Master Merge Progress
7
perf_counter[\Search Indexer(SystemIndex)\Master Merge Progress]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Master Merges Now
7
perf_counter[\Search Indexer(SystemIndex)\Master Merges Now.]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Master Merges to Date
7
perf_counter[\Search Indexer(SystemIndex)\Master Merges to Date]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Persistent Indexes
7
perf_counter[\Search Indexer(SystemIndex)\Persistent Indexes]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Index Queries Failed
7
perf_counter[\Search Indexer(SystemIndex)\Queries Failed]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Index Queries Succeeded
7
perf_counter[\Search Indexer(SystemIndex)\Queries Succeeded]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Index Queries
7
perf_counter[\Search Indexer(SystemIndex)\Queries]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Shadow Merge Levels Threshold
7
perf_counter[\Search Indexer(SystemIndex)\Shadow Merge Levels Threshold]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Shadow Merge Levels
7
perf_counter[\Search Indexer(SystemIndex)\Shadow Merge Levels]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Unique Keys
7
perf_counter[\Search Indexer(SystemIndex)\Unique Keys]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Work Items Created
7
perf_counter[\Search Indexer(SystemIndex)\Work Items Created]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SIND::SystemIndex::Work Items Deleted
7
perf_counter[\Search Indexer(SystemIndex)\Work Items Deleted]
5m
2w
365d
0
0
0
0
0
0
0
SIND
-
SYS::SRV::SMB::Blocking Requests Rejected
7
perf_counter[\Server\Blocking Requests Rejected]
5m
2w
365d
0
3
0
0
0
0
Shows the number of times that the server has rejected blocking server message block requests (SMBs) due to insufficient count of free work items. This counter indicates whether the MaxWorkItem or MinFreeWorkItems server registry parameters might need tuning.
0
SYS::SRV
-
SYS::SRV::Server Bytes Received
7
perf_counter[\Server\Bytes Received/sec]
5m
2w
365d
0
3
Bps
0
0
0
0
Shows the rate at which the server is receiving bytes from the network.
0
SYS::SRV
-
SYS::SRV::Server Bytes Total
7
perf_counter[\Server\Bytes Total/sec]
5m
2w
365d
0
3
Bps
0
0
0
0
Shows the rate at which the server is transmitting bytes through the network.
0
SYS::SRV
-
SYS::SRV::Server Bytes Transmitted
7
perf_counter[\Server\Bytes Transmitted/sec]
5m
2w
365d
0
3
Bps
0
0
0
0
Shows the rate at which the server is sending bytes on the network.
0
SYS::SRV
-
SYS::SRV::Errors Access Permissions
7
perf_counter[\Server\Errors Access Permissions]
5m
2w
365d
0
3
0
0
0
0
Shows the number of times attempts to open files on behalf of clients have failed with the message STATUS_ACCESS_DENIED. This counter can indicate if someone is attempting to access random files to improperly access a file that was not properly protected.
0
SYS::SRV
-
SYS::SRV::Errors Granted Access
7
perf_counter[\Server\Errors Granted Access]
5m
2w
365d
0
3
0
0
0
0
Shows the number of times that attempts to access files successfully opened were denied. This counter can indicate attempts to access files without proper access authorization.
0
SYS::SRV
-
SYS::SRV::Errors Logon
7
perf_counter[\Server\Errors Logon]
5m
2w
365d
0
3
0
0
0
0
Shows the number of failed logon attempts to the server. This counter can indicate whether password guessing programs are being used to crack the security on the server.
0
SYS::SRV
-
SYS::SRV::Errors System
7
perf_counter[\Server\Errors System]
5m
2w
365d
0
3
0
0
0
0
Shows the number of times that an internal server error was detected. Errors can reflect problems with logon, security, memory allocation, disk operations, transport driver interface operations, communication (such as receipt of unimplemented or unrecognized SMBs), or I/O Request Packet stack size for the server.
Many of these errors are also written to the System log and Security log in Event Viewer. The server can recover from most the errors displayed by this counter, but they are unexpected and should be reported to Microsoft Product Support Services.
0
SYS::SRV
-
SYS::SRV::Logon
7
perf_counter[\Server\Logon/sec]
5m
2w
365d
0
3
0
0
0
0
Shows the rate of all interactive logon attempts, network logon attempts, service logon attempts, successful logon attempts, and failed logon attempts.
