zabbix_export:
  version: '5.4'
  date: '2021-11-21T21:40:59Z'
  groups:
    -
      uuid: 7df96b18c230490a9a0a9e2307226338
      name: Templates
  templates:
    -
      uuid: 253650ae8a284c96b425139b70818eac
      template: 'OS Windows Server Baseline'
      name: 'OS Windows Server Baseline'
      description: |
        ## Description
        
        Zabbix template for Microsoft Windows Server. Tested on Microsoft Windows Server 2012, 2012 R2 and 2016. It may work with earlier versions, but some items (with missing performance counters) may be unsupported. Tested on Zabbix 3.4.0. It may work with earlier versions, but some items (for example service.info[service,<param>]) may be unsupported. Mantas Tumenas. mantas.tumenas@gmail.com
        
        ## Overview
        
        Zabbix template for Microsoft Windows Server.
        
        
        Features:
        
        
        * Performance counters.
        * CPU Low Level Discovery.
        * Mounted file system Low Level Discovery.
        
        
        Difference from default Windows OS template:
        
        
        * CPU's discovery and triggers per CPU's.
        * Mounted file system discovery and triggers per logical disk.
        * More items and triggers prototypes for Mounted file system discovery.
        * Triggers are oriented for Microsoft Windows Server running Microsoft SQL Server.
        
        
        Missing:
        
        
        * Network interface items.
        
        
        Supported versions: Tested on Microsoft Windows Server 2012, 2012 R2 and 2016. It may work with earlier versions, but some items (with missing performance counters) may be unsupported. Tested on Zabbix 3.4.0. It may work with earlier versions, but some items (for example service.info[service,]) may be unsupported.
        
        
        My other templates are [here](owner/MantasT).
        
        
        
        ## Author
        
        Mantas Tumenas
        
        
      groups:
        -
          name: Templates
      items:
        -
          uuid: 2f81ca2014774221ac5afb2785e8c244
          name: 'Memory % Committed Bytes in Use'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Memory\% Committed Bytes in Use",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This measures the ratio of Committed Bytes to the Commit Limit—in other words, the amount of virtual memory in use. This indicates insufficient memory if the number is greater than 80 percent. The obvious solution for this is to add more memory.
            
            Threshold: > 80%.
          tags:
            -
              tag: Application
              value: 'Memory Performance'
          triggers:
            -
              uuid: c77af0421dda4f0f98788ce488abb037
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\% Committed Bytes in Use",1],300s:now-0)>80'
              name: '{HOST.NAME}: Memory % Committed Bytes in Use avg value > 80 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: WARNING
              description: |
                This measures the ratio of Committed Bytes to the Commit Limit—in other words, the amount of virtual memory in use. This indicates insufficient memory if the number is greater than 80 percent. The obvious solution for this is to add more memory.
                
                Threshold: > 80%.
              manual_close: 'YES'
        -
          uuid: 8d00749d041e431ab3a17f66ae174927
          name: 'Memory Cache Bytes'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Memory\Cache Bytes",1]'
          delay: 30s
          value_type: FLOAT
          units: B
          description: |
            This indicates the amount of memory being used for the file system cache.
            
            Threshold: There may be a disk bottleneck if this value is greater than 300 MB.
          tags:
            -
              tag: Application
              value: 'Memory Performance'
        -
          uuid: 338a0000025240c9807b0539581c4c42
          name: 'Memory Free System Page Table Entries'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Memory\Free System Page Table Entries",1]'
          delay: 30s
          value_type: FLOAT
          description: |
            Free System Page Table Entries is the number of page table entries not currently in used by the system. This analysis determines if the system is running out of free system page table entries (PTEs) by checking if there is less than 5,000 free PTE’s with a Warning if there is less than 10,000 free PTE’s. Lack of enough PTEs can result in system wide hang.
            
            Threshold: Running low on PTE’s – less than 10,000 (If the free PTEs are under 10,000 the system is close to a system wide hang).
            Critically low on PTE’s – less than 5000 (If the free PTEs are under 5000 the system is close to a system wide hang).
          tags:
            -
              tag: Application
              value: 'Memory Performance'
          triggers:
            -
              uuid: e4572e4987854706a57e4456fc594b65
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Free System Page Table Entries",1],300s:now-0)<5000'
              name: '{HOST.NAME}: Memory Free System Page Table Entries avg value < 5000 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: HIGH
              description: |
                Free System Page Table Entries is the number of page table entries not currently in used by the system. This analysis determines if the system is running out of free system page table entries (PTEs) by checking if there is less than 5,000 free PTE’s with a Warning if there is less than 10,000 free PTE’s. Lack of enough PTEs can result in system wide hang.
                
                Threshold: Critically low on PTE’s – less than 5000 (If the free PTEs are under 5000 the system is close to a system wide hang).
              manual_close: 'YES'
            -
              uuid: 3f2dad16d64c4649a9602c66c319b283
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Free System Page Table Entries",1],300s:now-0)<10000'
              name: '{HOST.NAME}: Memory Free System Page Table Entries avg value < 10000 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: AVERAGE
              description: |
                Free System Page Table Entries is the number of page table entries not currently in used by the system. This analysis determines if the system is running out of free system page table entries (PTEs) by checking if there is less than 5,000 free PTE’s with a Warning if there is less than 10,000 free PTE’s. Lack of enough PTEs can result in system wide hang.
                
                Threshold: Running low on PTE’s – less than 10,000 (If the free PTEs are under 10,000 the system is close to a system wide hang).
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Memory Free System Page Table Entries avg value < 5000 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Free System Page Table Entries",1],300s:now-0)<5000'
        -
          uuid: 451e0726ad1b4a0fb07ecbf04c8eedcd
          name: 'Memory Pages/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Memory\Pages/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: /sec
          description: |
            If it is high, then the system is likely running out of memory by trying to page the memory to the disk. Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\Pages Input/sec and Memory\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.
            
            Threshold: High pages/sec – greater than 1000 (If it’s higher than 1000, the system is could be beginning to run out of memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory). 
            Very high average pages/sec – greater than 2500 (If this is greater than 2500, the system could be experiencing system-wide delays due to insufficient memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory).
            Critically high average pages/sec – greater than 5000 (If this is greater than 5000. If so, the system is most likely experiencing delays due to insufficient memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory).
          tags:
            -
              tag: Application
              value: 'Memory Performance'
          triggers:
            -
              uuid: 1bd72d91b17644f1815ad65591288d4a
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages/sec",1],300s:now-0)>1000'
              name: '{HOST.NAME}: Memory Pages/sec avg value > 1000 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: INFO
              description: |
                If it is high, then the system is likely running out of memory by trying to page the memory to the disk. Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\Pages Input/sec and Memory\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.
                Threshold: High pages/sec – greater than 1000 (If it’s higher than 1000, the system is could be beginning to run out of memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory).
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Memory Pages/sec avg value > 2500 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages/sec",1],300s:now-0)>2500'
            -
              uuid: 9494b6ea0d7d43619bcb31d0dcb5915a
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages/sec",1],300s:now-0)>2500'
              name: '{HOST.NAME}: Memory Pages/sec avg value > 2500 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: WARNING
              description: |
                If it is high, then the system is likely running out of memory by trying to page the memory to the disk. Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\Pages Input/sec and Memory\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.
                
                Threshold: Very high average pages/sec – greater than 2500 (If this is greater than 2500, the system could be experiencing system-wide delays due to insufficient memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory).
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Memory Pages/sec avg value > 5000 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages/sec",1],300s:now-0)>5000'
            -
              uuid: 3aeaba2240304ec898a264e8b22104e9
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages/sec",1],300s:now-0)>5000'
              name: '{HOST.NAME}: Memory Pages/sec avg value > 5000 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: AVERAGE
              description: |
                If it is high, then the system is likely running out of memory by trying to page the memory to the disk. Pages/sec is the rate at which pages are read from or written to disk to resolve hard page faults. This counter is a primary indicator of the kinds of faults that cause system-wide delays. It is the sum of Memory\Pages Input/sec and Memory\Pages Output/sec. It is counted in numbers of pages, so it can be compared to other counts of pages, such as Memory\Page Faults/sec, without conversion. It includes pages retrieved to satisfy faults in the file system cache (usually requested by applications) non-cached mapped memory files.
                
                Threshold: Critically high average pages/sec – greater than 5000 (If this is greater than 5000. If so, the system is most likely experiencing delays due to insufficient memory. Consider reviewing the processes to see which processes are taking up the most memory or consider adding more memory).
              manual_close: 'YES'
        -
          uuid: 719647565d004b0ab2209f5be364f1a7
          name: 'Memory Pages Input/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Memory\Pages Input/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: /sec
          description: |
            Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation.
            
