Windows Zabbix agent

Overview

The Windows Zabbix agent items are presented in two lists:

Note that all item keys supported by Zabbix agent on Windows are also supported by the new generation Zabbix agent 2. See the additional item keys that you can use with the agent 2 only.

See also: Minimum permissions for Windows items

Shared items

The table below lists Zabbix agent items that are supported on Windows and are shared with the UNIX Zabbix agent:

  • The item key is a link to full details of the UNIX Zabbix agent item
  • Windows-relevant item comments are included
Item keyDescriptionItem group
logThe monitoring of a log file. This item is not supported for Windows Event Log.
The persistent_dir parameter is not supported on Windows.
Log monitoring
log.countThe count of matched lines in a monitored log file. This item is not supported for Windows Event Log.
The persistent_dir parameter is not supported on Windows.
logrtThe monitoring of a log file that is rotated. This item is not supported for Windows Event Log.
The persistent_dir parameter is not supported on Windows.
logrt.countThe count of matched lines in a monitored log file that is rotated. This item is not supported for Windows Event Log.
The persistent_dir parameter is not supported on Windows.
modbus.getReads Modbus data.Modbus
net.dnsChecks if the DNS service is up.
The ip, timeout and count parameters are ignored on Windows.
Network
net.dns.recordPerforms a DNS query.
The ip, timeout and count parameters are ignored on Windows.
net.if.discoveryThe list of network interfaces.
Some Windows versions (for example, Server 2008) might require the latest updates installed to support non-ASCII characters in interface names.
net.if.inThe incoming traffic statistics on a network interface.
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.
Multi-byte interface names on Windows are supported.
You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.
net.if.outThe outgoing traffic statistics on a network interface.
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.
Multi-byte interface names on Windows are supported.
You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.
net.if.totalThe sum of incoming and outgoing traffic statistics on a network interface.
On Windows, the item gets values from 64-bit counters if available. 64-bit interface statistic counters were introduced in Windows Vista and Windows Server 2008. If 64-bit counters are not available, the agent uses 32-bit counters.
You may obtain network interface descriptions on Windows with net.if.discovery or net.if.list items.
net.tcp.listenChecks if this TCP port is in LISTEN state.
net.tcp.portChecks if it is possible to make a TCP connection to the specified port.
net.tcp.serviceChecks if a service is running and accepting TCP connections.
Checking of LDAP and HTTPS on Windows is only supported by Zabbix agent 2.
net.tcp.service.perfChecks the performance of a TCP service.
Checking of LDAP and HTTPS on Windows is only supported by Zabbix agent 2.
net.tcp.socket.countReturns the number of TCP sockets that match parameters.
This item is supported on Linux by Zabbix agent, but on Windows it is supported only by Zabbix agent 2 on 64-bit Windows.
net.udp.serviceChecks if a service is running and responding to UDP requests.
net.udp.service.perfChecks the performance of a UDP service.
net.udp.socket.countReturns the number of UDP sockets that match parameters.
This item is supported on Linux by Zabbix agent, but on Windows it is supported only by Zabbix agent 2 on 64-bit Windows.
proc.numThe number of processes.
On Windows, only the name and user parameters are supported.
Processes
system.cpu.discoveryThe list of detected CPUs/CPU cores.System
system.cpu.loadThe CPU load.
system.cpu.numThe number of CPUs.
system.cpu.utilThe CPU utilization percentage.
