Windows by Zabbix agent.yaml

zabbix_export:
  version: '6.4'
  template_groups:
    - uuid: 846977d1dfed4968bc5f8bdb363285bc
      name: 'Templates/Operating systems'
  templates:
    - uuid: 13b06904a6bf41cbb795e3193d896340
      template: 'Windows by Zabbix agent'
      name: 'Windows by Zabbix agent'
      description: |
        Official Windows template.
        
        Modified by VijayK.
        
        GitHub: https://github.com/VSKUMBHANI/
      vendor:
        name: 'https://github.com/VSKUMBHANI'
        version: 6.4-0
      groups:
        - name: 'Templates/Operating systems'
      items:
        - uuid: af550a1bfe74428eb24492d8af3b405e
          name: 'Host name of Zabbix agent running'
          key: agent.hostname
          delay: 1h
          history: 7d
          trends: '0'
          value_type: CHAR
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            - tag: component
              value: system
        - uuid: f81e2ce0d1104f9aaf1fc49284ed0ed4
          name: 'Zabbix agent ping'
          key: agent.ping
          history: 7d
          description: 'The agent always returns 1 for this item. It could be used in combination with nodata() for availability check.'
          valuemap:
            name: 'Zabbix agent ping status'
          tags:
            - tag: component
              value: system
        - uuid: 5707443d739d4689bde192e75ff4bd0f
          name: 'Version of Zabbix agent running'
          key: agent.version
          delay: 1h
          history: 7d
          trends: '0'
          value_type: CHAR
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            - tag: component
              value: application
        - uuid: 15cdef2c2dff457ca1ecea74b2c11b9e
          name: 'Login Event ID 21'
          type: ZABBIX_ACTIVE
          key: 'eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip]'
          delay: 10s
          history: 7d
          trends: '0'
          value_type: LOG
          preprocessing:
            - type: JAVASCRIPT
              parameters:
                - |
                  //User_External_Login_Zabbix_v4
                  
                  const log = value;
                  const regex = /Remote Desktop Services:\s(.+?):\r\n\r\nUser:\s(.+?)\r\nSession ID:\s([\d\.]+)\r\nSource Network Address:\s([\d\.]+|LOCAL)/g;
                  const localregex = /\b192\.168\.(16[6-9]|1[7-8][0-9]|19[0-1])\.(25[0-4]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b|\b192\.168\.(10|11)\.(25[0-4]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b|\b192\.168\.150\.([1-9]|[1-9]\d|1\d\d|2[0-4]\d|25[0-4])\b|\bLOCAL\b/g;
                  
                  //const logs = JSON.stringify(log); //Convert the value into string.
                  //var mystring = log;
                  //return log + " \nMystring "+mystring.match(regex); // Match the string with regex and return 1 if match or else return null.
                  //Remote Desktop Services:\s(.+?):\.+User:\s(.+?)\.\.Session ID:\s([\d\.]+)\.\.Source Network Address:\s([\d\.]+|LOCAL) - NotWork
                  //Remote Desktop Services:\s(.+?):\n\nUser:\s(.+?)\nSession ID:\s([\d\.]+)\nSource Network Address:\s([\d\.]+|LOCAL) - NotWork
                  //Remote Desktop Services:\s(.+?):\n\n\n\nUser:\s(.+?)\n\nSession ID:\s([\d\.]+)\n\nSource Network Address:\s([\d\.]+|LOCAL) - NotWork
                  //Remote Desktop Services:\s(.+?):\r\n\r\nUser:\s(.+?)\r\nSession ID:\s([\d\.]+)\r\nSource Network Address:\s([\d\.]+|LOCAL) - Working
                  
                  var match = regex.exec(log); //Compare the regex with value and return the match values.
                  
                  const stat = match[1];
                  const user = match[2];
                  const sessionid = match[3];
                  const ip = match[4];
                  
                  var localipmatch = localregex.exec(ip);
                  
                  if (localipmatch){
                  return "Login from the local device detect. \n Username: "+user+"\n" + "IP: "+ip;
                  }
                  
                  const url = 'http://ip-api.com/json/' + ip;
                  const http = new HttpRequest();
                  const data = http.get(url); //Get the details from URL and return the JSON.
                  data = JSON.parse(data); // Define the JSON in variable.
                  
                  return "Login from the outside device detect. \n Username: "+user+"\n"+"IP: "+data.query+"\n"+"Country: "+data.country+"\n"+"State: "+data.regionName+ "\n" +"City: "+data.city+"\n"+"ISP: "+data.isp;
          triggers:
            - uuid: 04321bd10b5e461094a5c083c8bd1de2
              expression: 'logeventid(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip])=1 and nodata(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],20)=0'
              name: 'Login 21 {ITEM.VALUE}'
              priority: AVERAGE
            - uuid: a0d3627d2d5e45b295bdb1b270b64903
              expression: 'find(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],,"iregexp","@LocalIP")=0 and nodata(/Windows by Zabbix agent/eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^21,,skip],10)=0'
              name: 'User Login from Outside Network'
              event_name: 'Outside Network Login detect {ITEM.VALUE}'
              priority: AVERAGE
        - uuid: 1a677e4347c544df85fa963f360ff7a0
          name: 'Logoff Event ID 23'
          type: ZABBIX_ACTIVE
          key: 'eventlog[Microsoft-Windows-TerminalServices-LocalSessionManager/Operational,,,,^23,,skip]'
          delay: 10s
          history: 7d
          trends: '0'
          value_type: LOG
        - uuid: 8c62e3529c1749209db8c071a3d1f292
          name: 'Login Event ID 1149'
          type: ZABBIX_ACTIVE
          key: 'eventlog[Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,,,,1149,,skip]'
          delay: 10s
          history: 7d
          trends: '0'
          value_type: LOG
        - uuid: 31cce8af1b46473cba4495b67c6839f0
          name: 'User Login'
          type: ZABBIX_ACTIVE
          key: 'eventlog[Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational,,,,^1149,,]'
          history: 7d
          trends: '0'
          value_type: LOG
        - uuid: db648910cf8d433cb06c0786848f2693
          name: 'Failed Login Event 4625'
          type: ZABBIX_ACTIVE
          key: 'eventlog[Security,,,,^4625,,skip]'
          delay: 10s
          history: 7d
          trends: '0'
          value_type: LOG
          preprocessing:
            - type: JAVASCRIPT
              parameters:
                - |
                  //Script for retrive the data from Windows Event 4625 which is User failed to login in Windows system.
                  
                  const logonData = value;
                  
                  //Define the regex for user match.
                  const regex = /Account Name:\s*(?!-)(\S+)/g;
                  
                  //Define variable and array to store matched value.
                  var match, accountNames = [];
                  
                  //match the regex in value.
                  while ((match = regex.exec(logonData))) {
                      accountNames.push(match[1]);
                  }
                  
                  //Define variable for other values that require in the result. 
                  const failureReason = logonData.match(/Failure Reason:\s+(.+)$/m)[1];
                  const sourceNetworkAddress = logonData.match(/Source Network Address:\s+(.+)$/m)[1];
                  const workstationName = logonData.match(/Workstation Name:\s+(.+)$/m)[1];
                  