            Threshold: More then 10 page file reads per second.
          tags:
            -
              tag: Application
              value: 'Memory Performance'
          triggers:
            -
              uuid: efe673b3d2854229a7bc6815f9089a83
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Memory\Pages Input/sec",1],300s:now-0)>10'
              name: '{HOST.NAME}: Memory Pages Input/sec avg value > 10 in the last 5 min'
              url: 'http://technet.microsoft.com/en-us/magazine/2008.08.pulse.aspx'
              priority: INFO
              description: |
                Pages Input/sec is the rate at which pages are read from disk to resolve hard page faults. Hard page faults occur when a process refers to a page in virtual memory that is not in its working set or elsewhere in physical memory, and must be retrieved from disk. When a page is faulted, the system tries to read multiple contiguous pages into memory to maximize the benefit of the read operation. Compare the value of Memory\\Pages Input/sec to the value of Memory\\Page Reads/sec to determine the average number of pages read into memory during each read operation.
                
                Threshold: More then 10 page file reads per second.
              manual_close: 'YES'
        -
          uuid: 0091d672ac044f20b4583fa50f0a65ce
          name: 'PhysicalDisk % Disk Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\PhysicalDisk(_Total)\% Disk Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            Represents the percentage of elapsed time that the selected disk drive was busy servicing read or write requests.
            
            Threshold:  greater than 50%, it represents an I/O bottleneck.
            
            Symptoms. Third-party monitoring tool may generate multiple alarm events during times when your disk is very busy. If you monitor the Physical %Disk Time on your Windows based computer, you may note that the value may go over 100% if your computer is very busy. For example, this could occur if you are copying a large amount of files, or you are copying multiple large files, and so on.
            
            Cause. This behavior can occur because some controllers allow the operating system to use overlapping input/output operations for multiple outstanding requests. The disk performance counters time the responses by using a 100 nanosecond precision counter, and then report the cumulative statistics for a given sample time. This sample time could go over 100% if, for example, you have 10 requests that completed in 2 milliseconds each in a 10 millisecond sampling interval. If you have multiple disks in a Raid arrangement, the overlapped input/output happens because the operating system can read and write to multiple disks, and this could show values that are higher than 100% for this counter.
            Status. This behavior is by design.
          tags:
            -
              tag: Application
              value: 'Disk Performance'
        -
          uuid: 6cdaed36423d4a67ab2d48b9d155d0e9
          name: 'PhysicalDisk % Idle Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\PhysicalDisk(_Total)\% Idle Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This measures the percentage of time the disk was idle during the sample interval. 
            
            Threshold: If this counter falls below 20%, the disk system is saturated. You may consider replacing the current disk system with a faster disk system.
          tags:
            -
              tag: Application
              value: 'Disk Performance'
          triggers:
            -
              uuid: 1cac694b4aef40ea96f06109157f11db
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\% Idle Time",1],300s:now-0)<20'
              name: '{HOST.NAME}: PhysicalDisk % Idle Time  avg value < 20 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: INFO
              description: |
                This measures the percentage of time the disk was idle during the sample interval. If this counter falls below 20 percent, the disk system is saturated. You may consider replacing the current disk system with a faster disk system.
                
                Threshold: < 20%.
              manual_close: 'YES'
        -
          uuid: df88f4b3a5a24c2c92b14e3ee3a77324
          name: 'PhysicalDisk Avg. Disk Queue Length'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\PhysicalDisk(_Total)\Avg. Disk Queue Length",1]'
          delay: 30s
          value_type: FLOAT
          description: |
            This indicates how many I/O operations are waiting for the hard drive to become available.
            
            Threshold: If the value here is larger than the two times the number of spindles, that means the disk itself may be the bottleneck.
          tags:
            -
              tag: Application
              value: 'Disk Performance'
        -
          uuid: 60d09d93d000485a801b23746abc2d8e
          name: 'PhysicalDisk Avg. Disk sec/Read'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1]'
          delay: 30s
          value_type: FLOAT
          units: sec
          description: |
            This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
            
            Threshold: Average disk responsiveness is slow – more than 15 ms.
            Average disk responsiveness is very slow – more than 25 ms.
            Disk responsiveness is critical - more than 50 ms.
          tags:
            -
              tag: Application
              value: 'Disk Performance'
          triggers:
            -
              uuid: e632c2da985c431fa83829abfd62c584
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1],300s:now-0)>0.015'
              name: '{HOST.NAME}: PhysicalDisk Read Latency avg value > 0.015 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: INFO
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is slow – more than 15 ms.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: PhysicalDisk Read Latency avg value > 0.025 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1],300s:now-0)>0.025'
            -
              uuid: 9fe271feac34471f966fb5bf5e68a77a
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1],300s:now-0)>0.025'
              name: '{HOST.NAME}: PhysicalDisk Read Latency avg value > 0.025 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: WARNING
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is very slow – more than 25 ms.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: PhysicalDisk Read Latency avg value > 0.050 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1],300s:now-0)>0.050'
            -
              uuid: e8379d575f964c73af64aecf484a0ab3
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Read",1],300s:now-0)>0.050'
              name: '{HOST.NAME}: PhysicalDisk Read Latency avg value > 0.050 in the last 5 min'
              priority: AVERAGE
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Disk responsiveness is critical - more than 50 ms.
              manual_close: 'YES'
        -
          uuid: ef8136cfdf464d39a1139c42c3a8d92b
          name: 'PhysicalDisk Avg. Disk sec/Write'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1]'
          delay: 30s
          value_type: FLOAT
          units: sec
          description: |
            This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
            
            Threshold: Average disk responsiveness is slow – more than 15 ms.
            Average disk responsiveness is very slow – more than 25 ms.
            Disk responsiveness is critical - more than 50 ms.
          tags:
            -
              tag: Application
              value: 'Disk Performance'
          triggers:
            -
              uuid: 6668587118344fd59ef1cbca8e614a47
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1],300s:now-0)>0.015'
              name: '{HOST.NAME}: PhysicalDisk Write Latency avg value > 0.015 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: INFO
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is slow – more than 15 ms.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: PhysicalDisk Write Latency avg value > 0.025 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1],300s:now-0)>0.025'
            -
              uuid: ae9ae9dfaaad44acaefee46b16fccb75
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1],300s:now-0)>0.025'
              name: '{HOST.NAME}: PhysicalDisk Write Latency avg value > 0.025 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: WARNING
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is very slow – more than 25 ms.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: PhysicalDisk Write Latency avg value > 0.050 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1],300s:now-0)>0.050'
            -
              uuid: 5b1cb24f41fc457fbfae1e92efa9f091
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\PhysicalDisk(_Total)\Avg. Disk sec/Write",1],300s:now-0)>0.050'
              name: '{HOST.NAME}: PhysicalDisk Write Latency avg value > 0.050 in the last 5 min'
              priority: AVERAGE
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is critical - more than 50 ms.
              manual_close: 'YES'
        -
          uuid: 92f9f847963049eda486e7f8f8211957
          name: 'IO Data Operations/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Process(_Total)\IO Data Operations/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: O/sec
          description: 'These counters count all I/O activity generated to include file, network and device I/Os. These analyses check when processes are doing more than 1,000 I/O’s per second and flag it as a warning. These analyses are best used in correlation with other analyses such as disk analysis to determine which processes might be involved in the I/O activity.'
          tags:
            -
              tag: Application
              value: 'Process Performance'
          triggers:
            -
              uuid: d3b1d90aed3748dab11eb506bbb0877a
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Process(_Total)\IO Data Operations/sec",1],300s:now-0)>1000'
              name: '{HOST.NAME}: Process IO Data Operations/sec avg value > 1000 in the last 5 min'
              priority: INFO
              description: 'These counters count all I/O activity generated to include file, network and device I/Os. These analyses check when processes are doing more than 1,000 I/O’s per second and flag it as a warning. These analyses are best used in correlation with other analyses such as disk analysis to determine which processes might be involved in the I/O activity.'
              manual_close: 'YES'
        -
          uuid: d070ff94e66846de987bc7da4ee4c74b
          name: 'IO Other Operations/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Process(_Total)\IO Other Operations/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: O/sec
          description: 'The number of input/output operations generated by a process that are neither reads nor writes, including file, network, and device I/Os. An example of this type of operation would be a control function. I/O Others directed to CONSOLE (console input object) handles are not counted. These analyses check when processes are doing more than 1,000 I/O’s per second and flag it as a warning.'
          tags:
            -
              tag: Application
              value: 'Process Performance'
          triggers:
            -
              uuid: d1387d7aedb74ab4b824824bc8da988c
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Process(_Total)\IO Other Operations/sec",1],300s:now-0)>1000'
              name: '{HOST.NAME}: Process IO Other Operations/sec avg value > 1000 in the last 5 min'
              priority: INFO
              description: 'The number of input/output operations generated by a process that are neither reads nor writes, including file, network, and device I/Os. An example of this type of operation would be a control function. I/O Others directed to CONSOLE (console input object) handles are not counted. These analyses check when processes are doing more than 1,000 I/O’s per second and flag it as a warning.'
              manual_close: 'YES'
        -
          uuid: 22b1c56dce0e4b748698d5b6e128a20d
          name: 'IO Read Operations/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Process(_Total)\IO Read Operations/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: O/sec
          description: 'The number of read input/output operations generated by a process, including file, network, and device I/Os. I/O Reads directed to CONSOLE (console input object) handles are not counted.'
          tags:
            -
              tag: Application
              value: 'Process Performance'
          triggers:
            -
              uuid: b7b9ea8459124d858bace466fc9fb330
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Process(_Total)\IO Read Operations/sec",1],300s:now-0)>1000'
              name: '{HOST.NAME}: Process IO Read Operations/sec avg value > 1000 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: INFO
              description: 'The number of read input/output operations generated by a process, including file, network, and device I/Os. I/O Reads directed to CONSOLE (console input object) handles are not counted.'
              manual_close: 'YES'
        -
          uuid: 130509c8443042e0b9e101f16818799b
          name: 'IO Write Operations/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Process(_Total)\IO Write Operations/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: O/sec
          description: 'The number of write input/output operations generated by a process, including file, network, and device I/Os. I/O Writes directed to CONSOLE (console input object) handles are not counted.'
          tags:
            -
              tag: Application
              value: 'Process Performance'
          triggers:
            -
              uuid: 046d0139f3924b73bac42ed0fd19a744
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Process(_Total)\IO Write Operations/sec",1],300s:now-0)>1000'
              name: '{HOST.NAME}: Process IO Write Operations/sec avg value > 1000 in the last 5 min'
              url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
              priority: INFO
              description: 'The number of write input/output operations generated by a process, including file, network, and device I/Os. I/O Writes directed to CONSOLE (console input object) handles are not counted.'
              manual_close: 'YES'
        -
          uuid: 18fe1ff80310490389fb440628dae386
          name: 'Processor % DPC Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Processor Information(_Total)\% DPC Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            Determines how much time the processor is spending processing DPCs. DPCs originate when the processor performs tasks requiring immediate attention, and then defers the remainder of the task to be handled at lower priority. DPCs represent further processing of client requests.
            
