diff --git a/Template OS Windows Active/Template_OS_Windows_Active.xml b/Template OS Windows Active/Template_OS_Windows_Active.xml index d4d2e96..d3e527d 100644 --- a/Template OS Windows Active/Template_OS_Windows_Active.xml +++ b/Template OS Windows Active/Template_OS_Windows_Active.xml @@ -1,7 +1,7 @@ - 3.4 - 2018-06-15T06:49:28Z + 5.0 + 2020-09-27T17:44:38Z Templates @@ -66,1181 +66,598 @@ Firewall status + + Version of zabbix_agent(d) running + agent.version + 0 + CHAR + + + {diff(0)}>0 + Template OS Windows Active (itmicus.ru) + + + Data inventory - 7 - - + ZABBIX_ACTIVE os.windows.active[get,inventory] 1h 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - - - Antivirus - 18 - - + DEPENDENT os.windows.inventory.antivirus 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT Antivirus: name, version,last update - 0 Inventory: Software - - - 12 + JSONPATH $.Antivirus - os.windows.active[get,inventory] Bios version - 18 - - + DEPENDENT os.windows.inventory.biosversion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT BiosVersion - 0 Inventory: Hardware - - - 12 + JSONPATH $.BiosVersion - os.windows.active[get,inventory] Chassis - 18 - - + DEPENDENT os.windows.inventory.chassis 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 28 + TEXT + CHASSIS Inventory: Hardware - - - 12 + JSONPATH $.Chassis - os.windows.active[get,inventory] Computer architecture - 18 - - + DEPENDENT os.windows.inventory.computerarchitecture 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 30 + TEXT + HW_ARCH Inventory: Hardware - - - 12 + JSONPATH $.ComputerArchitecture - os.windows.active[get,inventory] Computer Manufacturer - 18 - - + DEPENDENT os.windows.inventory.computermanufacturer 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT ComputerManufacturer - 31 + VENDOR Inventory: Hardware - - - 12 + JSONPATH $.ComputerManufacturer - os.windows.active[get,inventory] Computer model - 18 - - + DEPENDENT os.windows.inventory.computermodel 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 29 + TEXT + MODEL Inventory: Hardware - - - 12 + JSONPATH $.ComputerModel - os.windows.active[get,inventory] Computer number of logical processors - 18 - - + DEPENDENT os.windows.inventory.computernumberoflogicalprocessors 0 1w 1w - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - ComputerNumberOfLogicalProcessors - 0 Inventory: Hardware - - - 12 + JSONPATH $.ComputerNumberOfLogicalProcessors - os.windows.active[get,inventory] Computer number of processors - 18 - - + DEPENDENT os.windows.inventory.computernumberofprocessors 0 1w 1w - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - ComputerNumberOfProcessors - 0 Inventory: Hardware - - - 12 + JSONPATH $.ComputerNumberOfProcessors - os.windows.active[get,inventory] CPU model - 18 - - + DEPENDENT os.windows.inventory.cpumodel 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT CPU model - 0 Inventory: Hardware - - - 12 + JSONPATH $.CPUModel - os.windows.active[get,inventory] Domain - 18 - - + DEPENDENT os.windows.inventory.domain 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT Domain or workgroup name - 0 Inventory: OS - - - 12 + JSONPATH $.Domain - os.windows.active[get,inventory] Firewall status - 18 - - + DEPENDENT os.windows.inventory.firewallstatus 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + TEXT FirewallStatus - 0 Inventory: OS - - - 12 + JSONPATH $.FirewallStatus - os.windows.active[get,inventory] + + + {diff(0)}>0 + Firewall status has just been changed + INFO + + Hostname - 18 - - + DEPENDENT os.windows.inventory.hostname 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.Hostname - os.windows.active[get,inventory] Motherboard manufacturer - 18 - - + DEPENDENT os.windows.inventory.motherboadrmanufacturer 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: Hardware - - - 12 + JSONPATH $.MotherboardManufacturer - os.windows.active[get,inventory] Motherboard product - 18 - - + DEPENDENT os.windows.inventory.motherboardproduct 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: Hardware - - - 12 + JSONPATH $.MotherboardProduct - os.windows.active[get,inventory] Networks - 18 - - + DEPENDENT os.windows.inventory.networks 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 38 + TEXT + HOST_NETWORKS Inventory: OS - - - 12 + JSONPATH $.Networks - os.windows.active[get,inventory] Operating System build version - 18 - - + DEPENDENT os.windows.inventory.osbuildversion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.OSBuildversion - os.windows.active[get,inventory] Operating System days from latest update installed - 18 - - + DEPENDENT os.windows.inventory.OSDaysFromLatestUpdatesInstalled 0 1w - 365d - 0 - 3 - s - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Inventory: OS - - - 12 + JSONPATH $.OSSecondsFromLatestUpdatesInstalled - os.windows.active[get,inventory] + + + {last()}>{$WINDOWS_UPDATE_LAST_INSTALL_INFO} and {last()}<{$WINDOWS_UPDATE_LAST_INSTALL_WARN} + Windows updates installed more than 90 days ago + INFO + + + {last()}>{$WINDOWS_UPDATE_LAST_INSTALL_WARN} + Windows updates installed more than 180 days ago + WARNING + + Operating System installation date - 18 - - + DEPENDENT os.windows.inventory.osinstalldate 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.OSInstallDate - os.windows.active[get,inventory] Operating System latest update installed - 18 - - + DEPENDENT os.windows.inventory.OSLatestUpdatesInstalled 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.OSLatestUpdatesInstalled - os.windows.active[get,inventory] Operating System title - 18 - - + DEPENDENT os.windows.inventory.ostitle 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 5 + TEXT + OS Inventory: Hardware - - - 12 + JSONPATH $.OSTitle - os.windows.active[get,inventory] Operating System uptime - 18 - - + DEPENDENT os.windows.inventory.osuptime 0 1w - 365d - 0 - 3 - s - - - 0 - 0 - - 0 - - - - 0 - - - - - OSUptime - 0 Inventory: OS - - - 12 + JSONPATH $.OSUptime - os.windows.active[get,inventory] Operating System vendor - 18 - - + DEPENDENT os.windows.inventory.osvendor 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.OSVendor - os.windows.active[get,inventory] Operating System version - 18 - - + DEPENDENT os.windows.inventory.osversion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: OS - - - 12 + JSONPATH $.OSVersion - os.windows.active[get,inventory] Operating System Pending Reboot - 18 - - + DEPENDENT os.windows.inventory.PendingReboot 0 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - OS Pending Reboot, after install updates - 0 Inventory: OS @@ -1249,459 +666,212 @@ Firewall status Microsoft Windows Pending Reboot - - 12 + JSONPATH $.PendingReboot - os.windows.active[get,inventory] + + + {last()}=1 + RECOVERY_EXPRESSION + {last()}=0 + Operation System pending reboot + INFO + YES + + PowerShell Remoting is Active - 18 - - + DEPENDENT os.windows.inventory.powershellremoting 0 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - PowerShell Remoting is Active - 0 Inventory: Software - - - 12 + JSONPATH $.ShellVersion.PSRemotingActive - os.windows.active[get,inventory] PowerShell version - 18 - - + DEPENDENT os.windows.inventory.powershellversion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 18 + TEXT + SOFTWARE_APP_A Inventory: Software - - - 12 + JSONPATH $.ShellVersion.PowerShell - os.windows.active[get,inventory] Serial number - 18 - - + DEPENDENT os.windows.inventory.serialnumber 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 10 + TEXT + TAG Inventory: Hardware - - - 12 + JSONPATH $.SerialNumber - os.windows.active[get,inventory] SM BIOS Version - 18 - - + DEPENDENT os.windows.inventory.SMBIOSBIOSVersion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Inventory: Hardware - - - 12 + JSONPATH $.SMBIOSBIOSVersion - os.windows.active[get,inventory] Total physical memory - 18 - - + DEPENDENT os.windows.inventory.totalphysicalmemory 0 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - TotalPhysicalMemory - 0 Inventory: Hardware - - - 12 + JSONPATH $.TotalPhysicalMemory - os.windows.active[get,inventory] Zabbix agent version - 18 - - + DEPENDENT os.windows.inventory.zabbixagentversion 0 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 19 + TEXT + SOFTWARE_APP_B Inventory: Software - - - 12 + JSONPATH $.ZabbixAgentVersion - os.windows.active[get,inventory] Number of processes - 7 - - + ZABBIX_ACTIVE proc.num[] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 CPU - - - - - Physical memory swap space free - 7 - - + ZABBIX_ACTIVE system.swap.size[,free] 15s 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Physical memory - - - - - Physical memory swap space total - 7 - - + ZABBIX_ACTIVE system.swap.size[,total] 1h 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Physical memory - - - - - System information - 7 - - + ZABBIX_ACTIVE system.uname 1d 1w 0 - 0 - 1 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + CHAR OS version - 0 OS @@ -1710,42 +880,23 @@ Firewall status OS overview - - - - - + + + {diff(0)}>0 + Host information was changed on "{HOST.NAME}" + AVERAGE + + System Uptime - 7 - - + ZABBIX_ACTIVE system.uptime 15m 1w - 365d - 0 - 0 - + FLOAT s - - - 0 - 0 - - 0 - - - - 0 - - - - - System uptime - 0 OS @@ -1754,46 +905,26 @@ Firewall status OS overview - - - - - + + + {change(0)}<0 + "{HOST.NAME}" has just been restarted + INFO + + Physical memory cache bytes - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT CacheBytes FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - \Memory\Cache Bytes Cache Bytes is the sum of the Memory\\System Cache Resident Bytes, Memory\\System Driver Resident Bytes, Memory\\System Code Resident Bytes, and Memory\\Pool Paged Resident Bytes counters. This counter displays the last observed value only; it is not an average. The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. - 0 Hardware overview @@ -1805,44 +936,18 @@ The Memory performance object consists of counters that describe the behavior of Physical memory - - - - - Physical memory Committed Bytes - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT CommittedBytes FROM Win32_PerfRawData_PerfOS_Memory] 15s 1w - 365d - 0 - 0 - + FLOAT B - - - 0 - 0 - - 0 - - - - 0 - - - - - \Memory\% Committed Bytes Memory Available Megabytes in Use This measures the ratio of Committed Bytes to the Commit Limit—in other words, the amount of virtual memory in use. This indicates insufficient memory if the number is greater than 80 percent. The obvious solution for this is to add more memory. - 0 Hardware overview @@ -1854,44 +959,18 @@ Memory Available Megabytes in Use This measures the ratio of Committed Bytes to Physical memory - - - - - Physical memory free - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select FreePhysicalMemory from Win32_OperatingSystem] 15s 1w - 365d - 0 - 0 - + FLOAT B - - - 0 - 0 - - 0 - - - - 0 - - - - - \Memory\Available Bytes Memory Available Megabytes - 0 Hardware overview @@ -1903,49 +982,37 @@ Memory Available Megabytes Physical memory - - - 1 + MULTIPLIER 1024 - - + + + {avg(30m)}<{$PHYSICAL_MEMORY_MIN_FREE} + RECOVERY_EXPRESSION + {avg(30m)}>{$PHYSICAL_MEMORY_MIN_FREE} + Physical memory free < {$PHYSICAL_MEMORY_MIN_FREE} + INFO + Available Megabytes is different from most other KHIs in the regard that you need to pay attention to two things: +• The trending direction is reversed (i.e. higher is better) +• Track the minimum and average, not maximum. +Most likely, the server doesn’t have enough RAM to fulfil demand. To verify, either use Task Manager and look for unaccounted processes or use the Private Bytes (in process counter object) to see identify the culprit. +Lastly, if you discover SQL Server Express on Front-end Servers is the consumer of this memory verify that Lock Pages in Memory is disabled. When configured, Windows Memory Manager cannot trim SQL Servers Working Set for other processes while that memory is not in used. + + Physical memory Free System Page Table Entries - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT FreeSystemPageTableEntries FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT Memory\Free System Page Table Entries This indicates the number of page table entries not currently in use by the system. If the number is less than 5,000, there may well be a memory leak. - 0 Hardware overview @@ -1957,46 +1024,26 @@ This indicates the number of page table entries not currently in use by the syst Physical memory - - - - - + + + {last()}<5000 + Physical memory Page Table Entries < 5000 + INFO + If the number is less than 5,000, there may well be a memory leak. + + Physical memory Page Faults Per sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT PageFaultsPersec FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - Memory\ Page Faults Per sec Page Faults/sec is the average number of pages faulted per second. It is measured in number of pages faulted per second because only one page is faulted in each fault operation, hence this is also equal to the number of page fault operations. This counter includes both hard faults (those that require disk access) and soft faults (where the faulted page is found elsewhere in physical memory.) Most processors can handle large numbers of soft faults without significant consequence. However, hard faults, which require disk access, can cause significant delays. The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes. - 0 Hardware overview @@ -2008,44 +1055,17 @@ The Memory performance object consists of counters that describe the behavior of Physical memory - - - - - Physical memory Page per sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2, select PagesPersec FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT Memory\Pages per Second This measures the rate at which pages are read from or written to disk to resolve hard page faults. If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. - 0 Hardware overview @@ -2057,130 +1077,67 @@ This measures the rate at which pages are read from or written to disk to resolv Physical memory - - - - - + + + {avg(30m)}>1000 + Physical memory pages per sec > 1000 + INFO + If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. + + Processor Interrupt Time % - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT PercentInterruptTime FROM Win32_PerfFormattedData_PerfOS_Processor] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT Processor\% Interrupt Time This measures the time the processor spends receiving and servicing hardware interruptions during specific sample intervals. This