                  //Return the result.
                  return "Account Name: " + accountNames + "\nIP Address: " + sourceNetworkAddress + "\nDevice: " + workstationName + "\nFailure reason: " + failureReason;
          triggers:
            - uuid: f099c15b02f94123bf7ee6320c2463a9
              expression: 'count(/Windows by Zabbix agent/eventlog[Security,,,,^4625,,skip],5m)>=3 and nodata(/Windows by Zabbix agent/eventlog[Security,,,,^4625,,skip],20s)=0'
              name: 'Multiple failed login detect'
              priority: WARNING
              tags:
                - tag: scope
                  value: authentication
        - uuid: e2ed503a53784dfda26d39f52dc26484
          name: 'User Active Session'
          key: 'perf_counter[\Terminal Services\Active Sessions]'
          delay: 2m
          history: 2d
          trends: 5d
        - uuid: fd0c9b6ca7c6488391fb64a685369fd6
          name: 'User Inactive Session'
          key: 'perf_counter[\Terminal Services\Inactive Sessions]'
          delay: 2m
          history: 2d
          trends: 5d
        - uuid: 420fb7d10f0b4d5eaf7091db798462d2
          name: 'User Total Session'
          key: 'perf_counter[\Terminal Services\Total Sessions]'
          delay: 2m
          history: 2d
          trends: 5d
        - uuid: 5219a246de0641a89685a961cdd08c0b
          name: 'Cache bytes'
          key: 'perf_counter_en["\Memory\Cache Bytes"]'
          history: 7d
          units: B
          description: |
            Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes,
            Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays
            the last observed value only; it is not an average.
          tags:
            - tag: component
              value: memory
        - uuid: 2ea74fafb9334de095adcb47cced578d
          name: 'Free system page table entries'
          key: 'perf_counter_en["\Memory\Free System Page Table Entries"]'
          history: 7d
          description: |
            This indicates the number of page table entries not currently in use by the system. If the number is less
            than 5,000, there may well be a memory leak or you running out of memory.
          tags:
            - tag: component
              value: memory
          triggers:
            - uuid: e3118e2e6109460f80cc2d56795ed42f
              expression: 'max(/Windows by Zabbix agent/perf_counter_en["\Memory\Free System Page Table Entries"],5m)<{$MEM.PAGE_TABLE_CRIT.MIN}'
              name: 'Number of free system page table entries is too low'
              event_name: 'Number of free system page table entries is too low (less {$MEM.PAGE_TABLE_CRIT.MIN} for 5m)'
              priority: WARNING
              description: 'The Memory Free System Page Table Entries is less than {$MEM.PAGE_TABLE_CRIT.MIN} for 5 minutes. If the number is less than 5,000, there may well be a memory leak.'
              dependencies:
                - name: 'High memory utilization'
                  expression: 'min(/Windows by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              tags:
                - tag: scope
                  value: capacity
        - uuid: 6c41d254585a4d7b81a0c5766a8913c1
          name: 'Memory page faults per second'
          key: 'perf_counter_en["\Memory\Page Faults/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages
            faulted per second because only one page is faulted in each fault operation, hence this is also equal
            to the number of page fault operations. This counter includes both hard faults (those that require
            disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most
            processors can handle large numbers of soft faults without significant consequence. However, hard faults,
            which require disk access, can cause significant delays.
          tags:
            - tag: component
              value: memory
        - uuid: 287163bc5b0441c4bf51489432a278eb
          name: 'Memory pages per second'
          key: 'perf_counter_en["\Memory\Pages/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            This measures the rate at which pages are read from or written to disk to resolve hard page faults.
            If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.
          tags:
            - tag: component
              value: memory
          triggers:
            - uuid: ab4c9a66d16f42e6a32f6144f4d2a3ca
              expression: 'min(/Windows by Zabbix agent/perf_counter_en["\Memory\Pages/sec"],5m)>{$MEM.PAGE_SEC.CRIT.MAX}'
              name: 'The Memory Pages/sec is too high'
              event_name: 'The Memory Pages/sec is too high (over {$MEM.PAGE_SEC.CRIT.MAX} for 5m)'
              priority: WARNING
              description: 'The Memory Pages/sec in the last 5 minutes exceeds {$MEM.PAGE_SEC.CRIT.MAX}. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak.'
              dependencies:
                - name: 'High memory utilization'
                  expression: 'min(/Windows by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              tags:
                - tag: scope
                  value: capacity
        - uuid: fb822cb2a17948208a61bd6661c496df
          name: 'Memory pool non-paged'
          key: 'perf_counter_en["\Memory\Pool Nonpaged Bytes"]'
          history: 7d
          units: B
          description: |
            This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects
            that cannot be written to disk but instead must remain in physical memory as long as they are allocated.
            There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch).
            A typical Event ID 2019 is recorded in the system event log.
          tags:
            - tag: component
              value: memory
        - uuid: b99a722d267d455fad3c07c53302b20f
          name: 'Used swap space in %'
          key: 'perf_counter_en["\Paging file(_Total)\% Usage"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'The used space of swap volume/file in percent.'
          tags:
            - tag: component
              value: memory
            - tag: component
              value: storage
        - uuid: ee1f116fdab34969a6e6f5e1c25fc3d2
          name: 'CPU DPC time'
          key: 'perf_counter_en["\Processor Information(_total)\% DPC Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            Processor DPC time is the time that a single processor spent receiving and servicing deferred procedure
            calls (DPCs). DPCs are interrupts that run at a lower priority than standard interrupts. % DPC Time is a
            component of % Privileged Time because DPCs are executed in privileged mode. If a high % DPC Time is
            sustained, there may be a processor bottleneck or an application or hardware related issue that can
            significantly diminish overall system performance.
          tags:
            - tag: component
              value: cpu
        - uuid: e403552481b04ebdba2e8a019f114f20
          name: 'CPU interrupt time'
          key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
            hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
            devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
            lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
            hardware failure. This should never be higher than 20%.
          tags:
            - tag: component
              value: cpu
          triggers:
            - uuid: f67bedcb282349b2aac052baf4963480
              expression: 'min(/Windows by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}'
              name: 'CPU interrupt time is too high'
              event_name: 'CPU interrupt time is too high (over {$CPU.INTERRUPT.CRIT.MAX}% for 5m)'
              priority: WARNING
              description: |
                "The CPU Interrupt Time in the last 5 minutes exceeds {$CPU.INTERRUPT.CRIT.MAX}%."
                The Processor Information\% Interrupt Time is the time the processor spends receiving and servicing
                hardware interrupts during sample intervals. This value is an indirect indicator of the activity of
                devices that generate interrupts, such as the system clock, the mouse, disk drivers, data communication
                lines, network interface cards and other peripheral devices. This is an easy way to identify a potential
                hardware failure. This should never be higher than 20%.
              dependencies:
                - name: 'High CPU utilization'
                  expression: 'min(/Windows by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              tags:
                - tag: scope
                  value: performance
        - uuid: 37448f05afe340a3891d05528c9d1adc
          name: 'CPU privileged time'
          key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% Privileged Time counter shows the percent of time that the processor is spent
            executing in Kernel (or Privileged) mode. Privileged mode includes services interrupts inside Interrupt
            Service Routines (ISRs), executing Deferred Procedure Calls (DPCs), Device Driver calls and other kernel-mode
            functions of the Windows® Operating System.
          tags:
            - tag: component
