Zabbix 2.0 low level discovery – network interfaces

I recently posted how I set up the low level discovery for file systems.  Today I’ll show you how to set up network interface discovery and soon SNMP.

Zabbix 2.0 makes it easy to add network devices, file systems, and SNMP devices for monitoring.  They call their new method low-level discovery and I will show you how I set it up so you can quickly start monitoring your environment.

The new discovery rules are created in the Zabbix UI under Configuration, Templates, Discovery.  I have created network interface discovery rules in the Windows template and the Linux template.

Network Interface Discovery Rules

There is no difference in how I set up this discovery rule between Windows and Linux.  I simply made the same rules under each template.  Here are the details for setting up the low level network interface discovery for the Windows and Linux templates.

Name: Windows Network Discovery
Type: Zabbix agent (active)
Key: net.if.discovery
Update interval: 7200
Keep lost resource period: 0
Filter macro: {#IFNAME}
Regexp: @Network-discovery

After reading some comments on the Zabbix forums, it looks like using the global regular expressions helps a lot with the Windows network interface discovery.  Without the regexp you will get a lot of results on your typical Windows box.  Linux has a similar issue but usually the only ‘extra’ interface that is found is the LO, so it’s not as big of a deal.  Either way, this regular expression works for both Windows and Linux.

Set your global regular expressions under Administration, General, Regular Expressions.  I’ve created mine to not match to loopback interfaces and other generic interfaces.  Here’s a screenshot showing my config.


Network Interface Prototypes

Once the discovery entry is made, you should create item prototypes for the items you are interested in.  The prototype will be applied to each of the discovered network interfaces.

I created 2 prototype items for the low level network interface discovery for both Windows and Linux.

  • Incoming Traffic
  • Outgoing Traffic

Each item prototype is pretty much the same, just a change for the name and key.

Incoming traffic

Name: Incoming - $1
Type:Zabbix agent (active)
Type: Numeric (unsigned)
Units: bps
Use custom multiplier: 8
Update interval: 60
Keep history: 7
Keep trends: 365
Store value: Delta (speed per second)
Applications: Network

outgoing traffic

Name: Outgoing - $1
Type:Zabbix agent (active)
Key: net.if.out[{#IFNAME}]
Type: Numeric (unsigned)
Units: bps
Use custom multiplier: 8
Update interval: 60
Keep history: 7
Keep trends: 365
Store value: Delta (speed per second)
Applications: Network

I didn’t set up any trigger prototypes for the network interfaces but I did create a graph prototype.

This shows a graph prototype for Windows, but just like the items the graph prototype for Linux is exactly the same.


That’s about it.  The addition of low-level discovery in Zabbix is fantastic and I’m sure you will immediately see how helpful it can be once you get it set up in Zabbix 2.0.

Let me know what you think about this new feature.  I’ll post information about SNMP discovery shortly.

8 Comments on “Zabbix 2.0 low level discovery – network interfaces”

  1. Richard says:

    Great tutorial !! I am impatient to read the next article about SNMP and network interfaces !!!Im trying to make it functionnal but some problems appeared with unsupported parameters in the zabbix server log (key of the prototype element incorrect).

  2. Hi,
    Good post and explanation. One thing though. The Graph prototype must contain unique identifier {#IFNAME} in it. Otherwise the graph don’t get created with error stating that the graph already exists. Tested on latest stable 2.0.4


  3. Daniel says:

    Not sure if you have messed with triggers for this network discovery. I would like to trigger every time a specific network interface downloads more than 2Gigs in a day. So I created the following trigger prototype:
    {Template OS[{#IFNAME},bytes].sum(1d)}>2G

    Zabbix very much doesnt like the “bytes” part of that expression, and im not sure why. any suggestions?

  4. darrynvt says:

    I have literally spent 3 day’s writing code in .NET to try do this. I’m such an idiot. Didn’t realise that the local net.if.discovery worked in Windows! BRILLIANT Article!!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s