0
SYS::SRV
-
SYS::SRV::Sessions
7
perf_counter[\Server\Server Sessions]
5m
2w
365d
0
3
0
0
0
0
Shows the number of sessions currently active in the server. This counter indicates current server activity.
0
SYS::SRV
-
SYS::SRV::Sessions Errored Out
7
perf_counter[\Server\Sessions Errored Out]
5m
2w
365d
0
3
0
0
0
0
Shows the number of sessions that have been closed due to unexpected error conditions. This counter indicates how frequently network problems are causing dropped sessions on the server. The Sessions Errored Out counter reports auto-disconnects along with errored-out sessions. For a more accurate value for errored-out sessions, obtain the value for Sessions Timed Out and reduce the Sessions Errored Out value by that amount.
0
SYS::SRV
-
SYS::SRV::Sessions Forced Off
7
perf_counter[\Server\Sessions Forced Off]
5m
2w
365d
0
3
0
0
0
0
Shows the number of sessions that have been forced to log off. This counter can indicate how many sessions were forced to log off due to logon time constraints.
0
SYS::SRV
-
SYS::SRV::Sessions Logged Off
7
perf_counter[\Server\Sessions Logged Off]
5m
2w
365d
0
3
0
0
0
0
Shows the number of sessions that have been forced to log off. This counter can indicate how many sessions were forced to log off due to logon time constraints.
0
SYS::SRV
-
SYS::SRV::Sessions Timed Out
7
perf_counter[\Server\Sessions Timed Out]
5m
2w
365d
0
3
0
0
0
0
Shows the number of sessions that have been closed because idle time exceeded the AutoDisconnect parameter for the server. This counter shows whether the AutoDisconnect setting is helping to conserve resources.
0
SYS::SRV
-
SYS::REG::Quota In Use
7
perf_counter[\System\% Registry Quota In Use]
10m
2w
365d
0
0
%
0
0
0
0
https://blogs.technet.microsoft.com/supportingwindows/2014/10/22/unable-to-restart-server-due-to-registry-bloat-over-2gb/
Total Registry Quota Allowed that is currently being used by the system
0
SYS
-
SYS::Alignment Fixups
7
perf_counter[\System\Alignment Fixups/sec]
1m
2w
365d
0
3
0
0
0
0
Rate of alignment faults fixed by the system.
https://msdn.microsoft.com/en-gb/library/ms804037.aspx
0
SYS
-
SYS::Context Switches
7
perf_counter[\System\Context Switches/sec]
4s
2w
365d
0
0
0
0
0
0
System (all CPUs) context switches per second.
0
SYS
-
SYS::Exception Dispatches
7
perf_counter[\System\Exception Dispatches/sec]
1m
2w
365d
0
0
0
0
0
0
Rate at which exceptions are dispatched by the system.
https://msdn.microsoft.com/en-gb/library/ms804037.aspx
0
SYS
-
SYS::File Control Operations
7
perf_counter[\System\File Control Operations/sec]
1m
2w
365d
0
0
0
0
0
0
combined rate of file system operations that are neither read nor write operations, such as file system control requests and requests for information about device characteristics or status. This is the inverse of System\System: File Data Operations/sec.
0
SYS
-
SYS::File Read Operations
7
perf_counter[\System\File Read Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Combined rate of file system read requests to all devices on the computer, including requests to read from the file system cache. It is measured in numbers of read operations per second.
0
SYS
-
SYS::File Write Operations
7
perf_counter[\System\File Write Operations/sec]
1m
2w
365d
0
0
0
0
0
0
Combined rate of file system write requests to all devices on the computer, including requests to write to data in the file system cache. It is measured in numbers of write operations per second.
0
SYS
-
SYS::Floating Emulations
7
perf_counter[\System\Floating Emulations/sec]
1m
2w
365d
0
0
0
0
0
0
Rate of floating emulations performed by the system.
0
SYS
-
CPU::Processor Queue Length
7
perf_counter[\System\Processor Queue Length]
1m
2w
365d
0
0
0
0
0
0
0
CPU
-
SYS::Calls
7
perf_counter[\System\System Calls/sec]
1m
2w
365d
0
0
0
0
0
0
System (all CPUs) calls per second.