              value: cpu
          triggers:
            - uuid: 4d099256b3ba42f1b90143e2014900dd
              expression: 'min(/Windows by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Privileged Time"],5m)>{$CPU.PRIV.CRIT.MAX}'
              name: 'CPU privileged time is too high'
              event_name: 'CPU privileged time is too high (over {$CPU.PRIV.CRIT.MAX}% for 5m)'
              priority: WARNING
              description: 'The CPU privileged time in the last 5 minutes exceeds {$CPU.PRIV.CRIT.MAX}%.'
              dependencies:
                - name: 'CPU interrupt time is too high'
                  expression: 'min(/Windows by Zabbix agent/perf_counter_en["\Processor Information(_total)\% Interrupt Time"],5m)>{$CPU.INTERRUPT.CRIT.MAX}'
                - name: 'High CPU utilization'
                  expression: 'min(/Windows by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              tags:
                - tag: scope
                  value: performance
        - uuid: 575912d512624143b564ca0fbfd0bb8f
          name: 'CPU user time'
          key: 'perf_counter_en["\Processor Information(_total)\% User Time"]'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: |
            The Processor Information\% User Time counter shows the percent of time that the processor(s) is spent executing
            in User mode.
          tags:
            - tag: component
              value: cpu
        - uuid: 2322a85bfc1049a3b5c892d83b5d5054
          name: 'Context switches per second'
          key: 'perf_counter_en["\System\Context Switches/sec"]'
          history: 7d
          value_type: FLOAT
          description: |
            Context Switches/sec is the combined rate at which all processors on the computer are switched from one thread to another.
            Context switches occur when a running thread voluntarily relinquishes the processor, is preempted by a higher priority ready thread, or switches between user-mode and privileged (kernel) mode to use an Executive or subsystem service.
            It is the sum of Thread\\Context Switches/sec for all threads running on all processors in the computer and is measured in numbers of switches.
            There are context switch counters on the System and Thread objects. This counter displays the difference between the values observed in the last two samples, divided by the duration of the sample interval.
          tags:
            - tag: component
              value: cpu
        - uuid: 002af28df72f4a788c88bc022d88c6dd
          name: 'CPU queue length'
          key: 'perf_counter_en["\System\Processor Queue Length"]'
          history: 7d
          value_type: FLOAT
          description: |
            The Processor Queue Length shows the number of threads that are observed as delayed in the processor Ready Queue
            and are waiting to be executed.
          tags:
            - tag: component
              value: cpu
        - uuid: 630b7b2af6274936ab80b1dd774113e5
          name: 'Number of threads'
          key: 'perf_counter_en["\System\Threads"]'
          history: 7d
          description: 'The number of threads used by all running processes.'
          tags:
            - tag: component
              value: os
        - uuid: b305029532f84daf93c8da2d181ac3a1
          name: 'Number of processes'
          key: 'proc.num[]'
          history: 7d
          description: 'The number of processes.'
          tags:
            - tag: component
              value: os
        - uuid: c2ed8e2efab04564b6c70ee8ad14730f
          name: 'CPU utilization'
          key: system.cpu.util
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'CPU utilization in %.'
          tags:
            - tag: component
              value: cpu
          triggers:
            - uuid: 806aa232f56640ab98aacc79491fc4d7
              expression: 'min(/Windows by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
              name: 'High CPU utilization'
              event_name: 'High CPU utilization (over {$CPU.UTIL.CRIT}% for 5m)'
              opdata: 'Current utilization: {ITEM.LASTVALUE1}'
              priority: WARNING
              description: 'CPU utilization is too high. The system might be slow to respond.'
              tags:
                - tag: scope
                  value: performance
        - uuid: cb056886ce72426e833a0445f9263906
          name: 'System name'
          key: system.hostname
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'System host name.'
          inventory_link: NAME
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: 6b50d36a4e29468a9546e880f3004399
              expression: 'last(/Windows by Zabbix agent/system.hostname,#1)<>last(/Windows by Zabbix agent/system.hostname,#2) and length(last(/Windows by Zabbix agent/system.hostname))>0'
              name: 'System name has changed'
              event_name: 'System name has changed (new name: {ITEM.VALUE})'
              priority: INFO
              description: 'System name has changed. Ack to close.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: 94c4dfe23e2e4c6e995a3a715941a8eb
          name: 'System local time'
          key: system.localtime
          history: 7d
          units: unixtime
          description: 'System local time of the host.'
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: 37ca2366c8474cc8a49a605e93377601
              expression: 'fuzzytime(/Windows by Zabbix agent/system.localtime,{$SYSTEM.FUZZYTIME.MAX})=0'
              name: 'System time is out of sync'
              event_name: 'System time is out of sync (diff with Zabbix server > {$SYSTEM.FUZZYTIME.MAX}s)'
              priority: WARNING
              description: 'The host system time is different from the Zabbix server time.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: 7e8b3476db6d4322a10cd1a28cbdb7ea
          name: 'Operating system architecture'
          key: system.sw.arch
          delay: 1h
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'Operating system architecture of the host.'
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            - tag: component
              value: os
        - uuid: 11cac38334544e5cbb028cfd473cb39e
          name: 'Free swap space'
          type: CALCULATED
          key: system.swap.free
          history: 7d
          units: B
          params: 'last(//system.swap.size[,total]) - last(//system.swap.size[,total]) / 100 * last(//perf_counter_en["\Paging file(_Total)\% Usage"])'
          description: 'The free space of swap volume/file in bytes.'
          tags:
            - tag: component
              value: memory
            - tag: component
              value: storage
        - uuid: 9c7e3c843a3045df81dddc5d18de267c
          name: 'Free swap space in %'
          type: DEPENDENT
          key: system.swap.pfree
          delay: '0'
          history: 7d
          value_type: FLOAT
          units: '%'
          description: 'The free space of swap volume/file in percent.'
          preprocessing:
            - type: JAVASCRIPT
              parameters:
                - 'return (100 - value)'
          master_item:
            key: 'perf_counter_en["\Paging file(_Total)\% Usage"]'
          tags:
            - tag: component
              value: memory
            - tag: component
              value: storage
        - uuid: f981835baf04494eaff2f33f159e0ab5
          name: 'Total swap space'
          key: 'system.swap.size[,total]'
          history: 7d
          units: B
          description: 'The total space of swap volume/file in bytes.'
          tags:
            - tag: component
              value: memory
            - tag: component
              value: storage
        - uuid: b103a2c22fe344f886e9dc9f4e4a65ec
          name: 'System description'
          key: system.uname
          delay: 15m
          history: 2w
          trends: '0'
          value_type: CHAR
          description: 'System description of the host.'
          inventory_link: OS_FULL
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1d
          tags:
            - tag: component
              value: system
        - uuid: 12503fbf4400488e9b5ff0488f164cb6
          name: Uptime
          key: system.uptime
          delay: 30s
          history: 2w
          trends: 0d
          units: uptime
          description: 'System uptime in ''N days, hh:mm:ss'' format.'
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: d27b9eab4034439f91dff41fe6f043ab
              expression: 'last(/Windows by Zabbix agent/system.uptime)<10m'
              name: 'Host has been restarted'
              event_name: 'Host has been restarted (uptime < 10m)'
              priority: WARNING
              description: 'The device uptime is less than 10 minutes.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: notice
        - uuid: 09e9a345a0f445b1a65685911f5eb9b0
          name: 'Total memory'
          key: 'vm.memory.size[total]'
          history: 7d
          units: B
          description: 'Total memory in Bytes.'
          tags:
            - tag: component
              value: memory
        - uuid: 1cbf45e11dab453797fe291639aa0c01
          name: 'Used memory'
          key: 'vm.memory.size[used]'
          history: 7d
          units: B
          description: 'Used memory in Bytes.'