counter indicates a possible hardware issue if the value is greater than 15 percent. - 0 CPU - - - - - + + + {avg(1h)}>15 + RECOVERY_EXPRESSION + {avg(1h)}<10 + Processor Interrupt Time > 15% + WARNING + possible hardware issue + + Processor Privileged Time % - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2, SELECT PercentPrivilegedTime FROM Win32_PerfFormattedData_PerfOS_Processor] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT Processor\% Privileged Time This is the percentage of elapsed time that the process threads spent executing code in privileged mode. When a Windows system service in called, the service will often run in privileged mode to gain access to system-private data. Such data is protected from access by threads executing in user mode. Calls to the system can be explicit or implicit, such as page faults or interrupts. Unlike some early operating systems, Windows uses process boundaries for subsystem protection in addition to the traditional protection of user and privileged modes. Some work done by Windows on behalf of the application might appear in other subsystem processes in addition to the privileged time in the process. The Processor performance object consists of counters that measure aspects of processor activity The processor is the part of the computer that performs arithmetic and logical computations, initiates operations on peripherals, and runs the threads of processes. A computer can have multiple processors. The processor object represents each processor as an instance of the object. - 0 CPU - - - - - Processor load % - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select PercentProcessorTime from Win32_PerfformattedData_PerfOS_Processor where Name='_Total'] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT \Processor Information(_Total)\% Processor Time - 0 CPU @@ -2192,44 +1149,27 @@ The Processor performance object consists of counters that measure aspects of pr Performance - - - - - + + + {avg(1h)}>{$CPU_MAX_LOAD} + RECOVERY_EXPRESSION + {avg(1h)}<{$CPU_MAX_LOAD} + Processor load > {$CPU_MAX_LOAD}% + AVERAGE + If % Processor Time is 80% or higher, the first path to explore is determining if there is a legitimate need to increase CPU capacity of your Lync Servers. Windows Server 2008 introduced new Power Management settings (which are on by default) to help reduce carbon footprint produced from Servers by consuming less electricity by parking CPU cores that are lightly utilized by moving those tasks to other cores. What this means is that high Processor Time values no longer automatically mean the physical CPUs are approaching their hardware limits + + Physical memory Page File % Usage - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2, SELECT PercentUsagePeak FROM Win32_PerfFormattedData_PerfOS_PagingFile] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT The peak usage of the Page File instance in percent. The Paging File performance object consists of counters that monitor the paging file(s) on the computer. The paging file is a reserved space on disk that backs up committed physical memory on the computer. - 0 Hardware overview @@ -2241,87 +1181,46 @@ The Paging File performance object consists of counters that monitor the paging Physical memory - - - - - + + + {avg(30m)}>70 + RECOVERY_EXPRESSION + {avg(30m)} +<60 + Physical memory Page File Usage > 70% + INFO + You could also confirm that it is on the most suitable disk, and if possible split the pagefile over two disks and thus improve access times. (Note the object here is Page File not Memory) + +Because the changes are so gradual, you are better off using this Page File % Usage counter as an alert, rather than a log. I suggest setting an alert on a limit of over 70. + + Processor User Time % - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT Processor\% User Time This measures the percentage of elapsed time the processor spends in user mode. If this value is high, the server is busy with the application. One possible solution here is to optimize the application that is using up the processor resources. - 0 CPU - - - - - Physical memory Pool Non-paged Bytes - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT PoolNonpagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - Memory\Pool Non-Paged Bytes This measures the size, in bytes, of the non-paged pool. This is an area of system memory for objects that cannot be written to disk but instead must remain in physical memory as long as they are allocated. There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). A typical Event ID 2019 is recorded in the system event log. - 0 Hardware overview @@ -2333,44 +1232,26 @@ This measures the size, in bytes, of the non-paged pool. This is an area of syst Physical memory - - - - - + + + {avg(30m)}>175M + Physical memory Pool Non-paged > 175 Mb + DISABLED + WARNING + There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). + + Physical memory Pool Paged Bytes - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,SELECT PoolPagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory] 15s 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - Memory\Pool Paged Bytes This measures the size, in bytes, of the paged pool. This is an area of system memory used for objects that can be written to disk when they are not being used. There may be a memory leak if this value is greater than 250MB (or 170MB with the /3GB switch). A typical Event ID 2020 is recorded in the system event log. - 0 Hardware overview @@ -2382,85 +1263,39 @@ This measures the size, in bytes, of the paged pool. This is an area of system m Physical memory - - - - - + + + {avg(30m)}>250M + Physical memory Pool paged > 250 Mb + DISABLED + WARNING + This is an area of system memory used for objects that can be written to disk when they are not being used. There may be a memory leak if this value is greater than 250MB (or 170MB with the /3GB switch). + + Processor Queue Length - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2, SELECT ProcessorQueueLength FROM Win32_PerfFormattedData_PerfOS_System] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT System\Processor Queue Length This indicates the number of threads in the processor queue. The server doesn't have enough processor power if the value is more than two times the number of CPUs for an extended period of time. - 0 CPU - - - - - Physical memory total - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select TotalPhysicalMemory from Win32_ComputerSystem] 1h 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Hardware overview @@ -2469,296 +1304,110 @@ This indicates the number of threads in the processor queue. The server doesn't Physical memory - - - - - Logical Disk discover - 7 - - + ZABBIX_ACTIVE os.windows.active[discover,ldisk] 1d - 0 - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 - - - 7d - Used Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" - 15 - - + CALCULATED os.windows.active.ldisk.used.bytes[{#LOGICAL_DISK}] - 1m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - last("wmi.get[root\cimv2,select Size from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}']")-last("wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}']") - - 0 - - - - - - - 