            Threshold:  40%.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: d47ec437f36c462cb443c897f242efff
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% DPC Time",1],300s:now-0)>40'
              name: '{HOST.NAME}: Processor % DPC Time avg value > 40% in the last 5 min'
              priority: INFO
              description: |
                Determines how much time the processor is spending processing DPCs. DPCs originate when the processor performs tasks requiring immediate attention, and then defers the remainder of the task to be handled at lower priority. DPCs represent further processing of client requests.
                
                Threshold:  40%.
              manual_close: 'YES'
        -
          uuid: 90444e1b080043dc9bb1a6b735856448
          name: 'Processor % Interrupt Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Processor Information(_Total)\% Interrupt Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This counter indicates the percentage of time the processor spends receiving and servicing hardware interrupts. This value is an indirect indicator of the activity of devices that generate interrupts, such as network adapters. A dramatic increase in this counter indicates potential hardware problems.
            
            Threshold: High CPU Interrupt Time – more than 30% interrupt time (A high amount of % Interrupt Time in the processor could indicate a hardware or driver problem).
            Very high CPU Interrupt Time – more than 50% interrupt time (A very high amount of % Interrupt Time in the processor could indicate a hardware or driver problem.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: 2bb111d6acd5482b857fe7189ec35071
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Interrupt Time",1],300s:now-0)>30'
              name: '{HOST.NAME}: Processor % Interrupt Time avg value > 30% in the last 5 min'
              description: |
                This counter indicates the percentage of time the processor spends receiving and servicing hardware interrupts. This value is an indirect indicator of the activity of devices that generate interrupts, such as network adapters. A dramatic increase in this counter indicates potential hardware problems.
                
                Threshold: High CPU Interrupt Time – more than 30% interrupt time (A high amount of % Interrupt Time in the processor could indicate a hardware or driver problem).
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Processor % Interrupt Time avg value > 50% in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Interrupt Time",1],300s:now-0)>50'
            -
              uuid: d6ed8e5c416745c9bbd06108f3e3c579
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Interrupt Time",1],300s:now-0)>50'
              name: '{HOST.NAME}: Processor % Interrupt Time avg value > 50% in the last 5 min'
              priority: INFO
              description: |
                This counter indicates the percentage of time the processor spends receiving and servicing hardware interrupts. This value is an indirect indicator of the activity of devices that generate interrupts, such as network adapters. A dramatic increase in this counter indicates potential hardware problems.
                
                Threshold: Very high CPU Interrupt Time – more than 50 % interrupt time (A very high amount of % Interrupt Time in the processor could indicate a hardware or driver problem.
              manual_close: 'YES'
        -
          uuid: 513267c433e749f2bb7c24a7bf4a5a1b
          name: 'Processor % Privileged Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Processor Information(_Total)\% Privileged Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This counter indicates the percentage of time a thread runs in privileged mode. When your application calls operating system functions (for example to perform file or network I/O or to allocate memory), these operating system functions are executed in privileged mode.
            
            Threshold: A figure that is consistently over 75% indicates a bottleneck.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: e3d486602f754979ac94a745615e852a
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Privileged Time",1],300s:now-0)>75'
              name: '{HOST.NAME}: Processor % Privileged Time avg value > 75% in the last 5 min'
              description: |
                This counter indicates the percentage of time a thread runs in privileged mode. When your application calls operating system functions (for example to perform file or network I/O or to allocate memory), these operating system functions are executed in privileged mode.
                
                Threshold: A figure that is consistently over 75% indicates a bottleneck.
              manual_close: 'YES'
        -
          uuid: 7a0f45adc8bc48b5bc6165ae2ac58165
          name: 'Processor % Processor Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Processor Information(_Total)\% Processor Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This measures the percentage of elapsed time the processor spends executing a non-idle thread. If the percentage is greater than 85 percent, the processor is overwhelmed and the server may require a faster processor.
            This counter is the primary indicator of processor activity. High values many not necessarily be bad. However, if the other processor-related counters are increasing linearly such as % Privileged Time or Processor Queue Length, high CPU utilization may be worth investigating).
            
            Threshold: 60% - Warning.
            85% - Average.
            95% - Critical.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: dde4452e076f4bdfa4facfdc8f5597d2
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Processor Time",1],900s:now-0)>60'
              name: '{HOST.NAME}: Processor % Processor Time avg value > 60 % in the last 15 min'
              priority: INFO
              description: |
                This measures the percentage of elapsed time the processor spends executing a non-idle thread. If the percentage is greater than 85 percent, the processor is overwhelmed and the server may require a faster processor.
                This counter is the primary indicator of processor activity. High values many not necessarily be bad. However, if the other processor-related counters are increasing linearly such as % Privileged Time or Processor Queue Length, high CPU utilization may be worth investigating).
                
                Threshold: 60% - Warning.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Processor % Processor Time avg value > 85% in the last 15 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Processor Time",1],900s:now-0)>85'
            -
              uuid: 3863527e56464dbe9cbf5b51e547d0fe
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Processor Time",1],900s:now-0)>85'
              name: '{HOST.NAME}: Processor % Processor Time avg value > 85% in the last 15 min'
              priority: WARNING
              description: |
                This measures the percentage of elapsed time the processor spends executing a non-idle thread. If the percentage is greater than 85 percent, the processor is overwhelmed and the server may require a faster processor.
                This counter is the primary indicator of processor activity. High values many not necessarily be bad. However, if the other processor-related counters are increasing linearly such as % Privileged Time or Processor Queue Length, high CPU utilization may be worth investigating).
                
                Threshold: 85% - Average.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Processor % Processor Time avg value > 95% in the last 15 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Processor Time",1],900s:now-0)>95'
            -
              uuid: 94543529cd084bcc88b3488bbfa4a4d9
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% Processor Time",1],900s:now-0)>95'
              name: '{HOST.NAME}: Processor % Processor Time avg value > 95% in the last 15 min'
              priority: AVERAGE
              description: |
                This measures the percentage of elapsed time the processor spends executing a non-idle thread. If the percentage is greater than 85 percent, the processor is overwhelmed and the server may require a faster processor.
                This counter is the primary indicator of processor activity. High values many not necessarily be bad. However, if the other processor-related counters are increasing linearly such as % Privileged Time or Processor Queue Length, high CPU utilization may be worth investigating).
                