          tags:
            - tag: component
              value: memory
        - uuid: 3b1e4ecaa04a46e9b0aee956918f0713
          name: 'Memory utilization'
          type: CALCULATED
          key: vm.memory.util
          history: 7d
          value_type: FLOAT
          units: '%'
          params: 'last(//vm.memory.size[used]) / last(//vm.memory.size[total]) * 100'
          description: 'Memory utilization in %.'
          tags:
            - tag: component
              value: memory
          triggers:
            - uuid: b442993bb2a6404a8ebcb7be39d16ce6
              expression: 'min(/Windows by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
              name: 'High memory utilization'
              event_name: 'High memory utilization (>{$MEMORY.UTIL.MAX}% for 5m)'
              priority: AVERAGE
              description: 'The system is running out of free memory.'
              tags:
                - tag: scope
                  value: capacity
                - tag: scope
                  value: performance
        - uuid: 08b70a5b80fd435ba393e3deb3ca5adb
          name: 'Network interfaces WMI get'
          key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
          history: '0'
          trends: '0'
          value_type: TEXT
          description: 'Raw data of win32_networkadapter.'
          preprocessing:
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
          tags:
            - tag: component
              value: raw
        - uuid: bc9997be31674068a93eeeb995227914
          name: OS
          key: 'wmi.get["root\cimv2","SELECT Caption from Win32_OperatingSystem"]'
          trends: '0'
          value_type: TEXT
          inventory_link: OS
        - uuid: 0de4efc299a642d490b2c6f3ace63990
          name: Vendor
          key: 'wmi.get["root\cimv2","SELECT manufacturer FROM Win32_BIOS"]'
          trends: '0'
          value_type: TEXT
          inventory_link: VENDOR
        - uuid: 8b539e415a314abdba68731940d9df91
          name: 'Serial Numner'
          key: 'wmi.get["root\cimv2","SELECT serialnumber FROM Win32_BIOS"]'
          trends: '0'
          value_type: TEXT
          inventory_link: SERIALNO_A
        - uuid: 83c8c6f15b524a2fb04fc90d04d3e8a2
          name: 'Number of cores'
          key: 'wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]'
          history: 7d
          description: 'The number of logical processors available on the computer.'
          tags:
            - tag: component
              value: cpu
        - uuid: 3dcb0f79342b4ded97cdec0794472266
          name: 'Zabbix agent availability'
          type: INTERNAL
          key: 'zabbix[host,agent,available]'
          history: 7d
          description: 'Monitoring agent availability status'
          valuemap:
            name: zabbix.host.available
          tags:
            - tag: component
              value: system
          triggers:
            - uuid: 05beb4500cae480892fad0739f99807d
              expression: 'max(/Windows by Zabbix agent/zabbix[host,agent,available],{$AGENT.TIMEOUT})=0'
              name: 'Zabbix agent is not available'
              event_name: 'Zabbix agent is not available (for {$AGENT.TIMEOUT})'
              priority: AVERAGE
              description: 'For passive only agents, host availability is used with {$AGENT.TIMEOUT} as time threshold.'
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: availability
      discovery_rules:
        - uuid: ba19d6566fdb4a668d4363769d1fee01
          name: 'Network interfaces discovery'
          type: DEPENDENT
          key: net.if.discovery
          delay: '0'
          filter:
            evaltype: AND
            conditions:
              - macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.MATCHES}'
                formulaid: A
              - macro: '{#IFALIAS}'
                value: '{$NET.IF.IFALIAS.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.MATCHES}'
                formulaid: C
              - macro: '{#IFDESCR}'
                value: '{$NET.IF.IFDESCR.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.MATCHES}'
                formulaid: E
              - macro: '{#IFNAME}'
                value: '{$NET.IF.IFNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
          description: 'Discovery of installed network interfaces.'
          item_prototypes:
            - uuid: 8a7bb1e8afd24d32a65fa2116ba439ce
              name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets discarded'
              key: 'net.if.in["{#IFGUID}",dropped]'
              delay: 3m
              history: 2d
              trends: 5d
              description: 'The number of incoming packets dropped on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 6e1f3dfb91024095a20870ee94d01822
              name: 'Interface {#IFNAME}({#IFALIAS}): Inbound packets with errors'
              key: 'net.if.in["{#IFGUID}",errors]'
              delay: 3m
              history: 2d
              trends: 5d
              description: 'The number of incoming packets with errors on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 82accc942f5747a2b399484466625051
              name: 'Interface {#IFNAME}({#IFALIAS}): Bits received'
              key: 'net.if.in["{#IFGUID}"]'
              delay: 3m
              history: 2d
              trends: 5d
              units: bps
              description: 'Incoming traffic on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                - type: MULTIPLIER
                  parameters:
                    - '8'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 9ddb9aaf863a45c0affbd90e4a6fa393
              name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets discarded'
              key: 'net.if.out["{#IFGUID}",dropped]'
              delay: 3m
              history: 2d
              trends: 5d
              description: 'The number of outgoing packets dropped on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 38c8a1aa95b343e39e23e7b508521dad
              name: 'Interface {#IFNAME}({#IFALIAS}): Outbound packets with errors'
              key: 'net.if.out["{#IFGUID}",errors]'
              delay: 3m
              history: 2d
              trends: 5d
              description: 'The number of outgoing packets with errors on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 3b090da19af842189bb6fa56d49ceec3
              name: 'Interface {#IFNAME}({#IFALIAS}): Bits sent'
              key: 'net.if.out["{#IFGUID}"]'
              delay: 3m
              history: 2d
              trends: 5d
              units: bps
              description: 'Outgoing traffic on the network interface.'
              preprocessing:
                - type: CHANGE_PER_SECOND
                  parameters:
                    - ''
                - type: MULTIPLIER
                  parameters:
                    - '8'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: 0445b842d1ce4c7f9fd5716c78a079c4
              name: 'Interface {#IFNAME}({#IFALIAS}): Speed'
              type: DEPENDENT
              key: 'net.if.speed["{#IFGUID}"]'
              delay: '0'
              history: 2d
              trends: '0'
              units: bps
              description: 'Estimated bandwidth of the network interface if any.'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].Speed.first()'
                  error_handler: CUSTOM_VALUE
                  error_handler_params: '0'
                - type: JAVASCRIPT
                  parameters:
                    - 'return (value==''9223372036854775807'' ? 0 : value)'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1h
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
            - uuid: c495bffb7e244e5caf5dc013d839b758
              name: 'Interface {#IFNAME}({#IFALIAS}): Operational status'
              type: DEPENDENT
              key: 'net.if.status["{#IFGUID}"]'
              delay: '0'
              history: 2d
              trends: '0'
              description: 'The operational status of the network interface.'
              valuemap:
                name: 'Win32_NetworkAdapter::NetConnectionStatus'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].NetConnectionStatus.first()'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1d
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
              trigger_prototypes:
                - uuid: a9b1c61ac4a6481aab93d40c6fb93462
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_mode: RECOVERY_EXPRESSION
                  recovery_expression: 'last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
                  name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  opdata: 'Current state: {ITEM.LASTVALUE1}'
                  priority: AVERAGE
                  description: |
                    This trigger expression works as follows:
                    1. Can be triggered if operations status is down.
                    2. {$IFCONTROL:\"{#IFNAME}\"}=1 - user can redefine Context macro to value - 0. That marks this interface as not important.
                        No new trigger will be fired if this interface is down.
                    3. {TEMPLATE_NAME:METRIC.diff()}=1) - trigger fires only if operational status is different from Connected(2).
                    