The value is acquired using the Processor Time performance counter. Note that since Windows 8 its Task Manager shows CPU utilization based on the Processor Utility performance counter, while in previous versions it was the Processor Time counter.
system is the only type parameter supported on Windows.
system.hostnameThe system host name.
The value is acquired by either GetComputerName() (for netbios) or gethostname() (for host) functions on Windows.
See also a more detailed description.
system.localtimeThe system time.
system.runRun the specified command on the host.
system.sw.archThe software architecture information.
system.swap.sizeThe swap space size in bytes or in percentage from total.
The pused type parameter is supported on Linux by Zabbix agent, but on Windows it is supported only by Zabbix agent 2.
Note that this key might report incorrect swap space size/percentage on virtualized (VMware ESXi, VirtualBox) Windows platforms. In this case you may use the perf_counter[\700(_Total)\702] key to obtain correct swap space percentage.
system.unameIdentification of the system.
On Windows the value for this item is obtained from Win32_OperatingSystem and Win32_Processor WMI classes. The OS name (including edition) might be translated to the user’s display language. On some versions of Windows it contains trademark symbols and extra spaces.
system.uptimeThe system uptime in seconds.
vfs.dir.countThe directory entry count.
On Windows, directory symlinks are skipped and hard links are counted only once.
Virtual file systems
vfs.dir.getThe directory entry list.
On Windows, directory symlinks are skipped and hard links are counted only once.
vfs.dir.sizeThe directory size.
On Windows any symlink is skipped and hard links are taken into account only once.
vfs.file.cksumThe file checksum, calculated by the UNIX cksum algorithm.
vfs.file.contentsRetrieving the contents of a file.
vfs.file.existsChecks if the file exists.
On Windows the double quotes have to be backslash ‘\’ escaped and the whole item key enclosed in double quotes when using the command line utility for calling zabbix_get.exe or agent2.
Note that the item may turn unsupported on Windows if a directory is searched within a non-existing directory, e.g. vfs.file.exists[C:\no\dir,dir] (where ‘no’ does not exist).
vfs.file.getReturns information about a file.
Supported file types on Windows: regular file, directory, symbolic link
vfs.file.md5sumThe MD5 checksum of file.
vfs.file.ownerRetrieves the owner of a file.
vfs.file.regexpRetrieve a string in the file.
vfs.file.regmatchFind a string in the file.
vfs.file.sizeThe file size.
vfs.file.timeThe file time information.
On Windows XP vfs.file.time[file,change] may be equal to vfs.file.time[file,access].
vfs.fs.discoveryThe list of mounted filesystems with their type and mount options.
The {#FSLABEL} macro is supported on Windows since Zabbix 6.0.
vfs.fs.getThe list of mounted filesystems with their type, available disk space, inode statistics and mount options.
The {#FSLABEL} macro is supported on Windows since Zabbix 6.0.
vfs.fs.sizeThe disk space in bytes or in percentage from total.
vm.memory.sizeThe memory size in bytes or in percentage from total.Virtual memory
web.page.getGet the content of a web page.Web monitoring
web.page.perfThe loading time of a full web page.
web.page.regexpFind a string on the web page.
agent.hostmetadataThe agent host metadata.Zabbix
agent.hostnameThe agent host name.
agent.pingThe agent availability check.
agent.variantThe variant of Zabbix agent (Zabbix agent or Zabbix agent 2).
agent.versionThe version of Zabbix agent.
zabbix.statsReturns a set of Zabbix server or proxy internal metrics remotely.
zabbix.statsReturns the number of monitored items in the queue which are delayed on Zabbix server or proxy remotely.