0 Filesystems - - - - - - Used Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" bytes 12h linear forecast shifted - 15 - - + CALCULATED os.windows.active.ldisk.used.forecast12hshifted[{#LOGICAL_DISK}] - 1m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - last("os.windows.active.ldisk.used.forecastmb12h[{#LOGICAL_DISK}]",#1,12h) - - 0 - - - - - Forecast to 12 h - 0 Filesystems - - - 1 + MULTIPLIER 1048576 - - - Used Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" bytes 12h linear forecast - 15 - - + CALCULATED os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}] - 1m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - forecast("os.windows.active.ldisk.used.mbytes[{#LOGICAL_DISK}]",12h,,12h) - - 0 - - - - - - - 0 Filesystems - - - 1 + MULTIPLIER 1048576 - - - + + + {last()}<{$LOGICAL_DISK_FREE_SPACE_HIGH} and {last()}>{$LOGICAL_DISK_FREE_SPACE_DISASTER} + Forecast: Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_HIGH} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) in next 12 hours + HIGH + + + {last()}<{$LOGICAL_DISK_FREE_SPACE_INFO} and {last()}>{$LOGICAL_DISK_FREE_SPACE_HIGH} + Forecast: Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_INFO} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) in next 12 hours + INFO + + Used Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" bytes 12h linear forecast (MB) - 15 - - + CALCULATED os.windows.active.ldisk.used.forecastmb12h[{#LOGICAL_DISK}] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - forecast("os.windows.active.ldisk.used.mbytes[{#LOGICAL_DISK}]",12h,,12h) - - 0 - - - - - - - 0 Filesystems - - - - - - Used Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" (MB) - 15 - - + CALCULATED os.windows.active.ldisk.used.mbytes[{#LOGICAL_DISK}] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - last(os.windows.active.ldisk.used.bytes[{#LOGICAL_DISK}])/1024/1024 - - 0 - - - - - - - 0 Filesystems - - - - - - Free disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'] - 1m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Filesystems @@ -2767,164 +1416,43 @@ This indicates the number of threads in the processor queue. The server doesn't Hardware overview - - - - - - + + + {last()}<{$LOGICAL_DISK_FREE_SPACE_DISASTER} + Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_DISASTER} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) + DISASTER + + + {last()}<{$LOGICAL_DISK_FREE_SPACE_HIGH} and {last()}>{$LOGICAL_DISK_FREE_SPACE_DISASTER} + Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_HIGH} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) + HIGH + + + {last()}<{$LOGICAL_DISK_FREE_SPACE_INFO} and {last()}>{$LOGICAL_DISK_FREE_SPACE_HIGH} + Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_INFO} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) + INFO + + Total Disk "{#LOGICAL_DISK} {#LOGICAL_DISK_VOLUME_NAME}" - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select Size from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'] - 1m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Filesystems - - - - - - - - - {Template OS Windows Active:os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}].last()}<{$LOGICAL_DISK_FREE_SPACE_HIGH} and {Template OS Windows Active:os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}].last()}>{$LOGICAL_DISK_FREE_SPACE_DISASTER} - 0 - - Forecast: Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_HIGH} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) in next 12 hours - 0 - - - 0 - 4 - - 0 - 0 - - - - - {Template OS Windows Active:os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}].last()}<{$LOGICAL_DISK_FREE_SPACE_INFO} and {Template OS Windows Active:os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}].last()}>{$LOGICAL_DISK_FREE_SPACE_HIGH} - 0 - - Forecast: Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_INFO} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) in next 12 hours - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'].last()}<{$LOGICAL_DISK_FREE_SPACE_DISASTER} - 0 - - Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_DISASTER} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) - 0 - - - 0 - 5 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'].last()}<{$LOGICAL_DISK_FREE_SPACE_HIGH} and {Template OS Windows Active:wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'].last()}>{$LOGICAL_DISK_FREE_SPACE_DISASTER} - 0 - - Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_HIGH} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) - 0 - - - 0 - 4 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'].last()}<{$LOGICAL_DISK_FREE_SPACE_INFO} and {Template OS Windows Active:wmi.get[root\cimv2,select FreeSpace from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'].last()}>{$LOGICAL_DISK_FREE_SPACE_HIGH} - 0 - - Free disk space is less than {$LOGICAL_DISK_FREE_SPACE_INFO} on volume "{#LOGICAL_DISK}" (Last: {ITEM.LASTVALUE1}) - 0 - - - 0 - 1 - - 0 - 0 - - - - Disk "{#LOGICAL_DISK}" usage - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 0 1A7C11 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select Size from win32_logicaldisk where DeviceID='{#LOGICAL_DISK}'] @@ -2932,11 +1460,8 @@ This indicates the number of threads in the processor queue. The server doesn't 1 - 1 + FILLED_REGION F63100 - 0 - 2 - 0 Template OS Windows Active os.windows.active.ldisk.used.bytes[{#LOGICAL_DISK}] @@ -2946,29 +1471,9 @@ This indicates the number of threads in the processor queue. The server doesn't Disk "{#LOGICAL_DISK}" usage (12h forecast) - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 0 CC0000 - 0 - 2 - 0 Template OS Windows Active os.windows.active.ldisk.used.bytes[{#LOGICAL_DISK}] @@ -2976,11 +1481,7 @@ This indicates the number of threads in the processor queue. The server doesn't 1 - 0 00CC00 - 0 - 2 - 0 Template OS Windows Active os.windows.active.ldisk.used.forecast12h[{#LOGICAL_DISK}] @@ -2988,11 +1489,7 @@ This indicates the number of threads in the processor queue. The server doesn't 2 - 0 3333FF - 0 - 2 - 0 Template OS Windows Active os.windows.active.ldisk.used.forecast12hshifted[{#LOGICAL_DISK}] @@ -3001,69 +1498,22 @@ This indicates the number of threads in the processor queue. The server doesn't - - Physical Disk discover - 7 - - + ZABBIX_ACTIVE os.windows.active[discover,pdisk] 1d - 0 - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 - - - 7d Get physical disks Physical Disk "{#PHYSICAL_DISK}" Avg. Disk Read/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select AvgDisksecPerRead from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT \PhysicalDisk({#PHYSICAL_DISK})\Avg. Disk sec/Read Displays the average time the disk transfers took to complete, in seconds. Although the scale is seconds, the counter has millisecond precision, meaning a value of 0.004 indicates the average time for disk transfers to complete was 4 milliseconds. @@ -3071,7 +1521,6 @@ This is the counter in Perfmon used to measure IO latency. I wrote a blog specifically about measuring latency with Perfmon. For details got to “Measuring Disk Latency with Windows Performance Monitor”. http://blogs.technet.com/b/askcore/archive/2012/02/07/measuring-disk-latency-with-windows-performance-monitor-perfmon.aspx - 0 Filesystems @@ -3080,46 +1529,27 @@ http://blogs.technet.com/b/askcore/archive/2012/02/07/measuring-disk-latency-wit Performance - - - - - - + + + {avg(30m)}>{$PHYSICAL_DISK_AVG_READ} + RECOVERY_EXPRESSION + {avg(30m)}<{$PHYSICAL_DISK_AVG_READ} + PhysicalDisk "{#PHYSICAL_DISK}" Avg. Disk sec/Read > {$PHYSICAL_DISK_AVG_READ} + AVERAGE + + Physical Disk "{#PHYSICAL_DISK}" Avg. Disk Write/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select AvgDisksecPerWrite from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] 15s 1w - 365d - 0 - 0 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - + FLOAT \PhysicalDisk({#PHYSICAL_DISK})\Avg. Disk sec/Write Displays the average time the disk transfers took to complete, in seconds. Although the scale is seconds, the counter has millisecond precision, meaning a value of 0.004 indicates the average time for disk transfers to complete was 4 milliseconds. This is the counter in Perfmon used to measure IO latency. - 0 Filesystems @@ -3128,48 +1558,30 @@ This is the counter in Perfmon used to measure IO latency. Performance - - - - - - + + + {avg(30m)}>{$PHYSICAL_DISK_AVG_WRITE} + RECOVERY_EXPRESSION + {avg(30m)}<{$PHYSICAL_DISK_AVG_WRITE} + PhysicalDisk "{#PHYSICAL_DISK}" Avg. Disk sec/Write > {$PHYSICAL_DISK_AVG_WRITE} + AVERAGE + + Physical Disk "{#PHYSICAL_DISK}" Disk Read Bytes/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select DiskReadBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] 15s 1w - 365d - 0 - 0 - + FLOAT Bps - - - 0 - 0 - - 0 - - - - 0 - - - - - perf_counter["\PhysicalDisk({#PHYSICAL_DISK})\Disk Read Bytes/sec"] Perfmon captures the total number of bytes sent to the disk (write) and retrieved from the disk (read) over a period of one second. If the Perfmon capture interval is set for anything greater than one second, the average of the values captured is presented. The Disk Read Bytes/sec and the Disk Write Bytes/sec counters break down the results displaying only read bytes or only write bytes, respectively. The average speed of data exchange with the disk, or the speed of reading / writing. Shows the total number of bytes sent to disk (write) and disk (read) for one second, thereby allowing you to estimate the throughput of the disk system. It is built from the values Disk Read Bytes / sec (read speed) and Disk Write Bytes / sec (write speed). Limit values strongly depend on the type of disk: for example, for a single hard drive, the maximum read / write speed is 160-250Mb / s, for a single SSD, about 550-600Mb / s. - 0 Filesystems @@ -3178,41 +1590,15 @@ The average speed of data exchange with the disk, or the speed of reading / writ Performance - - - - - - Physical Disk "{#PHYSICAL_DISK}" Disk Transfers/sec iops - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select DiskTransfersPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] 15s 1w - 365d - 0 - 0 - + FLOAT ops/s - - - 0 - 0 - - 0 - - - - 0 - - - - - perf_counter["\PhysicalDisk({#PHYSICAL_DISK})\Disk Transfers/sec"] Disk Transfers/sec is the rate of read and write operations on the disk. @@ -3220,7 +1606,6 @@ Disk Transfers/sec is the rate of read and write operations on the disk. The Physical Disk performance object consists of counters that monitor hard or fixed disk drive on a computer. Disks are used to store file, program, and paging data and are read to retrieve these items, and written to record changes to them. The values of physical disk counters are sums of the values of the logical disks (or partitions) into which they are divided. The main indicator of the intensity of requests to the disk. Shows the total number of I / O operations processed (completed) by the disk for 1 second (Input / Output Operations Per Second, IOPS). This counter allows you to roughly estimate how much the load on the disks is close to the limit. For disks running in normal mode, you can focus on the following values: 80-160 IOPS for a single SATA or SAS hard drive, 1800-5000 IOPS for a single SSD drive. To clarify, you can use Disk Reads / sec counters (the number of read requests processed per second) and Disk Writes / sec (the number of write requests processed per second). - 0 Filesystems @@ -3229,48 +1614,21 @@ The main indicator of the intensity of requests to the disk. Shows the total num Performance - - - - - - Physical Disk "{#PHYSICAL_DISK}" Disk Write Bytes/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select DiskWriteBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] 15s 1w - 365d - 0 - 0 - + FLOAT Bps - - - 0 - 0 - - 0 - - - - 0 - - - - - perf_counter["\PhysicalDisk({#PHYSICAL_DISK})\Disk Write Bytes/sec"] Perfmon captures the total number of bytes sent to the disk (write) and retrieved from the disk (read) over a period of one second. If the Perfmon capture interval is set for anything greater than one second, the average of the values captured is presented. The Disk Read Bytes/sec and the Disk Write Bytes/sec counters break down the results displaying only read bytes or only write bytes, respectively. The average speed of data exchange with the disk, or the speed of reading / writing. Shows the total number of bytes sent to disk (write) and disk (read) for one second, thereby allowing you to estimate the throughput of the disk system. It is built from the values Disk Read Bytes / sec (read speed) and Disk Write Bytes / sec (write speed). Limit values strongly depend on the type of disk: for example, for a single hard drive, the maximum read / write speed is 160-250Mb / s, for a single SSD, about 550-600Mb / s. - 0 Filesystems @@ -3279,74 +1637,15 @@ The average speed of data exchange with the disk, or the speed of reading / writ Performance - - - - - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select AvgDisksecPerRead from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'].avg(30m)}>{$PHYSICAL_DISK_AVG_READ} - 1 - {Template OS Windows Active:wmi.get[root\cimv2,select AvgDisksecPerRead from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'].avg(30m)}<{$PHYSICAL_DISK_AVG_READ} - PhysicalDisk "{#PHYSICAL_DISK}" Avg. Disk sec/Read > {$PHYSICAL_DISK_AVG_READ} - 0 - - - 0 - 3 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select AvgDisksecPerWrite from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'].avg(30m)}>{$PHYSICAL_DISK_AVG_WRITE} - 1 - {Template OS Windows Active:wmi.get[root\cimv2,select AvgDisksecPerWrite from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'].avg(30m)}<{$PHYSICAL_DISK_AVG_WRITE} - PhysicalDisk "{#PHYSICAL_DISK}" Avg. Disk sec/Write > {$PHYSICAL_DISK_AVG_WRITE} - 0 - - - 0 - 3 - - 0 - 0 - - - - Physical Disk "{#PHYSICAL_DISK}" Disk bytes/second - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 5 + GRADIENT_LINE EE0000 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select DiskReadBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3354,11 +1653,8 @@ The average speed of data exchange with the disk, or the speed of reading / writ 1 - 5 + GRADIENT_LINE 0000EE - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select DiskWriteBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3368,29 +1664,10 @@ The average speed of data exchange with the disk, or the speed of reading / writ Physical Disk "{#PHYSICAL_DISK}" ops/second - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 5 + GRADIENT_LINE 2774A4 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select DiskTransfersPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3400,29 +1677,10 @@ The average speed of data exchange with the disk, or the speed of reading / writ Physical Disk "{#PHYSICAL_DISK}" overview - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 1 + FILLED_REGION EE0000 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select DiskReadBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3430,11 +1688,8 @@ The average speed of data exchange with the disk, or the speed of reading / writ 1 - 1 + FILLED_REGION 0000EE - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select DiskWriteBytesPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3442,11 +1697,8 @@ The average speed of data exchange with the disk, or the speed of reading / writ 2 - 0 33FF33 - 1 - 2 - 0 + RIGHT Template OS Windows Active wmi.get[root\cimv2,select DiskTransfersPersec from Win32_PerfFormattedData_PerfDisk_PhysicalDisk where Name='{#PHYSICAL_DISK}'] @@ -3455,114 +1707,51 @@ The average speed of data exchange with the disk, or the speed of reading / writ - - Network Interface discover - 7 - - + ZABBIX_ACTIVE os.windows.active[discover,pnetwork] 1d - 0 - - - - 0 - 0 - - 0 - - - - 0 - - - - - - 1 - - + AND 7d Get network interfaces Network Interface "{#PHYSICAL_NETWORK_NAME}" % Utilization - 15 - - + CALCULATED os.windows.active.networkinterface.utilization.percent[{#PHYSICAL_NETWORK_INTERFACEINDEX}] 15s 1w - 365d - 0 - 0 - + FLOAT % - - - 0 - 0 - - 0 - ( (last("wmi.get[root\cimv2,select BytesTotalPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}']") *8) / last("wmi.get[root\cimv2,select CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}']"))*100 - - 0 - - - - - - - 0 Network - - - - - - + + + {avg(6h)}>{$NETWORK_MAX_UTILIZE} + RECOVERY_EXPRESSION + {avg(6h)}<{$NETWORK_MAX_UTILIZE} + Network Interface "{#PHYSICAL_NETWORK_NAME}" utilize > {$NETWORK_MAX_UTILIZE}% + WARNING + + Network Interface "{#PHYSICAL_NETWORK_NAME}" Incoming Bytes/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select BytesReceivedPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] 15s 1w - 365d - 0 - 3 - Bps - - - 0 - 0 - - 0 - - - - 0 - - - - - \Network Interface({#PNETWORK})\Bytes Received/sec - 0 Network @@ -3571,43 +1760,15 @@ last("wmi.get[root\cimv2,select CurrentBandwidth from Win32_PerfFormattedDa Performance - - - - - - Network Interface "{#PHYSICAL_NETWORK_NAME}" Outbound Bytes/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select BytesSentPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] 15s 1w - 365d - 0 - 3 - Bps - - - 0 - 0 - - 0 - - - - 0 - - - - - \Network Interface({#PNETWORK})\Bytes Sent/sec - 0 Network @@ -3616,170 +1777,61 @@ last("wmi.get[root\cimv2,select CurrentBandwidth from Win32_PerfFormattedDa Performance - - - - - - Network Interface "{#PHYSICAL_NETWORK_NAME}" Total Bytes/sec - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select BytesTotalPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] 15s 1w - 365d - 0 - 3 - Bps - - - 0 - 0 - - 0 - - - - 0 - - - - - last("perf_counter[\"\Network Interface({#PNETWORK})\Bytes Received/sec\"]")*(-1)+ last("perf_counter[\"\Network Interface({#PNETWORK})\Bytes Sent/sec\"]") - 0 Network - - - - - - Network Interface "{#PHYSICAL_NETWORK_NAME}" LinkSpeed - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select CurrentBandwidth from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] 5m 1w - 365d - 0 - 3 - B - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Network - - - - - - Network Interface "{#PHYSICAL_NETWORK_NAME}" MAC Address - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select MACAddress from win32_networkadapter where InterfaceIndex='{#PHYSICAL_NETWORK_INTERFACEINDEX}'] 5m 1w 0 - 0 - 4 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 + TEXT Network - - - - - - + + + {diff(0)}>0 + Network Interface "{#PHYSICAL_NETWORK_NAME}" MAC Address changed + AVERAGE + + Network Interface "{#PHYSICAL_NETWORK_NAME}" LinkStatus - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select NetConnectionStatus from win32_networkadapter where InterfaceIndex='{#PHYSICAL_NETWORK_INTERFACEINDEX}'] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Network @@ -3788,46 +1840,24 @@ last("perf_counter[\"\Network Interface({#PNETWORK})\Bytes Sent/sec\&q Microsoft Network Link Status - - - - - + + + {diff(0)}>0 + Network Interface "{#PHYSICAL_NETWORK_NAME}" Link Status changed + AVERAGE + + Network Interface "{#PHYSICAL_NETWORK_NAME}" Output Queue Length - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select OutputQueueLength from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - \Network Interface({#PNETWORK})\Output Queue Length “Output Queue Length is the length of the output packet queue (in packets). If this is longer than two, there are delays and the bottleneck should be found and eliminated, if possible. Since the requests are queued by the Network Driver Interface Specification (NDIS) in this implementation, this will always be 0.” https://blogs.technet.microsoft.com/yongrhee/2010/07/06/network-interface-output-queue-length-values-extremely-high/ - 0 Network @@ -3836,47 +1866,26 @@ https://blogs.technet.microsoft.com/yongrhee/2010/07/06/network-interface-output Performance - - - - - - + + + {last(#5)}>{$NETWORK_OUTPUT_QUEUE_LENGHT} + Network Interface "{#PHYSICAL_NETWORK_NAME}" Output Queue Length > {$NETWORK_OUTPUT_QUEUE_LENGHT} + WARNING + Each Network Interface has an associated output queue. Output Queue Length measures how many outbound network packets are queued. Output Queue Length of 2 or more indicates serious Network Interface bottlenecks. +When reviewing Output Queue Length, it is important to review the active Network Interface utilized. + + Network Interface "{#PHYSICAL_NETWORK_NAME}" Packets Outbound Discarded - 7 - - + ZABBIX_ACTIVE wmi.get[root\cimv2,select PacketsOutboundDiscarded from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] - 1m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - \Network Interface({#PNETWORK})\Packets Outbound Discarded Shows the number of outbound packets to be discarded even though no errors had been detected to prevent transmission. One possible reason for discarding the a packet could be to free up buffer space. https://msdn.microsoft.com/en-us/library/ms803962.aspx - 0 Network @@ -3885,125 +1894,25 @@ https://msdn.microsoft.com/en-us/library/ms803962.aspx Performance - - - - - - - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select NetConnectionStatus from win32_networkadapter where InterfaceIndex='{#PHYSICAL_NETWORK_INTERFACEINDEX}'].diff(0)}>0 - 0 - - Network Interface "{#PHYSICAL_NETWORK_NAME}" Link Status changed - 0 - - - 0 - 3 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select MACAddress from win32_networkadapter where InterfaceIndex='{#PHYSICAL_NETWORK_INTERFACEINDEX}'].diff(0)}>0 - 0 - - Network Interface "{#PHYSICAL_NETWORK_NAME}" MAC Address changed - 0 - - - 0 - 3 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select OutputQueueLength from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'].last(#5)}>{$NETWORK_OUTPUT_QUEUE_LENGHT} - 