                    WARNING: if closed manually - won't fire again on next poll, because of .diff.
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: availability
            - uuid: 11ce3d38745a49f58f713fcef1a913c5
              name: 'Interface {#IFNAME}({#IFALIAS}): Interface type'
              type: DEPENDENT
              key: 'net.if.type["{#IFGUID}"]'
              delay: '0'
              history: 2d
              trends: '0'
              description: 'The type of the network interface.'
              valuemap:
                name: 'Win32_NetworkAdapter::AdapterTypeId'
              preprocessing:
                - type: JSONPATH
                  parameters:
                    - '$[?(@.GUID == "{#IFGUID}")].AdapterTypeId.first()'
                - type: DISCARD_UNCHANGED_HEARTBEAT
                  parameters:
                    - 1d
              master_item:
                key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
              tags:
                - tag: component
                  value: network
                - tag: description
                  value: '{#IFALIAS}'
                - tag: interface
                  value: '{#IFNAME}'
          trigger_prototypes:
            - uuid: b2191521a7a54985a19740e3ee2674f2
              expression: |
                change(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"])<0 and
                last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"])>0 and
                last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])=2
              name: 'Interface {#IFNAME}({#IFALIAS}): Ethernet has changed to lower speed than it was before'
              opdata: 'Current reported speed: {ITEM.LASTVALUE1}'
              priority: INFO
              description: 'This Ethernet connection has transitioned down from its known maximum speed. This might be a sign of autonegotiation issues. Ack to close.'
              manual_close: 'YES'
              dependencies:
                - name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                - tag: scope
                  value: capacity
            - uuid: c93048183c3942808c60d6dd61963bc0
              expression: |
                (avg(/Windows by Zabbix agent/net.if.in["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"]) or
                avg(/Windows by Zabbix agent/net.if.out["{#IFGUID}"],15m)>({$IF.UTIL.MAX:"{#IFNAME}"}/100)*last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"])) and
                last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"])>0
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                avg(/Windows by Zabbix agent/net.if.in["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"]) and
                avg(/Windows by Zabbix agent/net.if.out["{#IFGUID}"],15m)<(({$IF.UTIL.MAX:"{#IFNAME}"}-3)/100)*last(/Windows by Zabbix agent/net.if.speed["{#IFGUID}"])
              name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage'
              event_name: 'Interface {#IFNAME}({#IFALIAS}): High bandwidth usage (>{$IF.UTIL.MAX:"{#IFNAME}"}%)'
              opdata: 'In: {ITEM.LASTVALUE1}, out: {ITEM.LASTVALUE3}, speed: {ITEM.LASTVALUE2}'
              priority: WARNING
              description: 'The network interface utilization is close to its estimated maximum bandwidth.'
              manual_close: 'YES'
              dependencies:
                - name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                - tag: scope
                  value: performance
            - uuid: a4fa6e161bb64b98b25b1a2a501a83f4
              expression: |
                min(/Windows by Zabbix agent/net.if.in["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}
                or min(/Windows by Zabbix agent/net.if.out["{#IFGUID}",errors],5m)>{$IF.ERRORS.WARN:"{#IFNAME}"}
              recovery_mode: RECOVERY_EXPRESSION
              recovery_expression: |
                max(/Windows by Zabbix agent/net.if.in["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8
                and max(/Windows by Zabbix agent/net.if.out["{#IFGUID}",errors],5m)<{$IF.ERRORS.WARN:"{#IFNAME}"}*0.8
              name: 'Interface {#IFNAME}({#IFALIAS}): High error rate'
              event_name: 'Interface {#IFNAME}({#IFALIAS}): High error rate (>{$IF.ERRORS.WARN:"{#IFNAME}"} for 5m)'
              opdata: 'errors in: {ITEM.LASTVALUE1}, errors out: {ITEM.LASTVALUE2}'
              priority: WARNING
              description: 'Recovers when below 80% of {$IF.ERRORS.WARN:"{#IFNAME}"} threshold'
              manual_close: 'YES'
              dependencies:
                - name: 'Interface {#IFNAME}({#IFALIAS}): Link down'
                  expression: '{$IFCONTROL:"{#IFNAME}"}=1 and last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])<>2 and (last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#1)<>last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"],#2))'
                  recovery_expression: 'last(/Windows by Zabbix agent/net.if.status["{#IFGUID}"])=2 or {$IFCONTROL:"{#IFNAME}"}=0'
              tags:
                - tag: scope
                  value: availability
          graph_prototypes:
            - uuid: 5cbfad75590746718cf4eabbeeea43f3
              name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic'
              graph_items:
                - drawtype: GRADIENT_LINE
                  color: 1A7C11
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}"]'
                - sortorder: '1'
                  drawtype: BOLD_LINE
                  color: 2774A4
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}"]'
                - sortorder: '2'
                  color: F63100
                  yaxisside: RIGHT
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}",errors]'
                - sortorder: '3'
                  color: A54F10
                  yaxisside: RIGHT
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}",errors]'
                - sortorder: '4'
                  color: FC6EA3
                  yaxisside: RIGHT
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.out["{#IFGUID}",dropped]'
                - sortorder: '5'
                  color: 6C59DC
                  yaxisside: RIGHT
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'net.if.in["{#IFGUID}",dropped]'
          master_item:
            key: 'wmi.getall[root\cimv2,"select Name,Description,NetConnectionID,Speed,AdapterTypeId,NetConnectionStatus,GUID from win32_networkadapter where PhysicalAdapter=True and NetConnectionStatus>0"]'
          preprocessing:
            - type: JAVASCRIPT
              parameters:
                - |
                  output = JSON.parse(value).map(function(net){
                      return {
                          "{#IFNAME}": net.Name,
                          "{#IFDESCR}": net.Description,
                          "{#IFALIAS}": net.NetConnectionID,
                          "{#IFGUID}": net.GUID
                      }})
                  return JSON.stringify({"data": output})
            - type: DISCARD_UNCHANGED_HEARTBEAT
              parameters:
                - 1h
        - uuid: 8f155ebc6fd045b3b7548010af1a73c7
          name: 'Physical disks discovery'
          key: 'perf_instance_en.discovery[PhysicalDisk]'
          delay: 1h
          filter:
            evaltype: AND
            conditions:
              - macro: '{#DEVNAME}'
                value: '{$VFS.DEV.DEVNAME.MATCHES}'
                formulaid: A
              - macro: '{#DEVNAME}'
                value: '{$VFS.DEV.DEVNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
          description: 'Discovery of installed physical disks.'
          item_prototypes:
            - uuid: 821f46bbf9d7432e9ea0d5f93a868269
              name: '{#DEVNAME}: Disk utilization by idle time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]'
              history: 7d
              value_type: FLOAT
              units: '%'
              description: 'This item is the percentage of elapsed time that the selected disk drive was busy servicing read or writes requests based on idle time.'
              preprocessing:
                - type: JAVASCRIPT
                  parameters:
                    - 'return (100 - value)'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                - uuid: 4777fa000fa9460baab1fd7bc7e40604
                  expression: 'min(/Windows by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60],15m)>{$VFS.DEV.UTIL.MAX.WARN}'
                  name: '{#DEVNAME}: Disk is overloaded'
                  event_name: '{#DEVNAME}: Disk is overloaded (util > {$VFS.DEV.UTIL.MAX.WARN}% for 15m)'
                  priority: WARNING
                  description: 'The disk appears to be under heavy load'
                  manual_close: 'YES'
                  dependencies:
                    - name: '{#DEVNAME}: Disk read request responses are too high'
                      expression: 'min(/Windows by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}'
                    - name: '{#DEVNAME}: Disk write request responses are too high'
                      expression: 'min(/Windows by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}'
                  tags:
                    - tag: scope
                      value: performance
            - uuid: 77e33448596a498ba211d23a1977e9ca
              name: '{#DEVNAME}: Average disk read queue length'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Average disk read queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
            - uuid: 7d91ed70bc3b4ef2a7991b3a5ba3bde4
              name: '{#DEVNAME}: Disk read request avg waiting time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]'