Windows-specific items

The table provides details on the item keys that are supported only by the Windows Zabbix agent.

Windows-specific items sometimes are an approximate counterpart of a similar agent item, for example proc_info, supported on Windows, roughly corresponds to the proc.mem item, not supported on Windows.

The item key is a link to full item key details.

Item keyDescriptionItem group
eventlogThe Windows event log monitoring.Log monitoring
net.if.listThe network interface list (includes interface type, status, IPv4 address, description).Network
perf_counterThe value of any Windows performance counter.Performance counters
perf_counter_enThe value of any Windows performance counter in English.
perf_instance.discoveryThe list of object instances of Windows performance counters.
perf_instance_en.discoveryThe list of object instances of Windows performance counters, discovered using the object names in English.
proc_infoVarious information about specific process(es).Processes
registry.dataReturn data for the specified value name in the Windows Registry key.Registry
registry.getThe list of Windows Registry values or keys located at given key.
service.discoveryThe list of Windows services.Services
service.infoInformation about a service.
servicesThe listing of services.
vm.vmemory.sizeThe virtual memory size in bytes or in percentage from the total.Virtual memory
wmi.getExecute a WMI query and return the first selected object.WMI
wmi.getallExecute a WMI query and return the whole response.

Item key details

Parameters without angle brackets are mandatory. Parameters marked with angle brackets < > are optional.

eventlog[name,<regexp>,<severity>,<source>,<eventid>,<maxlines>,<mode>]

The event log monitoring.
Return value: Log.

Parameters:

  • name - the name of the event log;

  • regexp - a regular expression describing the required pattern (case sensitive);

  • severity - a regular expression describing severity (case insensitive). This parameter accepts the following values: “Information”, “Warning”, “Error”, “Critical”, “Verbose” (running on Windows Vista or newer).

  • source - a regular expression describing the source identifier (case insensitive);

  • eventid - a regular expression describing the event identifier(s) (case sensitive);

  • maxlines - the maximum number of new lines per second the agent will send to Zabbix server or proxy. This parameter overrides the value of ‘MaxLinesPerSecond’ in zabbix_agentd.win.conf.

  • mode - possible values: all (default) or skip - skip the processing of older data (affects only newly created items).

Comments:

  • The item must be configured as an active check;
  • The agent is unable to send in events from the “Forwarded events” log;
  • Windows Eventing 6.0 is supported;
  • Selecting a non-Log type of information for this item will lead to the loss of local timestamp, as well as log severity and source information;
  • See also additional information on log monitoring.

Examples:

  1. eventlog[Application]
  2. eventlog[Security,,"Failure Audit",,^(529|680)$]
  3. eventlog[System,,"Warning|Error"]
  4. eventlog[System,,,,^1$]
  5. eventlog[System,,,,@TWOSHORT] #here a custom regular expression named `TWOSHORT` is referenced (defined as a *Result is TRUE* type, the expression itself being `^1$|^70$`).
net.if.list

The network interface list (includes interface type, status, IPv4 address, description).
Return value: Text.

Comments:

  • Multi-byte interface names supported;
  • Disabled interfaces are not listed;
  • Enabling/disabling some components may change their ordering in the Windows interface name;
  • Some Windows versions (for example, Server 2008) might require the latest updates installed to support non-ASCII characters in interface names.
perf_counter[counter,<interval>]

The value of any Windows performance counter.
Return value: Integer, float, string or text (depending on the request).

Parameters:

  • counter - the path to the counter;

  • interval - the last N seconds for storing the average value. The interval must be between 1 and 900 seconds (included) and the default value is 1.

Comments:

  • interval is used for counters that require more than one sample (like CPU utilization), so the check returns an average value for last “interval” seconds every time;
  • Performance Monitor can be used to obtain the list of available counters.
  • See also: Windows performance counters.
perf_counter_en[counter,<interval>]

The value of any Windows performance counter in English.
Return value: Integer, float, string or text (depending on the request).

Parameters:

  • counter - the path to the counter in English;

  • interval - the last N seconds for storing the average value. The interval must be between 1 and 900 seconds (included) and the default value is 1.

Comments:

  • interval is used for counters that require more than one sample (like CPU utilization), so the check returns an average value for last “interval” seconds every time;
  • This item is only supported on Windows Server 2008/Vista and above;
  • You can find the list of English strings by viewing the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\009.
perf_instance.discovery[object]

The list of object instances of Windows performance counters. Used for low-level discovery.
Return value: JSON object.

Parameter:

  • object - the object name (localized).
perf_instance_en.discovery[object]

The list of object instances of Windows performance counters, discovered using the object names in English. Used for low-level discovery.
Return value: JSON object.

Parameter:

  • object - the object name (in English).
proc_info[process,<attribute>,<type>]

Various information about specific process(es).
Return value: Float.