                Threshold: 95% - Critical.
              manual_close: 'YES'
        -
          uuid: 1f918bb352364c84808aa6b01dd89745
          name: 'Processor % User Time'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Processor Information(_Total)\% User Time",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            This measures the percentage of elapsed time the processor spends in user mode. If this value is high, the server is busy with the application. One possible solution here is to optimize the application that is using up the processor resources.
            
            Threshold: Depends on the scenario. Expect 20–30% of processor time in a user-mode scenario like Web Proxy. Suspect more than 70% of % Processor Time unless using SSL or VPN.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: 564e30795fd946ada3c75a9e0d508995
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Processor Information(_Total)\% User Time",1],300s:now-0)>70'
              name: '{HOST.NAME}: Processor % User Time avg value > 70% in the last 5 min'
              priority: INFO
              description: |
                This measures the percentage of elapsed time the processor spends in user mode. If this value is high, the server is busy with the application. One possible solution here is to optimize the application that is using up the processor resources.
                
                Threshold: Depends on the scenario. Expect 20–30% of processor time in a user-mode scenario like Web Proxy. Suspect more than 70% of % Processor Time unless using SSL or VPN.
              manual_close: 'YES'
        -
          uuid: 30e632c0df024e4b96f16e0b58c60620
          name: 'Server Work Queues'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\Server Work Queues(*)\Queue Length",1]'
          delay: 30s
          value_type: FLOAT
          description: |
            Shows the current length of the server work queue for this CPU.
            
            Threshold: A sustained queue length greater than four might indicate processor congestion. This is an instantaneous count, not an average over time.
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: 0296869b5da843ad9d59c655f32ef461
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\Server Work Queues(*)\Queue Length",1],300s:now-0)>4'
              name: '{HOST.NAME}: Server Work Queues avg value > 4 in the last 5 min'
              priority: INFO
              description: |
                Shows the current length of the server work queue for this CPU. 
                
                Threshold: A sustained queue length greater than four might indicate processor congestion. This is an instantaneous count, not an average over time.
              manual_close: 'YES'
        -
          uuid: 27f2d9ad8d404fd4a04d51ce7bcb6853
          name: 'System % Registry Quota In Use'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\System\% Registry Quota In Use",1]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            % Registry Quota In Use is the percentage of the Total Registry Quota Allowed that is currently being used by the system.  This counter displays the current percentage value only; it is not an average.
            
            Threshold: Average - 60%.
            High - 85%.
          tags:
            -
              tag: Application
              value: 'System Performance'
          triggers:
            -
              uuid: c93583ce32144c9489d26222a96a334b
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\% Registry Quota In Use",1],300s:now-0)>60'
              name: '{HOST.NAME}: % registry Quota in Use {ITEM.LASTVALUE}'
              priority: AVERAGE
              description: |
                % Registry Quota In Use is the percentage of the Total Registry Quota Allowed that is currently being used by the system.  This counter displays the current percentage value only; it is not an average.
                
                Threshold: > 60%.
              manual_close: 'YES'
            -
              uuid: 2a14bde6e3d446af8e38e9794a30e877
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\% Registry Quota In Use",1],300s:now-0)>85'
              name: '{HOST.NAME}: % registry Quota in Use {ITEM.LASTVALUE}'
              priority: HIGH
              description: |
                % Registry Quota In Use is the percentage of the Total Registry Quota Allowed that is currently being used by the system.  This counter displays the current percentage value only, it is not an average.
                
                Threshold: High - 85%.
              manual_close: 'YES'
        -
          uuid: 1b49254be04e4ab09be498283c4957d5
          name: 'System Context Switches/sec'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\System\Context Switches/sec",1]'
          delay: 30s
          value_type: FLOAT
          units: S/sec
          description: |
            Indicates that the kernel has switched the thread it is running on a processor. A context switch occurs each time a new thread runs, and each time one thread takes over from another. A large number of threads is likely to increase the number of context switches. Context switches allow multiple threads to share time slices on the processors, but they also interrupt the processor and might reduce overall system performance, especially on multiprocessor computers. You should also observe the patterns of context switches over time.
            
            Threshold: High context switches/sec – more than 5000 context switches per second.
            Very high context switches/sec – more than 10,000 context switches per second.
          tags:
            -
              tag: Application
              value: 'System Performance'
        -
          uuid: cb991feefd5b43d6912a1402fd4cf35d
          name: 'Processor Queue Length'
          type: ZABBIX_ACTIVE
          key: 'perf_counter["\System\Processor Queue Length",1]'
          delay: 30s
          value_type: FLOAT
          description: |
            If there are more tasks ready to run than there are processors, threads queue up. The processor queue is the collection of threads that are ready but not able to be executed by the processor because another active thread is currently executing. A sustained or recurring queue of more than two threads is a clear indication of a processor bottleneck. You may get more throughput by reducing parallelism in those cases. You can use this counter in conjunction with the Processor\% Processor Time counter to determine if your application can benefit from more CPUs. There is a single queue for processor time, even on multiprocessor computers. Therefore, in a multiprocessor computer, divide the Processor Queue Length (PQL) value by the number of processors servicing the workload. If the CPU is very busy (90 percent and higher utilization) and the PQL average is consistently higher than 2 per processor, you may have a processor bottleneck that could benefit from additional CPUs. Or, you could reduce the number of threads and queue more at the application level. This will cause less context switching, and less context switching is good for reducing CPU load. The common reason for a PQL of 2 or higher with low CPU utilization is that requests for processor time arrive randomly and threads demand irregular amounts of time from the processor. This means that the processor is not a bottleneck but that it is your threading logic that needs to be improved.
            
            Threshold: Average - each processor has 10 or more threads waiting.(Determines if the average processor queue length exceeds the number of processors by 10. If this threshold is broken, then the processor(s) may be at capacity).
            High - each processor has 20 or more threads waiting(Determines if the average processor queue length exceeds twenty times the number of processors. If this threshold is broken, then the processor(s) are beyond capacity).
          tags:
            -
              tag: Application
              value: 'Processor Performance'
          triggers:
            -
              uuid: f94299747adb4829915847069531df36
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\Processor Queue Length",1],300s:now-0)>10'
              name: '{HOST.NAME}: Processor Queue Length avg value > 10 in the last 5 min'
              priority: INFO
              description: |
                If there are more tasks ready to run than there are processors, threads queue up. The processor queue is the collection of threads that are ready but not able to be executed by the processor because another active thread is currently executing. A sustained or recurring queue of more than two threads is a clear indication of a processor bottleneck. You may get more throughput by reducing parallelism in those cases. You can use this counter in conjunction with the Processor\% Processor Time counter to determine if your application can benefit from more CPUs. There is a single queue for processor time, even on multiprocessor computers. Therefore, in a multiprocessor computer, divide the Processor Queue Length (PQL) value by the number of processors servicing the workload. If the CPU is very busy (90 percent and higher utilization) and the PQL average is consistently higher than 2 per processor, you may have a processor bottleneck that could benefit from additional CPUs. Or, you could reduce the number of threads and queue more at the application level. This will cause less context switching, and less context switching is good for reducing CPU load. The common reason for a PQL of 2 or higher with low CPU utilization is that requests for processor time arrive randomly and threads demand irregular amounts of time from the processor. This means that the processor is not a bottleneck but that it is your threading logic that needs to be improved.
                
                Threshold: Average - each processor has 10 or more threads waiting.(Determines if the average processor queue length exceeds the number of processors by 10. If this threshold is broken, then the processor(s) may be at capacity).
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Processor Queue Length avg value > 20 in the last 5 min'
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\Processor Queue Length",1],300s:now-0)>20'
            -
              uuid: 211703adab8b44b9b071a616821f0da5
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\Processor Queue Length",1],300s:now-0)>20'
              name: '{HOST.NAME}: Processor Queue Length avg value > 20 in the last 5 min'
              priority: WARNING
              description: |
                If there are more tasks ready to run than there are processors, threads queue up. The processor queue is the collection of threads that are ready but not able to be executed by the processor because another active thread is currently executing. A sustained or recurring queue of more than two threads is a clear indication of a processor bottleneck. You may get more throughput by reducing parallelism in those cases. You can use this counter in conjunction with the Processor\% Processor Time counter to determine if your application can benefit from more CPUs. There is a single queue for processor time, even on multiprocessor computers. Therefore, in a multiprocessor computer, divide the Processor Queue Length (PQL) value by the number of processors servicing the workload. If the CPU is very busy (90 percent and higher utilization) and the PQL average is consistently higher than 2 per processor, you may have a processor bottleneck that could benefit from additional CPUs. Or, you could reduce the number of threads and queue more at the application level. This will cause less context switching, and less context switching is good for reducing CPU load. The common reason for a PQL of 2 or higher with low CPU utilization is that requests for processor time arrive randomly and threads demand irregular amounts of time from the processor. This means that the processor is not a bottleneck but that it is your threading logic that needs to be improved.
                