0
SYS
-
SYS::Threads
7
perf_counter[\System\Threads]
1m
2w
365d
0
3
0
0
0
0
0
SYS
-
NET::TCP::V4::Connection Failures
7
perf_counter[\TCPv4\Connection Failures]
1m
2w
365d
0
3
0
0
0
0
Number of times that TCP connections have made a direct transition to the CLOSED state from the SYN-SENT or SYN-RCVD state, plus the number of times TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Connections Active
7
perf_counter[\TCPv4\Connections Active]
1m
2w
365d
0
3
0
0
0
0
Shows the number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Connections Established
7
perf_counter[\TCPv4\Connections Established]
1m
2w
365d
0
3
0
0
0
0
Number of TCP connections for which the current state is either ESTABLISHED or CLOSE-WAIT.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Connections Reset
7
perf_counter[\TCPv4\Connections Reset]
1m
2w
365d
0
3
0
0
0
0
Number of times that TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED or CLOSE-WAIT state.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Segments
7
perf_counter[\TCPv4\Segments/sec]
1m
2w
365d
0
0
0
0
0
0
Rate at which TCP segments are sent or received using the TCP protocol. Segments/sec is the sum of the values of TCP\ Segments Received/sec and TCP\Segments Sent/sec.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Segments Received
7
perf_counter[\TCPv4\Segments Received/sec]
1m
2w
365d
0
0
0
0
0
0
Rate at which segments are received, including those received in error. This count includes segments received on currently established connections. Segments Received/sec is a subset of TCP: Segments/sec.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Segments Retransmitted
7
perf_counter[\TCPv4\Segments Retransmitted/sec]
1m
2w
365d
0
0
0
0
0
0
Rate at which segments containing one or more previously transmitted bytes are retransmitted.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
NET::TCP::V4::Segments Sent
7
perf_counter[\TCPv4\Segments Sent/sec]
1m
2w
365d
0
0
0
0
0
0
Rate at which segments are sent. This value includes those on current connections, but excludes those containing only retransmitted bytes. Segments Sent/sec is a subset of TCP\ Segments/sec.
https://msdn.microsoft.com/en-us/library/ms804042.aspx
0
NET
-
Thread Privileged Time
7
perf_counter[\Thread(_Total/_Total)\% Privileged Time]
1m
2w
365d
0
0
%
0
0
0
0
0
THRD
-
Thread Processor Time
7
perf_counter[\Thread(_Total/_Total)\% Processor Time]
1m
2w
365d
0
0
%
0
0
0
0
0
THRD
-
Thread User Time
7
perf_counter[\Thread(_Total/_Total)\% User Time]
1m
2w
365d
0
0
%
0
0
0
0
0
THRD
-
Thread Context Switches
7
perf_counter[\Thread(_Total/_Total)\Context Switches/sec]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread Elapsed Time
7
perf_counter[\Thread(_Total/_Total)\Elapsed Time]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread ID Process
7
perf_counter[\Thread(_Total/_Total)\ID Process]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread ID Thread
7
perf_counter[\Thread(_Total/_Total)\ID Thread]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread Priority Base
7
perf_counter[\Thread(_Total/_Total)\Priority Base]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread Priority Current
7
perf_counter[\Thread(_Total/_Total)\Priority Current]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread Start Address
7
perf_counter[\Thread(_Total/_Total)\Start Address]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread State
7
perf_counter[\Thread(_Total/_Total)\Thread State]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
Thread Wait Reason
7
perf_counter[\Thread(_Total/_Total)\Thread Wait Reason]
1m
2w
365d
0
0
0
0
0
0
0
THRD
-
NET::UDP::V4::Datagrams
7
perf_counter[\UDPv4\Datagrams/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which UDP datagrams are transferred by the computer.
https://msdn.microsoft.com/en-gb/library/ms804038.aspx
0
NET
-
NET::UDP::V4::Datagrams No Port
7
perf_counter[\UDPv4\Datagrams No Port/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which UDP datagrams are received which there was no application at the destination port.
https://msdn.microsoft.com/en-gb/library/ms804038.aspx
0
NET
-
NET::UDP::V4::Datagrams Received
7
perf_counter[\UDPv4\Datagrams Received/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which UDP datagrams are delivered to UDP users.