Parameters:

  • process - the process name;

  • attribute - the requested process attribute;

  • type - the representation type (meaningful when more than one process with the same name exists)

Comments:

  • The following attributes are supported:
    vmsize (default) - size of process virtual memory in Kbytes
    wkset - size of process working set (amount of physical memory used by process) in Kbytes
    pf - number of page faults
    ktime - process kernel time in milliseconds
    utime - process user time in milliseconds
    io_read_b - number of bytes read by process during I/O operations
    io_read_op - number of read operation performed by process
    io_write_b - number of bytes written by process during I/O operations
    io_write_op - number of write operation performed by process
    io_other_b - number of bytes transferred by process during operations other than read and write operations
    io_other_op - number of I/O operations performed by process, other than read and write operations
    gdiobj - number of GDI objects used by process
    userobj - number of USER objects used by process;

  • Valid types are:
    avg (default) - average value for all processes named <process>
    min - minimum value among all processes named <process>
    max - maximum value among all processes named <process>
    sum - sum of values for all processes named <process>;

  • io\*, _gdiobj and userobj attributes are available only on Windows 2000 and later versions of Windows, not on Windows NT 4.0;
  • On a 64-bit system, a 64-bit Zabbix agent is required for this item to work correctly.

Examples:

  1. proc_info[iexplore.exe,wkset,sum] #retrieve the amount of physical memory taken by all Internet Explorer processes
  2. proc_info[iexplore.exe,pf,avg] #retrieve the average number of page faults for Internet Explorer processes
registry.data[key,<value name>]

Return data for the specified value name in the Windows Registry key.
Return value: Integer, string or text (depending on the value type)

Parameters:

  • key - the registry key including the root key; root abbreviations (e.g. HKLM) are allowed;
  • value name - the registry value name in the key (empty string “” by default). The default value is returned if the value name is not supplied.

Comments:

  • Supported root abbreviations:
    HKCR - HKEY_CLASSES_ROOT
    HKCC - HKEY_CURRENT_CONFIG
    HKCU - HKEY_CURRENT_USER
    HKCULS - HKEY_CURRENT_USER_LOCAL_SETTINGS
    HKLM - HKEY_LOCAL_MACHINE
    HKPD - HKEY_PERFORMANCE_DATA
    HKPN - HKEY_PERFORMANCE_NLSTEXT
    HKPT - HKEY_PERFORMANCE_TEXT
    HKU - HKEY_USERS

  • Keys with spaces must be double-quoted.

Examples:

  1. registry.data["HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting"] #return the data of the default value of this key
  2. registry.data["HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting","EnableZip"] #return the data of the value named "Enable Zip" in this key
registry.get[key,<mode>,<name regexp>]

The list of Windows Registry values or keys located at given key.
Return value: JSON object.

Parameters:

  • key - the registry key including the root key; root abbreviations (e.g. HKLM) are allowed (see comments for registry.data[] to see full list of abbreviations);

  • mode - possible values:
    values (default) or keys;

  • name regexp - only discover values with names that match the regexp (default - discover all values). Allowed only with values as mode.

Keys with spaces must be double-quoted.

Examples:

  1. registry.get[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,values,"^DisplayName|DisplayVersion$"] #return the data of the values named "DisplayName" or "DisplayValue" in this key. The JSON will include details of the key, last subkey, value name, value type and value data.
  2. registry.get[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,values] #return the data of the all values in this key. The JSON will include details of the key, last subkey, value name, value type and value data.
  3. registry.get[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,keys] #return all subkeys of this key. The JSON will include details of the key and last subkey.
service.discovery

The list of Windows services. Used for low-level discovery.
Return value: JSON object.

service.info[service,<param>]

Information about a service.
Return value: Integer - with param as state, startup; String - with param as displayname, path, user; Text - with param as description
Specifically for state: 0 - running, 1 - paused, 2 - start pending, 3 - pause pending, 4 - continue pending, 5 - stop pending, 6 - stopped, 7 - unknown, 255 - no such service
Specifically for startup: 0 - automatic, 1 - automatic delayed, 2 - manual, 3 - disabled, 4 - unknown, 5 - automatic trigger start, 6 - automatic delayed trigger start, 7 - manual trigger start

Parameters:

  • service - a real service name or its display name as seen in the MMC Services snap-in;
  • param - state (default), displayname, path, user, startup, or description.

Comments:

  • Items like service.info[service,state] and service.info[service] will return the same information;
  • Only with param as state this item returns a value for non-existing services (255).

Examples:

  1. service.info[SNMPTRAP] - state of the SNMPTRAP service;
  2. service.info[SNMP Trap] - state of the same service, but with the display name specified;
  3. service.info[EventLog,startup] - the startup type of the EventLog service
services[<type>,<state>,<exclude>]

The listing of services.
Return value: 0 - if empty; Text - the list of services separated by a newline.