              history: 7d
              value_type: FLOAT
              units: s
              description: 'The average time for read requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                - uuid: 85a8c002b3d84121ad2e73c8aced0987
                  expression: 'min(/Windows by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60],15m) > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}'
                  name: '{#DEVNAME}: Disk read request responses are too high'
                  event_name: '{#DEVNAME}: Disk read request responses are too high (read > {$VFS.DEV.READ.AWAIT.WARN:"{#DEVNAME}"}s for 15m'
                  priority: WARNING
                  description: 'This trigger might indicate disk {#DEVNAME} saturation.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: performance
            - uuid: 898784d050664f8eaf197ebebc16077e
              name: '{#DEVNAME}: Disk write request avg waiting time'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]'
              history: 7d
              value_type: FLOAT
              units: s
              description: 'The average time for write requests issued to the device to be served. This includes the time spent by the requests in queue and the time spent servicing them.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
              trigger_prototypes:
                - uuid: db6809fd85e241948fb5ef76cb7cc17b
                  expression: 'min(/Windows by Zabbix agent/perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60],15m) > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}'
                  name: '{#DEVNAME}: Disk write request responses are too high'
                  event_name: '{#DEVNAME}: Disk write request responses are too high (write > {$VFS.DEV.WRITE.AWAIT.WARN:"{#DEVNAME}"}s for 15m)'
                  priority: WARNING
                  description: 'This trigger might indicate disk {#DEVNAME} saturation.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: performance
            - uuid: 71a2c065efaa437fb7296972f516bd82
              name: '{#DEVNAME}: Average disk write queue length'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Average disk write queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
            - uuid: b49884669dbf43cc95ea3d27fb23698c
              name: '{#DEVNAME}: Disk average queue size (avgqu-sz)'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]'
              history: 7d
              value_type: FLOAT
              description: 'Current average disk queue, the number of requests outstanding on the disk at the time the performance data is collected.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
            - uuid: 390c6e4f2c134ae2939810892eefd6f7
              name: '{#DEVNAME}: Disk read rate'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]'
              history: 7d
              value_type: FLOAT
              units: '!r/s'
              description: 'Rate of read operations on the disk.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
            - uuid: 6353d621a9c4415c94247208fc996075
              name: '{#DEVNAME}: Disk write rate'
              key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]'
              history: 7d
              value_type: FLOAT
              units: '!w/s'
              description: 'Rate of write operations on the disk.'
              tags:
                - tag: component
                  value: storage
                - tag: disk
                  value: '{#DEVNAME}'
          graph_prototypes:
            - uuid: 6d37f811023b4f65a071b1deb9b1b8ec
              name: '{#DEVNAME}: Disk average queue length'
              graph_items:
                - color: 1A7C11
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Read Queue Length",60]'
                - sortorder: '1'
                  color: 2774A4
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk Write Queue Length",60]'
            - uuid: f54bdfb7e0c7471f80b8ca599bc4f904
              name: '{#DEVNAME}: Disk average waiting time'
              graph_items:
                - color: 1A7C11
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Read",60]'
                - sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Avg. Disk sec/Write",60]'
            - uuid: 339a20ba0d3f4ba4a05aee0611124819
              name: '{#DEVNAME}: Disk read/write rates'
              graph_items:
                - color: 1A7C11
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Reads/sec",60]'
                - sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Disk Writes/sec",60]'
            - uuid: bc71dc24634742028a5c8384dcaa0f32
              name: '{#DEVNAME}: Disk utilization and queue'
              graph_items:
                - color: 1A7C11
                  yaxisside: RIGHT
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\Current Disk Queue Length",60]'
                - sortorder: '1'
                  drawtype: GRADIENT_LINE
                  color: 2774A4
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'perf_counter_en["\PhysicalDisk({#DEVNAME})\% Idle Time",60]'
          preprocessing:
            - type: STR_REPLACE
              parameters:
                - '{#INSTANCE}'
                - '{#DEVNAME}'
        - uuid: cabcad5c3520448f8e1bf222be348b81
          name: 'Windows services discovery'
          key: service.discovery
          delay: 30m
          filter:
            evaltype: AND
            conditions:
              - macro: '{#SERVICE.NAME}'
                value: 'cbdhsvc_[a-zA-Z0-9]*'
                operator: NOT_MATCHES_REGEX
                formulaid: A
              - macro: '{#SERVICE.NAME}'
                value: 'edgeupdate*'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#SERVICE.NAME}'
                value: 'webthreatdefusersvc_[a-zA-Z0-9]*'
                operator: NOT_MATCHES_REGEX
                formulaid: C
              - macro: '{#SERVICE.NAME}'
                value: '{$SERVICE.NAME.MATCHES}'
                formulaid: D
              - macro: '{#SERVICE.NAME}'
                value: '{$SERVICE.NAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: E
              - macro: '{#SERVICE.STARTUPNAME}'
                value: '{$SERVICE.STARTUPNAME.MATCHES}'
                formulaid: F
              - macro: '{#SERVICE.STARTUPNAME}'
                value: '{$SERVICE.STARTUPNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: G
          description: 'Discovery of Windows services of different types as defined in template''s macros.'
          item_prototypes:
            - uuid: dd5a027d75fc4ff1a3bb6e69c0d8d592
              name: 'State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME})'
              key: 'service.info["{#SERVICE.NAME}",state]'
              history: 2d
              trends: 5d
              valuemap:
                name: 'Windows service state'
              tags:
                - tag: component
                  value: system
                - tag: name
                  value: '{#SERVICE.DISPLAYNAME}'
                - tag: service
                  value: '{#SERVICE.NAME}'
              trigger_prototypes:
                - uuid: 4708592603db4577b26cb6daade41754
                  expression: 'min(/Windows by Zabbix agent/service.info["{#SERVICE.NAME}",state],#3)<>0'
                  name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running'
                  event_name: '"{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME})'
                  priority: AVERAGE
                  description: 'The service has a state other than "Running" for the last three times.'
                  manual_close: 'YES'
                  tags:
                    - tag: scope
                      value: notice
        - uuid: c22b79b52f9148728095bda2796a753e
          name: 'Mounted filesystem discovery'
          key: vfs.fs.discovery
          delay: 1h
          filter:
            evaltype: AND
            conditions:
              - macro: '{#FSDRIVETYPE}'
                value: '{$VFS.FS.FSDRIVETYPE.MATCHES}'
                formulaid: A
              - macro: '{#FSDRIVETYPE}'
                value: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: B
              - macro: '{#FSNAME}'
                value: '{$VFS.FS.FSNAME.MATCHES}'
                formulaid: C
              - macro: '{#FSNAME}'
                value: '{$VFS.FS.FSNAME.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: D
              - macro: '{#FSTYPE}'
                value: '{$VFS.FS.FSTYPE.MATCHES}'
                formulaid: E
              - macro: '{#FSTYPE}'
                value: '{$VFS.FS.FSTYPE.NOT_MATCHES}'
                operator: NOT_MATCHES_REGEX
                formulaid: F
          description: 'Discovery of file systems of different types.'
          item_prototypes:
            - uuid: 7bf3bd42cdf444389e6953090900c620
              name: '{#FSLABEL}({#FSNAME}): Space utilization'
              key: 'vfs.fs.size[{#FSNAME},pused]'
              history: 7d
              value_type: FLOAT
              units: '%'
              description: 'Space utilization in % for {#FSNAME}'
              tags:
                - tag: component
                  value: storage
                - tag: filesystem
                  value: '{#FSNAME}'
            - uuid: 69378521b7e844ec89afe753a7cba30e
              name: '{#FSLABEL}({#FSNAME}): Total space'
              key: 'vfs.fs.size[{#FSNAME},total]'
              history: 7d
              units: B
              description: 'Total space in Bytes'
              tags:
                - tag: component
                  value: storage