https://msdn.microsoft.com/en-gb/library/ms804038.aspx
0
NET
-
NET::UDP::V4::Datagrams Received Errors
7
perf_counter[\UDPv4\Datagrams Received Errors]
1m
2w
365d
0
0
0
0
0
0
Shows the number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port.
https://msdn.microsoft.com/en-gb/library/ms804038.aspx
0
NET
-
NET::UDP::V4::Datagrams Sent
7
perf_counter[\UDPv4\Datagrams Sent/sec]
1m
2w
365d
0
0
0
0
0
0
Shows the rate at which UDP datagrams are sent from the computer.
https://msdn.microsoft.com/en-gb/library/ms804038.aspx
0
NET
-
NTP::WTS::Clock Frequency Adjustment
7
perf_counter[\Windows Time Service\Clock Frequency Adjustment]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
NTP::WTS::Computed Time Offset
7
perf_counter[\Windows Time Service\Computed Time Offset]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
NTP::WTS::Client Time Source Count
7
perf_counter[\Windows Time Service\NTP Client Time Source Count]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
NTP::WTS::Roundtrip Delay
7
perf_counter[\Windows Time Service\NTP Roundtrip Delay]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
NTP::WTS::Incoming Requests
7
perf_counter[\Windows Time Service\NTP Server Incoming Requests]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
NTP::WTS::Outgoing Responses
7
perf_counter[\Windows Time Service\NTP Server Outgoing Responses]
1m
2w
365d
0
0
0
0
0
0
0
NTP
-
SYS::process::*
7
proc.num[]
1m
2w
365d
0
3
0
0
0
0
Total number of processes in any state.
0
SYS
6
-
SYS::load:$2
7
system.cpu.load[,avg1]
1m
2w
365d
0
0
0
0
0
0
Avg1 system running queue length.
0
SYS
-
CPU::Processor load5
7
system.cpu.load[,avg5]
2m
2w
365d
0
0
0
0
0
0
0
CPU
-
CPU::Processor load15
7
system.cpu.load[,avg15]
2m
2w
365d
0
0
0
0
0
0
0
CPU
-
CPU::$2::$3
7
system.cpu.util[,system,avg1]
1m
2w
365d
0
0
%
0
0
0
0
The % time the CPU has spent running the kernel and its processes.
0
CPU
-
SYS::localtime
7
system.localtime
1m
2w
365d
0
3
unixtime
0
0
0
0
0
SYS
-
SYS::hostname
7
system.uname
30m
2w
0
0
1
0
0
0
0
0
SYS
-
SYS::Uptime
7
system.uptime
1m
2w
365d
0
0
uptime
0
0
0
0
The OS uptime.
0
SYS
-
MEM::cached
7
vm.memory.size[cached]
1m
2w
365d
0
3
B
0
0
0
0
0
MEM
-
MEM::$1
7
vm.memory.size[free]
1m
2w
365d
0
3
B
0
0
0
0
0
MEM
-
MEM::Total memory
7
vm.memory.size[total]
30m
2w
365d
0
3
B
0
0
0
0
0
MEM
NET:
7
net.if.discovery
2h
0
0
0
0
0
0
{#IFNAME}
@OS Windows::NET
8
A
1d
Work out Network interfaces from global regular expression
system.run["powershell -NoProfile -ExecutionPolicy Bypass -File \"C:\Program Files\Zabbix Agent\NIC.ps1\""]
NIC::{#IFNAME}::$2::in
7
net.if.in[{#IFNAME},bytes]
1m
2w
365d
0
0
bps
0
0
0
0
0
NET
10
NIC::{#IFNAME}::$2::in
7
net.if.in[{#IFNAME},dropped]
1m
2w
365d
0
0
packets/s
0
0
0
0
0
NET
10
NIC::{#IFNAME}::$2::in
7
net.if.in[{#IFNAME},errors]
1m
2w
365d
0
0
err/s
0
0
0
0
0
NET
10
NIC::{#IFNAME}::$2::out
7
net.if.out[{#IFNAME},bytes]
1m
2w
365d
0
0
bps
0
0
0
0
0
NET
10
NIC::{#IFNAME}::$2::out
7
net.if.out[{#IFNAME},dropped]
1m
2w
365d
0
0
packets/s
0
0
0
0
0
NET
10
NIC::{#IFNAME}::$2::out
7
net.if.out[{#IFNAME},errors]
1m