                Threshold: High - each processor has 20 or more threads waiting(Determines if the average processor queue length exceeds twenty times the number of processors. If this threshold is broken, then the processor(s) are beyond capacity).
              manual_close: 'YES'
        -
          uuid: 3bc6cbbe660145f983af3c4aeb98d5b7
          name: 'Service DNS Client'
          type: ZABBIX_ACTIVE
          key: 'service_state[Dnscache]'
          delay: 30s
          value_type: FLOAT
          description: 'The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer''s name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: a7ee18908a004ef2b5913d6a57798789
              expression: 'last(/OS Windows Server Baseline/service_state[Dnscache],#1:now-0)<>0'
              name: '{HOST.NAME}: Service DNS Cache {ITEM.LASTVALUE}'
              description: 'The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer''s name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start.'
              manual_close: 'YES'
        -
          uuid: 198aae95849f452699afd2c5381f86fd
          name: 'Service Event Log'
          type: ZABBIX_ACTIVE
          key: 'service_state[eventlog]'
          delay: 30s
          value_type: FLOAT
          description: 'This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: 5167cf21603a40369033809e00dddf5e
              expression: 'last(/OS Windows Server Baseline/service_state[eventlog],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Event Log {ITEM.LASTVALUE}'
              description: 'This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system.'
              manual_close: 'YES'
        -
          uuid: c6fece27f644475a8c43d582f947d2f1
          name: 'Service Group Policy Client'
          type: ZABBIX_ACTIVE
          key: 'service_state[gpsvc]'
          delay: 30s
          value_type: FLOAT
          description: 'The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is stopped or disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is stopped or disabled.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: b0c0e0b1d590402bbefbd4bda5273140
              expression: 'last(/OS Windows Server Baseline/service_state[gpsvc],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Group Policy Client {ITEM.LASTVALUE}'
              description: 'The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is stopped or disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is stopped or disabled.'
              manual_close: 'YES'
        -
          uuid: 800f4ae27abf4995b8b65b8f6179b112
          name: 'Service Server'
          type: ZABBIX_ACTIVE
          key: 'service_state[LanmanServer]'
          delay: 30s
          value_type: FLOAT
          description: 'Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: 84aac529f52642849f5d6d06645ec9e8
              expression: 'last(/OS Windows Server Baseline/service_state[LanmanServer],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Server {ITEM.LASTVALUE}'
              description: 'Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
              manual_close: 'YES'
        -
          uuid: 439f762da6ca4d44b6ab45bfcf12fc2e
          name: 'Service Workstation'
          type: ZABBIX_ACTIVE
          key: 'service_state[LanManWorkstation]'
          delay: 30s
          value_type: FLOAT
          description: 'Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: b84a3f6d994d4a89acbe19166627c5aa
              expression: 'last(/OS Windows Server Baseline/service_state[LanManWorkstation],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Workstation {ITEM.LASTVALUE}'
              description: 'Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
              manual_close: 'YES'
        -
          uuid: b3830345bc99470585ca0c2548e6db09
          name: 'Service Windows Firewall'
          type: ZABBIX_ACTIVE
          key: 'service_state[MpsSvc]'
          delay: 30s
          value_type: FLOAT
          description: 'Windows Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: 14b8e49e961043ea828bedc933c2f910
              expression: 'last(/OS Windows Server Baseline/service_state[MpsSvc],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Windows Firewall {ITEM.LASTVALUE}'
              description: 'Windows Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.'
              manual_close: 'YES'
        -
          uuid: 84db52e7dd53457ba3525b28d53d12ec
          name: 'Service Network List Service'
          type: ZABBIX_ACTIVE
          key: 'service_state[netprofm]'
          delay: 30s
          description: 'Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: ec1ba54a88f741cdac591cc9ab67b388
              expression: 'last(/OS Windows Server Baseline/service_state[netprofm],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Network List {ITEM.LASTVALUE}'
              description: 'Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.'
              manual_close: 'YES'
        -
          uuid: 2c248719235247a094c63806d7645029
          name: 'Service Network Location Awareness'
          type: ZABBIX_ACTIVE
          key: 'service_state[nlasvc]'
          delay: 30s
          value_type: FLOAT
          description: 'Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: 31543d52b853425da1f1f82a74dcf07d
              expression: 'last(/OS Windows Server Baseline/service_state[nlasvc],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Network Location Awareness {ITEM.LASTVALUE}'
              description: 'Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.'
              manual_close: 'YES'
        -
          uuid: 8e15b07253a34b0e8e5b767fe16a7bbf
          name: 'Service RPC Endpoint Mapper'
          type: ZABBIX_ACTIVE
          key: 'service_state[RpcEptMapper]'
          delay: 30s
          value_type: FLOAT
          description: 'Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function properly.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: 62009e9d3aa34283bcd88278ac3d4f83
              expression: 'last(/OS Windows Server Baseline/service_state[RpcEptMapper],#1:now-0)<>0'
              name: '{HOST.NAME}: Service RPC Endpoint Mapper {ITEM.LASTVALUE}'
              description: 'Resolves RPC interfaces identifiers to transport endpoints. If this service is stopped or disabled, programs using Remote Procedure Call (RPC) services will not function properly.'
              manual_close: 'YES'
        -
          uuid: d30a33cfe25b43c988123f6f48a07270
          name: 'Service Security Account Manager'
          type: ZABBIX_ACTIVE
          key: 'service_state[SamSs]'
          delay: 30s
          value_type: FLOAT
          description: 'The start up of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests.  Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled.'
          valuemap:
            name: 'Windows service state'
          tags:
            -
              tag: Application
              value: Services
          triggers:
            -
              uuid: f6224569cb3342f8b65195952762ddc8
              expression: 'last(/OS Windows Server Baseline/service_state[SamSs],#1:now-0)<>0'
              name: '{HOST.NAME}: Service Security Account Manager {ITEM.LASTVALUE}'
              description: 'The startup of this service signals other services that the Security Accounts Manager (SAM) is ready to accept requests.  Disabling this service will prevent other services in the system from being notified when the SAM is ready, which may in turn cause those services to fail to start correctly. This service should not be disabled.'
              manual_close: 'YES'
        -
          uuid: f6ec1da414cd42d3acb8c20a7973e0df
          name: 'Number of CPUs online'
          type: ZABBIX_ACTIVE
          key: 'system.cpu.num[online]'
          delay: 1h
          description: 'Number of CPUs online.'
          tags:
            -
              tag: Application
              value: CPU
        -
          uuid: 837b662332a3464bb33cdfd03b3bc2bd
          name: 'System uptime'
          type: ZABBIX_ACTIVE
          key: system.uptime
          delay: 30s
          value_type: FLOAT
          units: s
          description: 'System uptime in seconds.'
          tags:
            -
              tag: Application
              value: 'Operating System'
          triggers:
            -
              uuid: 458e4a575d1f4bc0b629330f590e17a4
              expression: 'change(/OS Windows Server Baseline/system.uptime)<0'
              name: '{HOST.NAME} has just been restarted'
              priority: INFO
              description: 'Server has just been restarted.'
              manual_close: 'YES'
        -
          uuid: ead49967f77b46da81e41ca10a32e1ac
          name: 'Memory Available'
          type: ZABBIX_ACTIVE
          key: 'vm.memory.size[available]'
          delay: 30s
          units: B
          description: |
            Inactive + Cached + Free memory.
            
            Threshold: Low on available memory – less than 10% available.
            Very low on available memory – less than 5% available.
            Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
          tags:
            -
              tag: Application
              value: Memory
          triggers:
            -
              uuid: b9de8054d7e8433ba7b1c512f57ee83d
              expression: 'last(/OS Windows Server Baseline/vm.memory.size[available],#1:now-0)<100'
              name: '{HOST.NAME}: Memory Available {ITEM.LASTVALUE}'
              priority: AVERAGE
              description: |
                Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\Available Bytes. The Virtual Memory Manager continually adjusts the space used in physical memory and on disk to maintain a minimum number of available bytes for the operating system and processes. When available bytes are plentiful, the Virtual Memory Manager lets the working sets of processes grow, or keeps them stable by removing an old page for each new page added. When available bytes are few, the Virtual Memory Manager must trim the working sets of processes to maintain the minimum required.
                