                - tag: filesystem
                  value: '{#FSNAME}'
            - uuid: a29509b4b7f24c25a768e88e0c23c154
              name: '{#FSLABEL}({#FSNAME}): Used space'
              key: 'vfs.fs.size[{#FSNAME},used]'
              history: 7d
              units: B
              description: 'Used storage in Bytes'
              tags:
                - tag: component
                  value: storage
                - tag: filesystem
                  value: '{#FSNAME}'
          trigger_prototypes:
            - uuid: d3e99134a1d04894918f2c92ff38cb92
              expression: |
                last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and
                ((last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              name: '{#FSLABEL}({#FSNAME}): Disk space is critically low'
              event_name: '{#FSLABEL}({#FSNAME}): Disk space is critically low (used > {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}%)'
              opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})'
              priority: AVERAGE
              description: |
                Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"}.
                 Second condition should be one of the following:
                 - The disk free space is less than {$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"}.
                 - The disk will be full in less than 24 hours.
              manual_close: 'YES'
              tags:
                - tag: scope
                  value: capacity
            - uuid: 97115bbe4f6b4a8cb2873b8fa01f95d3
              expression: |
                last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"} and
                ((last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              name: '{#FSLABEL}({#FSNAME}): Disk space is low'
              event_name: '{#FSLABEL}({#FSNAME}): Disk space is low (used > {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}%)'
              opdata: 'Space used: {ITEM.LASTVALUE3} of {ITEM.LASTVALUE2} ({ITEM.LASTVALUE1})'
              priority: WARNING
              description: |
                Two conditions should match: First, space utilization should be above {$VFS.FS.PUSED.MAX.WARN:"{#FSNAME}"}.
                 Second condition should be one of the following:
                 - The disk free space is less than {$VFS.FS.FREE.MIN.WARN:"{#FSNAME}"}.
                 - The disk will be full in less than 24 hours.
              manual_close: 'YES'
              dependencies:
                - name: '{#FSLABEL}({#FSNAME}): Disk space is critically low'
                  expression: |
                    last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused])>{$VFS.FS.PUSED.MAX.CRIT:"{#FSNAME}"} and
                    ((last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},total])-last(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},used]))<{$VFS.FS.FREE.MIN.CRIT:"{#FSNAME}"} or timeleft(/Windows by Zabbix agent/vfs.fs.size[{#FSNAME},pused],1h,100)<1d)
              tags:
                - tag: scope
                  value: capacity
          graph_prototypes:
            - uuid: f80e47b8d4db4c378f25056c02b72382
              name: '{#FSLABEL}({#FSNAME}): Disk space usage'
              width: '600'
              height: '340'
              type: PIE
              show_3d: 'YES'
              graph_items:
                - color: '969696'
                  calc_fnc: LAST
                  type: GRAPH_SUM
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'vfs.fs.size[{#FSNAME},total]'
                - sortorder: '1'
                  color: C80000
                  calc_fnc: LAST
                  item:
                    host: 'Windows by Zabbix agent'
                    key: 'vfs.fs.size[{#FSNAME},used]'
      tags:
        - tag: class
          value: os
        - tag: target
          value: windows
      macros:
        - macro: '{$AGENT.TIMEOUT}'
          value: 3m
          description: 'Timeout after which agent is considered unavailable. Works only for agents reachable from Zabbix server/proxy (passive mode).'
        - macro: '{$CPU.INTERRUPT.CRIT.MAX}'
          value: '50'
          description: 'The critical threshold of the % Interrupt Time counter.'
        - macro: '{$CPU.PRIV.CRIT.MAX}'
          value: '30'
          description: 'The threshold of the % Privileged Time counter.'
        - macro: '{$CPU.QUEUE.CRIT.MAX}'
          value: '3'
          description: 'The threshold of the Processor Queue Length counter.'
        - macro: '{$CPU.UTIL.CRIT}'
          value: '90'
          description: 'The critical threshold of the CPU utilization in %.'
        - macro: '{$IF.ERRORS.WARN}'
          value: '2'
        - macro: '{$IF.UTIL.MAX}'
          value: '90'
        - macro: '{$IFCONTROL}'
          value: '1'
        - macro: '{$MEM.PAGE_SEC.CRIT.MAX}'
          value: '1000'
          description: 'The warning threshold of the Memory Pages/sec counter.'
        - macro: '{$MEM.PAGE_TABLE_CRIT.MIN}'
          value: '5000'
          description: 'The warning threshold of the Free System Page Table Entries counter.'
        - macro: '{$MEMORY.UTIL.MAX}'
          value: '90'
          description: 'The warning threshold of the Memory util item.'
        - macro: '{$NET.IF.IFALIAS.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFALIAS.NOT_MATCHES}'
          value: CHANGE_THIS
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFDESCR.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFDESCR.NOT_MATCHES}'
          value: CHANGE_THIS
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$NET.IF.IFNAME.NOT_MATCHES}'
          value: Miniport|Virtual|Teredo|Kernel|Loopback|Bluetooth|HTTPS|6to4|QoS|Layer
          description: 'This macro is used in Network interface discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.NAME.MATCHES}'
          value: '^.*$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.NAME.NOT_MATCHES}'
          value: '^(?:RemoteRegistry|MMCSS|gupdate|SysmonLog|clr_optimization_v.+|sppsvc|gpsvc|Pml Driver HPZ12|Net Driver HPZ12|MapsBroker|IntelAudioService|Intel\(R\) TPM Provisioning Service|dbupdate|DoSvc|CDPUserSvc_.+|WpnUserService_.+|OneSyncSvc_.+|WbioSrvc|BITS|tiledatamodelsvc|GISvc|ShellHWDetection|TrustedInstaller|TabletInputService|CDPSvc|wuauserv|cbdhsvc_.+|webthreatdefusersvc_.+|edgeupdate|GSTOffline|)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.STARTUPNAME.MATCHES}'
          value: '^(?:automatic|automatic delayed)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SERVICE.STARTUPNAME.NOT_MATCHES}'
          value: '^(?:manual|disabled)$'
          description: 'This macro is used in Service discovery. Can be overridden on the host or linked template level.'
        - macro: '{$SWAP.PFREE.MIN.WARN}'
          value: '20'
          description: 'The warning threshold of the minimum free swap.'
        - macro: '{$SYSTEM.FUZZYTIME.MAX}'
          value: '60'
          description: 'The threshold for difference of system time in seconds.'
        - macro: '{$VFS.DEV.DEVNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.DEV.DEVNAME.NOT_MATCHES}'
          value: _Total
          description: 'This macro is used in physical disks discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.DEV.READ.AWAIT.WARN}'
          value: '0.02'
          description: 'Disk read average response time (in s) before the trigger would fire.'
        - macro: '{$VFS.DEV.UTIL.MAX.WARN}'
          value: '95'
          description: 'The warning threshold of disk time utilization in percent.'
        - macro: '{$VFS.DEV.WRITE.AWAIT.WARN}'
          value: '0.02'
          description: 'Disk write average response time (in s) before the trigger would fire.'
        - macro: '{$VFS.FS.FREE.MIN.CRIT}'
          value: 5G
          description: 'The critical threshold of the filesystem utilization.'
        - macro: '{$VFS.FS.FREE.MIN.WARN}'
          value: 10G
          description: 'The warning threshold of the filesystem utilization.'
        - macro: '{$VFS.FS.FSDRIVETYPE.MATCHES}'
          value: fixed
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.FSDRIVETYPE.NOT_MATCHES}'
          value: ^\s$
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.FSNAME.MATCHES}'
          value: '.*'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.FSNAME.NOT_MATCHES}'
          value: '^(?:/dev|/sys|/run|/proc|.+/shm$)'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.FSTYPE.MATCHES}'
          value: '.*'
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.FSTYPE.NOT_MATCHES}'
          value: ^\s$
          description: 'This macro is used in filesystems discovery. Can be overridden on the host or linked template level.'
        - macro: '{$VFS.FS.PUSED.MAX.CRIT}'
          value: '90'
          description: 'The critical threshold of the filesystem utilization in percent.'
        - macro: '{$VFS.FS.PUSED.MAX.WARN}'
          value: '80'
          description: 'The warning threshold of the filesystem utilization in percent.'
      dashboards:
        - uuid: 49212562a208434d9766aa82240230fd
          name: 'Network interfaces'
          pages:
            - widgets:
                - type: graphprototype
                  width: '24'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic'
                    - type: INTEGER
                      name: rows
                      value: '1'
                    - type: INTEGER
                      name: source_type
                      value: '2'
        - uuid: 5f494fac9dc94bf3827b67ea212240f2
          name: 'System performance'
          pages:
            - widgets:
                - type: graph