2w
365d
0
0
err/s
0
0
0
0
0
NET
10
({TRIGGER.VALUE}=0 and {OS Windows:net.if.in[{#IFNAME},errors].last()}>{$NIC_ERRORS_P4}) or ({TRIGGER.VALUE}=1 and {OS Windows:net.if.in[{#IFNAME},errors].last()}>{$NIC_ERRORS_RECOVER})
0
NIC::{#IFNAME}::Errors in above threshold (LV={ITEM.VALUE}::TH={{$NIC_ERRORS_P4}eps)
0
0
2
0
0
({TRIGGER.VALUE}=0 and {OS Windows:net.if.out[{#IFNAME},errors].last()}>{$NIC_ERRORS_P4}) or ({TRIGGER.VALUE}=1 and {OS Windows:net.if.out[{#IFNAME},errors].last()}>{$NIC_ERRORS_RECOVER})
0
NIC::{#IFNAME}::Errors out above threshold (LV={ITEM.VALUE}::TH={{$NIC_ERRORS_P4}eps)
0
0
2
0
0
NIC::{#IFNAME}::errors::max
1200
300
0.0000
100.0000
1
1
1
1
0
0.0000
0.0000
0
0
0
0
0
0
CC0000
0
4
0
-
OS Windows
net.if.in[{#IFNAME},dropped]
1
0
FF9999
0
4
0
-
OS Windows
net.if.in[{#IFNAME},errors]
2
0
0000AA
0
4
0
-
OS Windows
net.if.out[{#IFNAME},dropped]
3
0
3333FF
0
4
0
-
OS Windows
net.if.out[{#IFNAME},errors]
NIC::{#IFNAME}::throughput::avg
1200
300
0.0000
100.0000
1
1
1
1
0
0.0000
0.0000
0
0
0
0
0
0
C80000
0
2
0
-
OS Windows
net.if.in[{#IFNAME},bytes]
1
0
00EE00
0
2
0
-
OS Windows
net.if.out[{#IFNAME},bytes]
NIC::{#IFNAME}::throughput::max
1200
300
0.0000
100.0000
1
1
1
1
0
0.0000
0.0000
0
0
0
0
0
0
C80000
0
4
0
-
OS Windows
net.if.in[{#IFNAME},bytes]
1
0
00EE00
0
4
0
-
OS Windows
net.if.out[{#IFNAME},bytes]
VOL:
7
vfs.fs.discovery
2h
0
0
0
0
0
0
{#FSDRIVETYPE}
^fixed|^UNKNOWN
8
A
1d
Discover windows logical disks
{#FSNAME}::% Disk Read Time
7
perf_counter[\LogicalDisk({#FSNAME})\% Disk Read Time]
2m
2w
365d
0
0
%
0
0
0
0
0
DSK
{#FSNAME}::% Disk Time
7
perf_counter[\LogicalDisk({#FSNAME})\% Disk Time]
2m
2w
365d
0
0
%
0
0
0
0
0
DSK
{#FSNAME}::% Disk Write Time
7
perf_counter[\LogicalDisk({#FSNAME})\% Disk Write Time]
2m
2w
365d
0
0
%
0
0
0
0
0
DSK
{#FSNAME}::Space::%Free
7
perf_counter[\LogicalDisk({#FSNAME})\% Free Space]
2m
2w
365d
0
0
%
0
0
0
0
0
DSK
{#FSNAME}::% Idle Time
7
perf_counter[\LogicalDisk({#FSNAME})\% Idle Time]
2m
2w
365d
0
0
%
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Bytes/Read
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Bytes/Read]
2m
2w
365d
0
0
B
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Bytes/Transfer
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Bytes/Transfer]
2m
2w
365d
0
0
B
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Bytes/Write
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Bytes/Write]
2m
2w
365d
0
0
B
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Queue Length
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Queue Length]
2m
2w
365d
0
0
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Read Queue Length
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Read Queue Length]
2m
2w
365d
0
0
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk sec/Read
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk sec/Read]
2m
2w
365d
0
0
s
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk sec/Transfer
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk sec/Transfer]
2m
2w
365d
0
0
s
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk sec/Write