                Threshold: Low on available memory – less than 10% available.
                Very low on available memory – less than 5% available.
                Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
              manual_close: 'YES'
            -
              uuid: 69e6543760394def9ec42a2bdd6ae062
              expression: 'last(/OS Windows Server Baseline/vm.memory.size[available],#1:now-0)<300'
              name: '{HOST.NAME}: Memory Available {ITEM.LASTVALUE}'
              priority: WARNING
              description: |
                Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\Available Bytes. The Virtual Memory Manager continually adjusts the space used in physical memory and on disk to maintain a minimum number of available bytes for the operating system and processes. When available bytes are plentiful, the Virtual Memory Manager lets the working sets of processes grow, or keeps them stable by removing an old page for each new page added. When available bytes are few, the Virtual Memory Manager must trim the working sets of processes to maintain the minimum required.
                
                Threshold: Low on available memory – less than 10% available.
                Very low on available memory – less than 5% available.
                Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Memory Available {ITEM.LASTVALUE}'
                  expression: 'last(/OS Windows Server Baseline/vm.memory.size[available],#1:now-0)<100'
        -
          uuid: 9dfb5c306e0a45cb9bb78b8271ccba87
          name: 'Memory Cached'
          type: ZABBIX_ACTIVE
          key: 'vm.memory.size[cached]'
          delay: 30s
          units: B
          description: 'Memory Cached.'
          tags:
            -
              tag: Application
              value: Memory
        -
          uuid: 38e94b182a3440bba24e29c86a6277cd
          name: 'Memory Available %'
          type: ZABBIX_ACTIVE
          key: 'vm.memory.size[pavailable]'
          delay: 30s
          value_type: FLOAT
          units: '%'
          description: |
            Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\Available Bytes. The Virtual Memory Manager continually adjusts the space used in physical memory and on disk to maintain a minimum number of available bytes for the operating system and processes. When available bytes are plentiful, the Virtual Memory Manager lets the working sets of processes grow, or keeps them stable by removing an old page for each new page added. When available bytes are few, the Virtual Memory Manager must trim the working sets of processes to maintain the minimum required.
            
            Threshold: Low on available memory – less than 10% available.
            Very low on available memory – less than 5% available.
            Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
          tags:
            -
              tag: Application
              value: Memory
          triggers:
            -
              uuid: 170e368914bf4f0e8887b8d58001ecac
              expression: 'last(/OS Windows Server Baseline/vm.memory.size[pavailable],#1:now-0)<3'
              name: '{HOST.NAME}: Memory Available percentage {ITEM.LASTVALUE}'
              priority: AVERAGE
              description: |
                Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\Available Bytes. The Virtual Memory Manager continually adjusts the space used in physical memory and on disk to maintain a minimum number of available bytes for the operating system and processes. When available bytes are plentiful, the Virtual Memory Manager lets the working sets of processes grow, or keeps them stable by removing an old page for each new page added. When available bytes are few, the Virtual Memory Manager must trim the working sets of processes to maintain the minimum required.
                
                Threshold: Low on available memory – less than 10% available.
                Very low on available memory – less than 5% available.
                Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
              manual_close: 'YES'
            -
              uuid: 03320d7ab8bc4204b98ec9b38a5f940c
              expression: 'last(/OS Windows Server Baseline/vm.memory.size[pavailable],#1:now-0)<5'
              name: '{HOST.NAME}: Memory Available percentage {ITEM.LASTVALUE}'
              priority: WARNING
              description: |
                Available MBytes is the amount of physical memory available to processes running on the computer, in Megabytes, rather than bytes as reported in Memory\Available Bytes. The Virtual Memory Manager continually adjusts the space used in physical memory and on disk to maintain a minimum number of available bytes for the operating system and processes. When available bytes are plentiful, the Virtual Memory Manager lets the working sets of processes grow, or keeps them stable by removing an old page for each new page added. When available bytes are few, the Virtual Memory Manager must trim the working sets of processes to maintain the minimum required.
                
                Threshold: Low on available memory – less than 10% available.
                Very low on available memory – less than 5% available.
                Decreasing trend of 10 MB’s per hour. This could indicate a memory leak.
              manual_close: 'YES'
              dependencies:
                -
                  name: '{HOST.NAME}: Memory Available percentage {ITEM.LASTVALUE}'
                  expression: 'last(/OS Windows Server Baseline/vm.memory.size[pavailable],#1:now-0)<3'
        -
          uuid: 21e14da76b194a03ad090eac3699880c
          name: 'Memory Total'
          type: ZABBIX_ACTIVE
          key: 'vm.memory.size[total]'
          delay: 1h
          units: B
          description: 'Memory Total.'
          tags:
            -
              tag: Application
              value: Memory
        -
          uuid: 160e3c473cad4808b5a65f01216904bc
          name: 'Memory Size Used'
          type: ZABBIX_ACTIVE
          key: 'vm.memory.size[used]'
          delay: 30s
          units: B
          description: 'Memory Used.'
          tags:
            -
              tag: Application
              value: Memory
      discovery_rules:
        -
          uuid: 02967cbe08134263a4593b91861a43d7
          name: 'CPUs discovery'
          type: ZABBIX_ACTIVE
          key: system.cpu.discovery
          delay: 1h
          filter:
            conditions:
              -
                macro: '{#CPU.NUMBER}'
                value: '^[0-9]+$'
                formulaid: A
          lifetime: 90d
          description: 'Discovery of CPUs of different types as defined in global regular expression "CPU for discovery".'
          item_prototypes:
            -
              uuid: dc6a74b959644c528d510181832f73ac
              name: 'Processor No $1 Utilization % (1 min average)'
              type: ZABBIX_ACTIVE
              key: 'system.cpu.util[{#CPU.NUMBER},system,avg1]'
              delay: 30s
              value_type: FLOAT
              units: '%'
              description: 'CPU utilization in percent.'
              tags:
                -
                  tag: Application
                  value: 'Processor Performance'
              trigger_prototypes:
                -
                  uuid: 1a8ccecf5f244fb59ff3d2aba95be42b
                  expression: 'avg(/OS Windows Server Baseline/system.cpu.util[{#CPU.NUMBER},system,avg1],600s:now-0)>90'
                  name: 'Processor {#CPU.NUMBER} utilization avg value > 90% in the last 1 min'
                  priority: INFO
                  description: |
                    CPU utilization in percent.
                    
                    Threshold: 90 % in the last 15 minutes.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: 'Processor {#CPU.NUMBER} utilization avg value > 90% in the last 5 min'
                      expression: 'avg(/OS Windows Server Baseline/system.cpu.util[{#CPU.NUMBER},system,avg5],600s:now-0)>90'
            -
              uuid: 41a6960ee19f4fcd943dd1fb133063ec
              name: 'Processor No $1 Utilization % (5 min average)'
              type: ZABBIX_ACTIVE
              key: 'system.cpu.util[{#CPU.NUMBER},system,avg5]'
              delay: 30s
              value_type: FLOAT
              units: '%'
              description: 'CPU utilization in percent.'
              tags:
                -
                  tag: Application
                  value: 'Processor Performance'
              trigger_prototypes:
                -
                  uuid: 11ab7b0f8d1749dc8943c64b63c28f61
                  expression: 'avg(/OS Windows Server Baseline/system.cpu.util[{#CPU.NUMBER},system,avg5],600s:now-0)>90'
                  name: 'Processor {#CPU.NUMBER} utilization avg value > 90% in the last 5 min'
                  priority: WARNING
                  description: |
                    CPU utilization in percent.
                    
                    Threshold: 90 % in the last 15 minutes.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: 'Processor {#CPU.NUMBER} utilization avg value > 90% in the last 15 min'
                      expression: 'avg(/OS Windows Server Baseline/system.cpu.util[{#CPU.NUMBER},system,avg15],600s:now-0)>90'
            -
              uuid: adb8ac74d93e42e7b0e31cdae27c3da9
              name: 'Processor No $1 Utilization % (15 min average)'
              type: ZABBIX_ACTIVE
              key: 'system.cpu.util[{#CPU.NUMBER},system,avg15]'
              delay: 30s
              value_type: FLOAT
              units: '%'
              description: 'CPU utilization in percent.'
              tags:
                -
                  tag: Application
                  value: 'Processor Performance'
              trigger_prototypes:
                -
                  uuid: ea33f5607b2e4d29a8ec28bd6c579a51
                  expression: 'avg(/OS Windows Server Baseline/system.cpu.util[{#CPU.NUMBER},system,avg15],600s:now-0)>90'
                  name: 'Processor {#CPU.NUMBER} utilization avg value > 90% in the last 15 min'
                  priority: AVERAGE
                  description: |
                    CPU utilization in percent.
                    