                  width: '12'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: 'CPU usage'
                    - type: INTEGER
                      name: source_type
                      value: '0'
                - type: graph
                  'y': '5'
                  width: '12'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: 'Memory utilization'
                    - type: INTEGER
                      name: source_type
                      value: '0'
                - type: graphprototype
                  'y': '10'
                  width: '24'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: '{#FSLABEL}({#FSNAME}): Disk space usage'
                    - type: INTEGER
                      name: rows
                      value: '1'
                    - type: INTEGER
                      name: source_type
                      value: '2'
                - type: graphprototype
                  'y': '15'
                  width: '24'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: '{#DEVNAME}: Disk read/write rates'
                    - type: INTEGER
                      name: rows
                      value: '1'
                    - type: INTEGER
                      name: source_type
                      value: '2'
                - type: graphprototype
                  'y': '20'
                  width: '24'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: '{#DEVNAME}: Disk utilization and queue'
                    - type: INTEGER
                      name: rows
                      value: '1'
                    - type: INTEGER
                      name: source_type
                      value: '2'
                - type: graphprototype
                  'y': '25'
                  width: '24'
                  height: '5'
                  fields:
                    - type: INTEGER
                      name: columns
                      value: '1'
                    - type: GRAPH_PROTOTYPE
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: 'Interface {#IFNAME}({#IFALIAS}): Network traffic'
                    - type: INTEGER
                      name: rows
                      value: '1'
                    - type: INTEGER
                      name: source_type
                      value: '2'
                - type: graph
                  x: '12'
                  width: '12'
                  height: '5'
                  fields:
                    - type: ITEM
                      name: itemid
                      value:
                        host: 'Windows by Zabbix agent'
                        key: 'perf_counter_en["\System\Processor Queue Length"]'
                    - type: INTEGER
                      name: source_type
                      value: '1'
                - type: graph
                  x: '12'
                  'y': '5'
                  width: '12'
                  height: '5'
                  fields:
                    - type: GRAPH
                      name: graphid
                      value:
                        host: 'Windows by Zabbix agent'
                        name: 'Swap usage'
                    - type: INTEGER
                      name: source_type
                      value: '0'
      valuemaps:
        - uuid: 9b087b9bfa09434ea0d0b5c32577abcc
          name: 'Win32_NetworkAdapter::AdapterTypeId'
          mappings:
            - value: '0'
              newvalue: 'Ethernet 802.3'
            - value: '1'
              newvalue: 'Token Ring 802.5'
            - value: '2'
              newvalue: 'Fiber Distributed Data Interface (FDDI)'
            - value: '3'
              newvalue: 'Wide Area Network (WAN)'
            - value: '4'
              newvalue: LocalTalk
            - value: '5'
              newvalue: 'Ethernet using DIX header format'
            - value: '6'
              newvalue: ARCNET
            - value: '7'
              newvalue: 'ARCNET (878.2)'
            - value: '8'
              newvalue: ATM
            - value: '9'
              newvalue: Wireless
            - value: '10'
              newvalue: 'Infrared Wireless'
            - value: '11'
              newvalue: Bpc
            - value: '12'
              newvalue: CoWan
            - value: '13'
              newvalue: '1394'
        - uuid: 7e549195e83446228db8bf1101bea83d
          name: 'Win32_NetworkAdapter::NetConnectionStatus'
          mappings:
            - value: '0'
              newvalue: Disconnected
            - value: '1'
              newvalue: Connecting
            - value: '2'
              newvalue: Connected
            - value: '3'
              newvalue: Disconnecting
            - value: '4'
              newvalue: 'Hardware Not Present'
            - value: '5'
              newvalue: 'Hardware Disabled'
            - value: '6'
              newvalue: 'Hardware Malfunction'
            - value: '7'
              newvalue: 'Media Disconnected'
            - value: '8'
              newvalue: Authenticating
            - value: '9'
              newvalue: 'Authentication Succeeded'
            - value: '10'
              newvalue: 'Authentication Failed'
            - value: '11'
              newvalue: 'Invalid Address'
            - value: '12'
              newvalue: 'Credentials Required'
        - uuid: 3f685167f97c492598ad445fc938560f
          name: 'Windows service state'
          mappings:
            - value: '0'
              newvalue: Running
            - value: '1'
              newvalue: Paused
            - value: '2'
              newvalue: 'Start pending'
            - value: '3'
              newvalue: 'Pause pending'
            - value: '4'
              newvalue: 'Continue pending'
            - value: '5'
              newvalue: 'Stop pending'
            - value: '6'
              newvalue: Stopped
            - value: '7'
              newvalue: Unknown
            - value: '255'
              newvalue: 'No such service'
        - uuid: c80233756c9d43769f334d632da07b8c
          name: zabbix.host.available
          mappings:
            - value: '0'
              newvalue: 'Not Available'
            - value: '1'
              newvalue: Available
            - value: '2'
              newvalue: Unknown
        - uuid: 5d3e53f3090448c7aaf081eb32b28ced
          name: 'Zabbix agent ping status'
          mappings:
            - value: '1'
              newvalue: Up
  triggers:
    - uuid: 8b1baeb26e154f99aefeaba3ea4fa63b
      expression: 'min(/Windows by Zabbix agent/perf_counter_en["\System\Processor Queue Length"],5m) - last(/Windows by Zabbix agent/wmi.get[root/cimv2,"Select NumberOfLogicalProcessors from Win32_ComputerSystem"]) * 2 > {$CPU.QUEUE.CRIT.MAX}'
      name: 'CPU queue length is too high'
      event_name: 'CPU queue length is too high (over {$CPU.QUEUE.CRIT.MAX} for 5m)'
      priority: WARNING
      description: 'The CPU Queue Length in the last 5 minutes exceeds {$CPU.QUEUE.CRIT.MAX}. According to actual observations, PQL should not exceed the number of cores * 2. To fine-tune the conditions, use the macro {$CPU.QUEUE.CRIT.MAX }.'
      dependencies:
        - name: 'High CPU utilization'
          expression: 'min(/Windows by Zabbix agent/system.cpu.util,5m)>{$CPU.UTIL.CRIT}'
      tags:
        - tag: scope
          value: performance
    - uuid: 7c23e03060ce42b094aac2f8aea1a9ad
      expression: 'max(/Windows by Zabbix agent/system.swap.pfree,5m)<{$SWAP.PFREE.MIN.WARN} and last(/Windows by Zabbix agent/system.swap.size[,total])>0'
      name: 'High swap space usage'
      event_name: 'High swap space usage (less than {$SWAP.PFREE.MIN.WARN}% free)'
      opdata: 'Free: {ITEM.LASTVALUE1}, total: {ITEM.LASTVALUE2}'
      priority: WARNING
      description: 'This trigger is ignored, if there is no swap configured'
      dependencies:
        - name: 'High memory utilization'
          expression: 'min(/Windows by Zabbix agent/vm.memory.util,5m)>{$MEMORY.UTIL.MAX}'
      tags:
        - tag: scope
          value: performance
  graphs:
    - uuid: 02ec085b49614b30a45287a7e88a8da1
      name: 'CPU jumps'
      graph_items:
        - color: 1A7C11
          item:
            host: 'Windows by Zabbix agent'
            key: 'perf_counter_en["\System\Context Switches/sec"]'
        - sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% Interrupt Time"]'
    - uuid: 0c2db401fe574282ab0beb6955049330
      name: 'CPU usage'
      type: STACKED
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - color: 1A7C11
          item:
            host: 'Windows by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% User Time"]'
        - sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows by Zabbix agent'
            key: 'perf_counter_en["\Processor Information(_total)\% Privileged Time"]'
    - uuid: 5de711b16f3845659289483f6deb4761
      name: 'CPU utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - drawtype: GRADIENT_LINE
          color: 1A7C11
          item:
            host: 'Windows by Zabbix agent'
            key: system.cpu.util
    - uuid: 1b86c8f6fe3343e6838c5d02f4f64b2b
      name: 'Memory utilization'
      ymin_type_1: FIXED
      ymax_type_1: FIXED
      graph_items:
        - drawtype: GRADIENT_LINE
          color: 1A7C11
          item:
            host: 'Windows by Zabbix agent'
            key: vm.memory.util
    - uuid: 518f6bcdcefc4cf493244798ccd09ec1
      name: 'Swap usage'
      graph_items:
        - color: 1A7C11
          item:
            host: 'Windows by Zabbix agent'
            key: system.swap.free
        - sortorder: '1'
          color: 2774A4
          item:
            host: 'Windows by Zabbix agent'
            key: 'system.swap.size[,total]'