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk sec/Write]
2m
2w
365d
0
0
s
0
0
0
0
0
DSK
{#FSNAME}::Avg. Disk Write Queue Length
7
perf_counter[\LogicalDisk({#FSNAME})\Avg. Disk Write Queue Length]
2m
2w
365d
0
0
0
0
0
0
0
DSK
{#FSNAME}::Current Disk Queue Length
7
perf_counter[\LogicalDisk({#FSNAME})\Current Disk Queue Length]
2m
2w
365d
0
0
0
0
0
0
0
DSK
{#FSNAME}::Disk Bytes
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Bytes/sec]
2m
2w
365d
0
0
B/sec
0
0
0
0
0
DSK
{#FSNAME}::Read Bytes
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Read Bytes/sec]
2m
2w
365d
0
0
B/sec
0
0
0
0
0
DSK
{#FSNAME}::Read Ops
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Reads/sec]
2m
2w
365d
0
0
ops/sec
0
0
0
0
0
DSK
{#FSNAME}::Transfer Ops
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Transfers/sec]
2m
2w
365d
0
0
ops/sec
0
0
0
0
0
DSK
{#FSNAME}::Write Bytes
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Write Bytes/sec]
2m
2w
365d
0
0
B/sec
0
0
0
0
0
DSK
{#FSNAME}::Write Ops
7
perf_counter[\LogicalDisk({#FSNAME})\Disk Writes/sec]
2m
2w
365d
0
0
ops/sec
0
0
0
0
0
DSK
{#FSNAME}::Space::free
7
perf_counter[\LogicalDisk({#FSNAME})\Free Megabytes]
2m
2w
365d
0
3
B
0
0
0
0
0
DSK
1
1048576
{#FSNAME}::Split IO Ops
7
perf_counter[\LogicalDisk({#FSNAME})\Split IO/Sec]
2m
2w
365d
0
0
ops/sec
0
0
0
0
0
DSK
{OS Windows:perf_counter[\LogicalDisk({#FSNAME})\% Free Space].last()}<5
0
VOL::{#FSNAME}::free {ITEM.VALUE}
0
0
3
0
0
{OS Windows:perf_counter[\LogicalDisk({#FSNAME})\% Free Space].last()}>4.99 and {OS Windows:perf_counter[\LogicalDisk({#FSNAME})\% Free Space].last()}<10
0
VOL::{#FSNAME}::free {ITEM.VALUE}
0
0
2
0
0
VOL::{#FSNAME}::io:bytes
1200
300
0.0000
100.0000
1
1
1
1
0
0.0000
0.0000
0
0
0
0
0
0
0000BB
0
4
0
-
OS Windows
perf_counter[\LogicalDisk({#FSNAME})\Disk Read Bytes/sec]
1
0
CC0000
0
4
0
-
OS Windows
perf_counter[\LogicalDisk({#FSNAME})\Disk Write Bytes/sec]
VOL::{#FSNAME}::io:ops
1200
300
0.0000
100.0000
1
1
1
1
0
0.0000
0.0000
0
0
0
0
0
0
0000BB
0
4
0
-
OS Windows
perf_counter[\LogicalDisk({#FSNAME})\Disk Reads/sec]
1
0
CC0000
0
4
0
-
OS Windows
perf_counter[\LogicalDisk({#FSNAME})\Disk Writes/sec]
VOL::{#FSNAME}::space::%
1200
300
0.0000
100.0000
1
1
0
1
0
0.0000
0.0000
1
1
0
0
0
1
0000BB
0
1
0
-
OS Windows
perf_counter[\LogicalDisk({#FSNAME})\% Free Space]
{$NIC_ERRORS_P4}
0.02
{$NIC_ERRORS_RECOVER}
0.01
{$PROC_LD_P4}
8
ICMP
Service Zabbix Agent
BI - Disk & Network Activity
2
4
Volume Usage
15
3
20
500
100
0
0
1
1
0
0
2
0
0
VOL::{#FSNAME}::space::%
OS Windows
15
20
500
100
0
1
1
1
0
0
2
0
0
VOL::{#FSNAME}::io:bytes
OS Windows
15
20
500
100
0
2
1
1
0
0
2
0
0
VOL::{#FSNAME}::io:ops
OS Windows
15
{OS Windows:vm.memory.size[free].last(0)}<10000
0
MEM::free {ITEM.LASTVALUE}
0
0
3
0
0
{OS Windows:system.cpu.load[,avg1].min(#5)}>{$PROC_LD_P4}
0
Processor load above threshold (LV={ITEM.VALUE}::TH={$PROC_LD_P4}
0
0
2
0
0
{OS Windows:system.uptime.last(0)}<10m
0
SYS::Host just (re)started
0
0
1
0
0
{OS Windows:system.localtime.fuzzytime(60)}=0
0
SYS::localtime drift > 60s
0
0
2
Tim drift bigger than 60s.