                    Threshold: 90 % in the last 15 minutes.
                  manual_close: 'YES'
        -
          uuid: 075ed7dee40d4c7daadaf7ace30e5d20
          name: 'Mounted filesystem discovery'
          type: ZABBIX_ACTIVE
          key: vfs.fs.discovery
          delay: 1h
          filter:
            conditions:
              -
                macro: '{#FSTYPE}'
                value: '@File systems for discovery'
                formulaid: A
          lifetime: 90d
          description: 'Discovery of file systems of different types as defined in global regular expression "File systems for discovery".'
          item_prototypes:
            -
              uuid: 1134a85f673b4d23877873c5179b0b47
              name: $1
              type: ZABBIX_ACTIVE
              key: 'perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1]'
              delay: 30s
              value_type: FLOAT
              units: sec
              description: |
                This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is slow – more than 15 ms.
                Average disk responsiveness is very slow – more than 25 ms.
                Disk responsiveness is critical - more than 50 ms.
              tags:
                -
                  tag: Application
                  value: 'Disk Performance'
              trigger_prototypes:
                -
                  uuid: 7be8f73c2d624418bde35df34d9ce9a3
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.015'
                  name: '{HOST.NAME}: LogicalDisk Read Latency avg value > 0.015 in the last 5 min'
                  url: 'http://blogs.technet.com/b/askcore/archive/2012/03/16/windows-performance-monitor-disk-counters-explained.aspx'
                  priority: INFO
                  description: |
                    This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is slow – more than 15 ms.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: LogicalDisk Read Latency avg value > 0.025 in the last 5 min'
                      expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.025'
                -
                  uuid: 45ae4c0ca078476ab29ceda3be127c2e
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.025'
                  name: '{HOST.NAME}: LogicalDisk Read Latency avg value > 0.025 in the last 5 min'
                  priority: WARNING
                  description: |
                    This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is very slow – more than 25 ms.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: LogicalDisk Read Latency avg value > 0.050 in the last 5 min'
                      expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.050'
                -
                  uuid: e2043c7965ef4e7eb2c11cca69f12740
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.050'
                  name: '{HOST.NAME}: LogicalDisk Read Latency avg value > 0.050 in the last 5 min'
                  priority: AVERAGE
                  description: |
                    This measures the average time, in seconds, to read data from the disk. If the number is larger than 25 milliseconds (ms), that means the disk system is experiencing latency when reading from the disk. For mission-critical servers hosting SQL Server® and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The most logical solution here is to replace the current disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is very slow – more than 25 ms.
                  manual_close: 'YES'
            -
              uuid: 350c80c9559c473abcb8eeddbf6800e7
              name: $1
              type: ZABBIX_ACTIVE
              key: 'perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Transfer",1]'
              delay: 30s
              value_type: FLOAT
              units: sec
              description: 'Avg. Disk sec/Transfer is the time, in seconds, of the average disk transfer.'
              tags:
                -
                  tag: Application
                  value: 'Disk Performance'
            -
              uuid: 550780ce3b79440bad94bf93a76b57f2
              name: $1
              type: ZABBIX_ACTIVE
              key: 'perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1]'
              delay: 30s
              value_type: FLOAT
              units: sec
              description: |
                This measures the average time, in seconds, it takes to write data to the disk. If the number is larger than 25 ms, the disk system experiences latency when writing to the disk. For mission-critical servers hosting SQL Server and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The likely solution here is to replace the disk system with a faster disk system.
                
                Threshold: Average disk responsiveness is slow – more than 15 ms.
                Average disk responsiveness is very slow – more than 25 ms.
                Disk responsiveness is critical - more than 50 ms.
              tags:
                -
                  tag: Application
                  value: 'Disk Performance'
              trigger_prototypes:
                -
                  uuid: fdf7a64413c1441b9378b50b4d9adc76
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.015'
                  name: '{HOST.NAME}: LogicalDisk WriteLatency avg value > 0.015 in the last 5 min'
                  priority: INFO
                  description: |
                    This measures the average time, in seconds, it takes to write data to the disk. If the number is larger than 25 ms, the disk system experiences latency when writing to the disk. For mission-critical servers hosting SQL Server and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The likely solution here is to replace the disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is slow – more than 15 ms.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: LogicalDisk WriteLatency avg value > 0.025 in the last 5 min'
                      expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.025'
                -
                  uuid: 91e7a1b56d684c1fa54fb154f194cb38
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.025'
                  name: '{HOST.NAME}: LogicalDisk WriteLatency avg value > 0.025 in the last 5 min'
                  priority: WARNING
                  description: |
                    This measures the average time, in seconds, it takes to write data to the disk. If the number is larger than 25 ms, the disk system experiences latency when writing to the disk. For mission-critical servers hosting SQL Server and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The likely solution here is to replace the disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is slow – more than 15 ms.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: LogicalDisk Write Latency avg value > 0.050 in the last 5 min'
                      expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.050'
                -
                  uuid: bb0baac5124d433b8f24083095081ffa
                  expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.050'
                  name: '{HOST.NAME}: LogicalDisk Write Latency avg value > 0.050 in the last 5 min'
                  priority: AVERAGE
                  description: |
                    This measures the average time, in seconds, it takes to write data to the disk. If the number is larger than 25 ms, the disk system experiences latency when writing to the disk. For mission-critical servers hosting SQL Server and Exchange Server, the acceptable threshold is much lower, approximately 10 ms. The likely solution here is to replace the disk system with a faster disk system.
                    
                    Threshold: Average disk responsiveness is slow – more than 15 ms.
                  manual_close: 'YES'
            -
              uuid: af3af97513fa4cdcb93fdd5cfd9b48f2
              name: $1
              type: ZABBIX_ACTIVE
              key: 'perf_counter["\LogicalDisk({#FSNAME})\Disk Transfers/sec",1]'
              delay: 30s
              value_type: FLOAT
              units: T/sec
              description: |
                Disk Transfers/sec is the rate of read and write operations on the disk.
                
                Threshold: Less than 80 I/O’s per second on average when disk latency is longer than 25 ms. This may indicate too many virtual LUNs using the same physical disks on a SAN.
              tags:
                -
                  tag: Application
                  value: 'Disk Performance'
            -
              uuid: 0c42c903bfc1426191cec9c1f2e9d982
              name: 'LogicalDisk Disk $1 Space Available'
              type: ZABBIX_ACTIVE
              key: 'vfs.fs.size[{#FSNAME},free]'
              delay: 30s
              units: B
              description: 'This measures the amount of free space on the selected logical disk drive.'
              tags:
                -
                  tag: Application
                  value: Disk
            -
              uuid: 0776976aa7e44ec39c53f68cb77f693c
              name: 'LogicalDisk Disk $1 Space Available %'
              type: ZABBIX_ACTIVE
              key: 'vfs.fs.size[{#FSNAME},pfree]'
              delay: 30s
              value_type: FLOAT
              units: '%'
              description: |
                This measures the percentage of free space on the selected logical disk drive. 
                
                Threshold: If this falls below 15 percent, you risk running out of free space for the OS to store critical files.
              tags:
                -
                  tag: Application
                  value: Disk
              trigger_prototypes:
                -
                  uuid: 911be952fabc4b26a00608e176d578ad
                  expression: 'last(/OS Windows Server Baseline/vfs.fs.size[{#FSNAME},pfree])<3'
                  name: '{HOST.NAME}: Free Disk {#FSNAME} Space {ITEM.LASTVALUE}'
                  priority: AVERAGE
                  description: |
                    This measures the percentage of free space on the selected logical disk drive. 
                    
                    Threshold: If this falls below 15 percent, you risk running out of free space for the OS to store critical files.
                  manual_close: 'YES'
                -
                  uuid: 1a2204102f1e4d17a62611e57a89d24e
                  expression: 'last(/OS Windows Server Baseline/vfs.fs.size[{#FSNAME},pfree])<5'
                  name: '{HOST.NAME}: Free Disk {#FSNAME} Space {ITEM.LASTVALUE}'
                  priority: WARNING
                  description: |
                    This measures the percentage of free space on the selected logical disk drive. 
                    
                    Threshold: If this falls below 15 percent, you risk running out of free space for the OS to store critical files.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: Free Disk {#FSNAME} Space {ITEM.LASTVALUE}'
                      expression: 'last(/OS Windows Server Baseline/vfs.fs.size[{#FSNAME},pfree])<3'
                -
                  uuid: bacc6747032444d883923c9769c4bd9d
                  expression: 'last(/OS Windows Server Baseline/vfs.fs.size[{#FSNAME},pfree])<10'
                  name: '{HOST.NAME}: Free Disk {#FSNAME} Space {ITEM.LASTVALUE}'
                  priority: INFO
                  description: |
                    This measures the percentage of free space on the selected logical disk drive. 
                    