Parameters:

  • type - all (default), automatic, manual, or disabled;
  • state - all (default), stopped, started, start_pending, stop_pending, running, continue_pending, pause_pending, or paused;
  • exclude - the services to exclude from the result. Excluded services should be listed in double quotes, separated by comma, without spaces.

Examples:

  1. services[,started] #returns the list of started services;
  2. services[automatic, stopped] #returns the list of stopped services that should be running;
  3. services[automatic, stopped, "service1,service2,service3"] #returns the list of stopped services that should be running, excluding services named "service1", "service2" and "service3"
vm.vmemory.size[<type>]

The virtual memory size in bytes or in percentage from the total.
Return value: Integer - for bytes; float - for percentage.

Parameter:

  • type - possible values: available (available virtual memory), pavailable (available virtual memory, in percent), pused (used virtual memory, in percent), total (total virtual memory, default), or used (used virtual memory)

Comments:

  • The monitoring of virtual memory statistics is based on:

    • Total virtual memory on Windows (total physical + page file size);

    • The maximum amount of memory Zabbix agent can commit;

    • The current committed memory limit for the system or Zabbix agent, whichever is smaller.

Example:

  1. vm.vmemory.size[pavailable] #return the available virtual memory, in percentage
wmi.get[<namespace>,<query>]

Execute a WMI query and return the first selected object.
Return value: Integer, float, string or text (depending on the request).

Parameters:

  • namespace - the WMI namespace;

  • query - the WMI query returning a single object.

WMI queries are performed with WQL.

Example:

  1. wmi.get[root\cimv2,select status from Win32_DiskDrive where Name like '%PHYSICALDRIVE0%'] #returns the status of the first physical disk
wmi.getall[<namespace>,<query>]

Execute a WMI query and return the whole response. Can be used for low-level discovery.
Return value: JSON object

Parameters:

  • namespace - the WMI namespace;

  • query - the WMI query.

Comments:

  • WMI queries are performed with WQL.
  • JSONPath preprocessing can be used to point to more specific values in the returned JSON.

Example:

  1. wmi.getall[root\cimv2,select * from Win32_DiskDrive where Name like '%PHYSICALDRIVE%'] #returns status information of physical disks

Monitoring Windows services

This tutorial provides step-by-step instructions for setting up the monitoring of Windows services. It is assumed that Zabbix server and agent are configured and operational.

Step 1

Get the service name.

You can get the service name by going to the MMC Services snap-in and bringing up the properties of the service. In the General tab you should see a field called “Service name”. The value that follows is the name you will use when setting up an item for monitoring. For example, if you wanted to monitor the “workstation” service, then your service might be: lanmanworkstation.

Step 2

Configure an item for monitoring the service.

The item service.info[service,<param>] retrieves information about a particular service. Depending on the information you need, specify the param option which accepts the following values: displayname, state, path, user, startup or description. The default value is state if param is not specified (service.info[service]).

The type of return value depends on chosen param: integer for state and startup; character string for displayname, path and user; text for description.

Example:

  • Key: service.info[lanmanworkstation]
  • Type of information: Numeric (unsigned)

The item service.info[lanmanworkstation] will retrieve information about the state of the service as a numerical value. To map a numerical value to a text representation in the frontend (“0” as “Running”, “1” as “Paused”, etc.), you can configure value mapping on the host on which the item is configured. To do this, either link the template Windows services by Zabbix agent or Windows services by Zabbix agent active to the host, or configure on the host a new value map that is based on the Windows service state value map configured on the mentioned templates.

Note that both of the mentioned templates have a discovery rule configured that will discover services automatically. If you do not want this, you can disable the discovery rule on the host level once the template has been linked to the host.

Discovery of Windows services

Low-level discovery provides a way to automatically create items, triggers, and graphs for different entities on a computer. Zabbix can automatically start monitoring Windows services on your machine, without the need to know the exact name of a service or create items for each service manually. A filter can be used to generate real items, triggers, and graphs only for services of interest.