0
0
{OS Windows:system.uname.diff(0)}>0
0
SYS::uname changed
0
0
2
0
0
{OS Windows:proc.num[].last(0)}>300
0
Too many processes
0
0
3
0
0
CPU::*::avg1
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
7
0
-
OS Windows
system.cpu.load[,avg1]
CPU Loads
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
990000
0
2
0
-
OS Windows
system.cpu.load[,avg15]
1
0
999900
0
2
0
-
OS Windows
system.cpu.load[,avg5]
2
0
009900
0
2
0
-
OS Windows
system.cpu.load[,avg1]
Disk IO
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
7
0
-
OS Windows
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Read]
1
0
0000CC
0
7
0
-
OS Windows
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Write]
2
0
00AAAA
0
7
0
-
OS Windows
perf_counter[\LogicalDisk(_Total)\Avg. Disk sec/Transfer]
3
0
BB00BB
0
7
0
-
OS Windows
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Read]
4
0
777700
0
7
0
-
OS Windows
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Write]
5
0
BB0000
0
7
0
-
OS Windows
perf_counter[\PhysicalDisk(_Total)\Avg. Disk sec/Transfer]
MEM::pages
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
00BBBB
0
7
0
-
OS Windows
perf_counter[\Memory\Pages/sec]
1
0
BB00BB
0
7
0
-
OS Windows
perf_counter[\Memory\Pages Input/sec]
Object Events
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
00BB00
0
7
0
-
OS Windows
perf_counter[\Objects\Events]
1
0
0000EE
0
7
0
-
OS Windows
perf_counter[\Objects\Semaphores]
2
0
00CCCC
0
7
0
-
OS Windows
perf_counter[\Objects\Threads]
Object Sections
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
DD00DD
0
2
0
-
OS Windows
perf_counter[\Objects\Sections]
1
0
EE0000
0
2
0
-
OS Windows
perf_counter[\Objects\Mutexes]
2
0
888800
0
2
0
-
OS Windows
perf_counter[\Objects\Processes]
Page File Bytes
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
0000BB
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\Page File Bytes]
Physical Memory
1200
300
0.0000
100.0000
1
1
0
1
0
0.0000
0.0000
1
0
0
0
0
4
C80000
0
2
0
-
OS Windows
perf_counter[\Memory\Available Bytes]
1
4
00C800
0
2
0
-
OS Windows
vm.memory.size[cached]
2
4
0000C8
0
2
0
-
OS Windows
perf_counter[\Memory\Committed Bytes]
3
4
C800C8
0
2
0
-
OS Windows
perf_counter[\Memory\Commit Limit]
Processor Queue Length
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
2
0
-
OS Windows
perf_counter[\System\Processor Queue Length]
Processor Times
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
7
0
-
OS Windows
perf_counter[\Processor(_Total)\% Processor Time]
1
0
0000DD
0
7
0
-
OS Windows
perf_counter[\Processor(_Total)\% Privileged Time]
2
0
00BBBB
0
7
0
-
OS Windows
perf_counter[\Processor(_Total)\% User Time]
Process Times
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\% Processor Time]
1
0
0000DD
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\% Privileged Time]
2
0
00BBBB
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\% User Time]
Server Bytes Total
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
2
0
-
OS Windows
perf_counter[\Server\Bytes Total/sec]
System Context
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
2
0
-
OS Windows
perf_counter[\System\Context Switches/sec]
User Process Total
1200
300
0.0000
100.0000
0
0
0
1
0
0.0000
0.0000
0
0
0
0
0
0
009900
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\Private Bytes]
1
0
0000CC
0
2
0
-
OS Windows
perf_counter[\Process(_Total)\Working Set]