                    Threshold: If this falls below 15 percent, you risk running out of free space for the OS to store critical files.
                  manual_close: 'YES'
                  dependencies:
                    -
                      name: '{HOST.NAME}: Free Disk {#FSNAME} Space {ITEM.LASTVALUE}'
                      expression: 'last(/OS Windows Server Baseline/vfs.fs.size[{#FSNAME},pfree])<5'
            -
              uuid: e8681ef7e5fa4bc8a43bbb3b2bd2fef1
              name: 'LogicalDisk Disk $1 Space Used %'
              type: ZABBIX_ACTIVE
              key: 'vfs.fs.size[{#FSNAME},pused]'
              delay: 30s
              value_type: FLOAT
              units: '%'
              description: 'LogicalDisk Space Used in percentes.'
              tags:
                -
                  tag: Application
                  value: Disk
            -
              uuid: 4a3061bd75584c13a23724f35fda48b7
              name: 'LogicalDisk Disk $1 Space Total'
              type: ZABBIX_ACTIVE
              key: 'vfs.fs.size[{#FSNAME},total]'
              delay: 1h
              units: B
              description: 'LogicalDisk Space Total.'
              tags:
                -
                  tag: Application
                  value: Disk
            -
              uuid: 29fc55985fec409d9c1148cbf1976acf
              name: 'LogicalDisk Disk $1 Space Used'
              type: ZABBIX_ACTIVE
              key: 'vfs.fs.size[{#FSNAME},used]'
              delay: 30s
              units: B
              description: 'LogicalDisk Space Used.'
              tags:
                -
                  tag: Application
                  value: Disk
          trigger_prototypes:
            -
              uuid: 3fe0c40f050d45e7ba41fd5ed503b7f7
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Disk Transfers/sec",1],300s:now-0)<80 and avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1],300s:now-0)>0.025'
              name: '{HOST.NAME}: LogicalDisk Transfer(Read) Latency avg value < 80 in the last 5 min'
              priority: INFO
              description: |
                Indicates the number of read and writes completed per second, regardless of how much data they involve. Measures disk utilization.
                
                Threshold: Less than 80 I/O’s per second on average when disk latency is longer than 25 ms. This may indicate too many virtual LUNs using the same physical disks on a SAN.
              manual_close: 'YES'
            -
              uuid: 8be3bdb11028407c8162d773100dffb2
              expression: 'avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Disk Transfers/sec",1],300s:now-0)<80 and avg(/OS Windows Server Baseline/perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1],300s:now-0)>0.025'
              name: '{HOST.NAME}: LogicalDisk Transfer(Write) Latency avg value < 80 in the last 5 min'
              priority: INFO
              description: |
                Indicates the number of read and writes completed per second, regardless of how much data they involve. Measures disk utilization.
                
                Threshold: Less than 80 I/O’s per second on average when disk latency is longer than 25 ms. This may indicate too many virtual LUNs using the same physical disks on a SAN.
              manual_close: 'YES'
          graph_prototypes:
            -
              uuid: 11a9d8bc6d564ff58cabfc7f6ef0d2cc
              name: 'LogicalDisk Disk {#FSNAME} Space'
              graph_items:
                -
                  color: 00C800
                  item:
                    host: 'OS Windows Server Baseline'
                    key: 'vfs.fs.size[{#FSNAME},free]'
                -
                  sortorder: '1'
                  color: 0000C8
                  item:
                    host: 'OS Windows Server Baseline'
                    key: 'vfs.fs.size[{#FSNAME},total]'
            -
              uuid: 2541b2b27c2943349e584bde60b3e22c
              name: 'Logical Disk {#FSNAME} Read/Write Latency'
              graph_items:
                -
                  color: 00C800
                  item:
                    host: 'OS Windows Server Baseline'
                    key: 'perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Read",1]'
                -
                  sortorder: '1'
                  color: C80000
                  item:
                    host: 'OS Windows Server Baseline'
                    key: 'perf_counter["\LogicalDisk({#FSNAME})\Avg. Disk sec/Write",1]'
      valuemaps:
        -
          uuid: 0def1c12c7e443b7b5eec40417170a31
          name: 'Windows service state'
          mappings:
            -
              value: '0'
              newvalue: Running
            -
              value: '1'
              newvalue: Paused
            -
              value: '2'
              newvalue: 'Start pending'
            -
              value: '3'
              newvalue: 'Pause pending'
            -
              value: '4'
              newvalue: 'Continue pending'
            -
              value: '5'
              newvalue: 'Stop pending'
            -
              value: '6'
              newvalue: Stopped
            -
              value: '7'
              newvalue: Unknown
            -
              value: '255'
              newvalue: 'No such service'
  triggers:
    -
      uuid: 5566c0b2603b4c3b9cda8cde5ea9f28d
      expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\Context Switches/sec",1],300s:now-0)/last(/OS Windows Server Baseline/system.cpu.num[online])>5000'
      name: '{HOST.NAME}: Context Switches/sec {ITEM.LASTVALUE}'
      priority: WARNING
      description: |
        Indicates that the kernel has switched the thread it is running on a processor. A context switch occurs each time a new thread runs, and each time one thread takes over from another. A large number of threads is likely to increase the number of context switches. Context switches allow multiple threads to share time slices on the processors, but they also interrupt the processor and might reduce overall system performance, especially on multiprocessor computers. You should also observe the patterns of context switches over time.
        
        Threshold: High context switches/sec – more than 5000 context switches per second.
      manual_close: 'YES'
    -
      uuid: 4047e52e9e8846b197ded1293bf8d916
      expression: 'avg(/OS Windows Server Baseline/perf_counter["\System\Context Switches/sec",1],300s:now-0)/last(/OS Windows Server Baseline/system.cpu.num[online])>10000'
      name: '{HOST.NAME}: Context Switches/sec {ITEM.LASTVALUE}'
      priority: AVERAGE
      description: |
        Indicates that the kernel has switched the thread it is running on a processor. A context switch occurs each time a new thread runs, and each time one thread takes over from another. A large number of threads is likely to increase the number of context switches. Context switches allow multiple threads to share time slices on the processors, but they also interrupt the processor and might reduce overall system performance, especially on multiprocessor computers. You should also observe the patterns of context switches over time.
        
        Threshold: Very high context switches/sec – more than 10,000 context switches per second.
      manual_close: 'YES'
  graphs:
    -
      uuid: a1b50d432a724688b359a082a63d7261
      name: 'Memory % Committed Bytes in Use'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Memory\% Committed Bytes in Use",1]'
    -
      uuid: a785ffb436c642eb912112c6be82cb4d
      name: 'Memory Free Page Table Entries'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Memory\Free System Page Table Entries",1]'
    -
      uuid: f5d2a21a1472453486df40326822e12d
      name: 'Memory Pages and Page Inputs'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Memory\Pages/sec",1]'
        -
          sortorder: '1'
          color: 00C800
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Memory\Pages Input/sec",1]'
    -
      uuid: 7ddcc3b081594648ba32fb4ce98776d6
      name: 'Memory Total, Cached, Available and Free'
      graph_items:
        -
          color: 0000C8
          item:
            host: 'OS Windows Server Baseline'
            key: 'vm.memory.size[total]'
        -
          sortorder: '1'
          color: C80000
          item:
            host: 'OS Windows Server Baseline'
            key: 'vm.memory.size[cached]'
        -
          sortorder: '2'
          color: 00BB00
          item:
            host: 'OS Windows Server Baseline'
            key: 'vm.memory.size[available]'
    -
      uuid: e945a2dfae1845d99dc550b006b3e336
      name: 'PhysicalDisk Avg. Disk Queue Length'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\PhysicalDisk(_Total)\Avg. Disk Queue Length",1]'
    -
      uuid: 916aa2ad5d8843b396b8c5ae40cc83e1
      name: 'Processes IO Operations/sec'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Process(_Total)\IO Data Operations/sec",1]'
        -
          sortorder: '1'
          color: 00C800
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Process(_Total)\IO Other Operations/sec",1]'
        -
          sortorder: '2'
          color: 0000C8
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Process(_Total)\IO Read Operations/sec",1]'
        -
          sortorder: '3'
          color: C800C8
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Process(_Total)\IO Write Operations/sec",1]'
    -
      uuid: 6d4bbc396dcc4d008c243e23062d08f0
      name: 'Processor and Server Queues'
      graph_items:
        -
          color: C80000
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\System\Processor Queue Length",1]'
        -
          sortorder: '1'
          color: 00C800
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\Server Work Queues(*)\Queue Length",1]'
    -
      uuid: 7f6b761d14db45dfa4e28943380f704b
      name: 'System % Registry Quota In Use'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\System\% Registry Quota In Use",1]'
    -
      uuid: 194f526fb26945edb34e8b7065768d76
      name: 'System Context Switches/sec'
      graph_items:
        -
          color: FF3333
          item:
            host: 'OS Windows Server Baseline'
            key: 'perf_counter["\System\Context Switches/sec",1]'