0 - - Network Interface "{#PHYSICAL_NETWORK_NAME}" Output Queue Length > {$NETWORK_OUTPUT_QUEUE_LENGHT} - 0 - - - 0 - 2 - Each Network Interface has an associated output queue. Output Queue Length measures how many outbound network packets are queued. Output Queue Length of 2 or more indicates serious Network Interface bottlenecks. -When reviewing Output Queue Length, it is important to review the active Network Interface utilized. - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select PacketsOutboundDiscarded from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'].last(#1)}>{$NETWORK_OUTPUT_DISCARDED} - 0 - - Network Interface "{#PHYSICAL_NETWORK_NAME}" Packets Outbound Discarded >{$NETWORK_OUTPUT_DISCARDED} - 0 - - - 0 - 1 - A healthy Server deployment should not be consistently discarding network packets on a managed network. The threshold means that packets are being discarded and the server administrator should be aware and understand why that is occurring. If the Network Interface is too busy, requests may not be getting processed quickly enough and become discarded. + + + {last(#1)}>{$NETWORK_OUTPUT_DISCARDED} + Network Interface "{#PHYSICAL_NETWORK_NAME}" Packets Outbound Discarded >{$NETWORK_OUTPUT_DISCARDED} + INFO + A healthy Server deployment should not be consistently discarding network packets on a managed network. The threshold means that packets are being discarded and the server administrator should be aware and understand why that is occurring. If the Network Interface is too busy, requests may not be getting processed quickly enough and become discarded. It is important to note that these Performance Counters are total based. To get the value for review, you’ll need to subtract the maximum of the last sample from to the maximum of the first sample (we’ve done this for you in the Analysis and Definitions Workbook), leaving you with the delta of how many packets have been discarded during your data collection. If you see that the value is not zero, but is the same for average and max, it hasn’t moved in the dataset. Therefore, it could be contributed to a change in the environment that was expected (e.g. switch firmware ugrade) and be a non-issue. Depending on the Network Interface manufacture, the receive and transmit buffers may be configurable. If they are, set them to an automatic setting. Should that not be an option, consider doubling the current value and re-evaluate. - 0 - 0 - - - - - {Template OS Windows Active:os.windows.active.networkinterface.utilization.percent[{#PHYSICAL_NETWORK_INTERFACEINDEX}].avg(6h)}>{$NETWORK_MAX_UTILIZE} - 1 - {Template OS Windows Active:os.windows.active.networkinterface.utilization.percent[{#PHYSICAL_NETWORK_INTERFACEINDEX}].avg(6h)}<{$NETWORK_MAX_UTILIZE} - Network Interface "{#PHYSICAL_NETWORK_NAME}" utilize > {$NETWORK_MAX_UTILIZE}% - 0 - - - 0 - 2 - - 0 - 0 - - - - + + + + Network traffic on "{#PHYSICAL_NETWORK_NAME}" - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 5 + GRADIENT_LINE 0000EE - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select BytesSentPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] @@ -4011,11 +1920,8 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 1 - 5 + GRADIENT_LINE EE0000 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select BytesReceivedPersec from Win32_PerfFormattedData_Tcpip_NetworkInterface where Name='{#PHYSICAL_NETWORK_NAME_PERF}'] @@ -4023,11 +1929,8 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 2 - 0 FFFF66 - 1 - 2 - 0 + RIGHT Template OS Windows Active os.windows.active.networkinterface.utilization.percent[{#PHYSICAL_NETWORK_INTERFACEINDEX}] @@ -4037,29 +1940,11 @@ Depending on the Network Interface manufacture, the receive and transmit buffers Network utilization % "{#PHYSICAL_NETWORK_NAME}" - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 1 - 0 - 0 + FIXED - 0 - 1 + FILLED_REGION 2774A4 - 0 - 2 - 0 Template OS Windows Active os.windows.active.networkinterface.utilization.percent[{#PHYSICAL_NETWORK_INTERFACEINDEX}] @@ -4068,47 +1953,22 @@ Depending on the Network Interface manufacture, the receive and transmit buffers - - Windows service discovery - 7 - - + ZABBIX_ACTIVE service.discovery 1d - 0 - - - - 0 - 0 - - 0 - - - - 0 - - - - - - 0 - {#SERVICE.NAME} @Windows service names for discovery - 8 A {#SERVICE.STARTUPNAME} @Windows service startup states for discovery - 8 B @@ -4118,77 +1978,35 @@ Depending on the Network Interface manufacture, the receive and transmit buffers State of service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) - 7 - - + ZABBIX_ACTIVE service.info[{#SERVICE.NAME},state] 5m 1w - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - - 0 Services - - Windows service state - - - - Startup {#SERVICE.STARTUPNAME} services - + + Windows service state + + + + {min(#3)}<>0 + Service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME}) + DISABLED + AVERAGE + + - - - {Template OS Windows Active:service.info[{#SERVICE.NAME},state].min(#3)}<>0 - 0 - - Service "{#SERVICE.NAME}" ({#SERVICE.DISPLAYNAME}) is not running (startup type {#SERVICE.STARTUPNAME}) - 0 - - - 1 - 3 - - 0 - 0 - - - - - - - - {$CPU_MAX_LOAD} @@ -4239,7 +2057,6 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 180d - System performance detailed @@ -4248,6 +2065,11 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 + + + CPU + Template OS Windows Active + 400 100 0 @@ -4257,19 +2079,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - CPU - Template OS Windows Active - - 3 + + 3 0 + + + Memory + Template OS Windows Active + 400 100 1 @@ -4279,19 +2101,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Memory - Template OS Windows Active - - 3 + + 3 20 + + + Network traffic on "{#PHYSICAL_NETWORK_NAME}" + Template OS Windows Active + 400 100 0 @@ -4301,19 +2123,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Network traffic on "{#PHYSICAL_NETWORK_NAME}" - Template OS Windows Active - - 3 + + 3 20 + + + Physical Disk "{#PHYSICAL_DISK}" ops/second + Template OS Windows Active + 250 100 0 @@ -4323,19 +2145,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Physical Disk "{#PHYSICAL_DISK}" ops/second - Template OS Windows Active - - 5 + + 5 20 + + + Physical Disk "{#PHYSICAL_DISK}" Disk bytes/second + Template OS Windows Active + 250 100 0 @@ -4345,19 +2167,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Physical Disk "{#PHYSICAL_DISK}" Disk bytes/second - Template OS Windows Active - - 5 + + 5 20 + + + Physical Disk "{#PHYSICAL_DISK}" overview + Template OS Windows Active + 500 100 0 @@ -4367,16 +2189,11 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Physical Disk "{#PHYSICAL_DISK}" overview - Template OS Windows Active - - 3 + + 3 @@ -4387,6 +2204,11 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 + + + CPU + Template OS Windows Active + 400 100 0 @@ -4396,19 +2218,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - CPU - Template OS Windows Active - - 3 + + 3 0 + + + Memory + Template OS Windows Active + 400 100 1 @@ -4418,19 +2240,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Memory - Template OS Windows Active - - 3 + + 3 20 + + + Physical Disk "{#PHYSICAL_DISK}" overview + Template OS Windows Active + 500 100 0 @@ -4440,19 +2262,19 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Physical Disk "{#PHYSICAL_DISK}" overview - Template OS Windows Active - - 3 + + 3 20 + + + Network traffic on "{#PHYSICAL_NETWORK_NAME}" + Template OS Windows Active + 400 100 1 @@ -4462,16 +2284,11 @@ Depending on the Network Interface manufacture, the receive and transmit buffers 0 0 0 - - 0 0 - - Network traffic on "{#PHYSICAL_NETWORK_NAME}" - Template OS Windows Active - - 3 + + 3 @@ -4479,280 +2296,21 @@ Depending on the Network Interface manufacture, the receive and transmit buffers - - {Template OS Windows Active:system.uptime.change(0)}<0 - 0 - - "{HOST.NAME}" has just been restarted - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template OS Windows Active:os.windows.inventory.firewallstatus.diff(0)}>0 - 0 - - Firewall status has just been changed - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template OS Windows Active:system.uname.diff(0)}>0 - 0 - - Host information was changed on "{HOST.NAME}" - 0 - - - 0 - 3 - - 0 - 0 - - - - - {Template OS Windows Active:os.windows.inventory.PendingReboot.last()}=1 - 1 - {Template OS Windows Active:os.windows.inventory.PendingReboot.last()}=0 - Operation System pending reboot - 0 - - - 0 - 1 - - 0 - 1 - - - {Template OS Windows Active:wmi.get[root\cimv2,SELECT CommittedBytes FROM Win32_PerfRawData_PerfOS_Memory].avg(10m)} >1.5 * {Template OS Windows Active:wmi.get[root\cimv2,select TotalPhysicalMemory from Win32_ComputerSystem].last()} - 1 + RECOVERY_EXPRESSION {Template OS Windows Active:wmi.get[root\cimv2,SELECT CommittedBytes FROM Win32_PerfRawData_PerfOS_Memory].avg(10m)} < {Template OS Windows Active:wmi.get[root\cimv2,select TotalPhysicalMemory from Win32_ComputerSystem].last()} Physical memory commited bytes over than total memory - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select FreePhysicalMemory from Win32_OperatingSystem].avg(30m)}<{$PHYSICAL_MEMORY_MIN_FREE} - 1 - {Template OS Windows Active:wmi.get[root\cimv2,select FreePhysicalMemory from Win32_OperatingSystem].avg(30m)}>{$PHYSICAL_MEMORY_MIN_FREE} - Physical memory free < {$PHYSICAL_MEMORY_MIN_FREE} - 0 - - - 0 - 1 - Available Megabytes is different from most other KHIs in the regard that you need to pay attention to two things: -• The trending direction is reversed (i.e. higher is better) -• Track the minimum and average, not maximum. -Most likely, the server doesn’t have enough RAM to fulfil demand. To verify, either use Task Manager and look for unaccounted processes or use the Private Bytes (in process counter object) to see identify the culprit. -Lastly, if you discover SQL Server Express on Front-end Servers is the consumer of this memory verify that Lock Pages in Memory is disabled. When configured, Windows Memory Manager cannot trim SQL Servers Working Set for other processes while that memory is not in used. - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2, SELECT PercentUsagePeak FROM Win32_PerfFormattedData_PerfOS_PagingFile].avg(30m)}>70 - 1 - {Template OS Windows Active:wmi.get[root\cimv2, SELECT PercentUsagePeak FROM Win32_PerfFormattedData_PerfOS_PagingFile].avg(30m)} -<60 - Physical memory Page File Usage > 70% - 0 - - - 0 - 1 - You could also confirm that it is on the most suitable disk, and if possible split the pagefile over two disks and thus improve access times. (Note the object here is Page File not Memory) - -Because the changes are so gradual, you are better off using this Page File % Usage counter as an alert, rather than a log. I suggest setting an alert on a limit of over 70. - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2, select PagesPersec FROM Win32_PerfFormattedData_PerfOS_Memory].avg(30m)}>1000 - 0 - - Physical memory pages per sec > 1000 - 0 - - - 0 - 1 - If the value is greater than 1,000, as a result of excessive paging, there may be a memory leak. - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,SELECT FreeSystemPageTableEntries FROM Win32_PerfFormattedData_PerfOS_Memory].last()}<5000 - 0 - - Physical memory Page Table Entries < 5000 - 0 - - - 0 - 1 - If the number is less than 5,000, there may well be a memory leak. - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,SELECT PoolNonpagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory].avg(30m)}>175M - 0 - - Physical memory Pool Non-paged > 175 Mb - 0 - - - 1 - 2 - There is a possible memory leak if the value is greater than 175MB (or 100MB with the /3GB switch). - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,SELECT PoolPagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory].avg(30m)}>250M - 0 - - Physical memory Pool paged > 250 Mb - 0 - - - 1 - 2 - This is an area of system memory used for objects that can be written to disk when they are not being used. There may be a memory leak if this value is greater than 250MB (or 170MB with the /3GB switch). - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,SELECT PercentInterruptTime FROM Win32_PerfFormattedData_PerfOS_Processor].avg(1h)}>15 - 1 - {Template OS Windows Active:wmi.get[root\cimv2,SELECT PercentInterruptTime FROM Win32_PerfFormattedData_PerfOS_Processor].avg(1h)}<10 - Processor Interrupt Time > 15% - 0 - - - 0 - 2 - possible hardware issue - 0 - 0 - - - - - {Template OS Windows Active:wmi.get[root\cimv2,select PercentProcessorTime from Win32_PerfformattedData_PerfOS_Processor where Name='_Total'].avg(1h)}>{$CPU_MAX_LOAD} - 1 - {Template OS Windows Active:wmi.get[root\cimv2,select PercentProcessorTime from Win32_PerfformattedData_PerfOS_Processor where Name='_Total'].avg(1h)}<{$CPU_MAX_LOAD} - Processor load > {$CPU_MAX_LOAD}% - 0 - - - 0 - 3 - If % Processor Time is 80% or higher, the first path to explore is determining if there is a legitimate need to increase CPU capacity of your Lync Servers. Windows Server 2008 introduced new Power Management settings (which are on by default) to help reduce carbon footprint produced from Servers by consuming less electricity by parking CPU cores that are lightly utilized by moving those tasks to other cores. What this means is that high Processor Time values no longer automatically mean the physical CPUs are approaching their hardware limits - 0 - 0 - - - - - {Template OS Windows Active:os.windows.inventory.OSDaysFromLatestUpdatesInstalled.last()}>{$WINDOWS_UPDATE_LAST_INSTALL_INFO} and {Template OS Windows Active:os.windows.inventory.OSDaysFromLatestUpdatesInstalled.last()}<{$WINDOWS_UPDATE_LAST_INSTALL_WARN} - 0 - - Windows updates installed more than 90 days ago - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template OS Windows Active:os.windows.inventory.OSDaysFromLatestUpdatesInstalled.last()}>{$WINDOWS_UPDATE_LAST_INSTALL_WARN} - 0 - - Windows updates installed more than 180 days ago - 0 - - - 0 - 2 - - 0 - 0 - - + INFO CPU - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - 0 - 5 + GRADIENT_LINE 00EE00 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select PercentProcessorTime from Win32_PerfformattedData_PerfOS_Processor where Name='_Total'] @@ -4760,11 +2318,8 @@ Because the changes are so gradual, you are better off using this Page File % Us 1 - 5 + GRADIENT_LINE F63100 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT PercentInterruptTime FROM Win32_PerfFormattedData_PerfOS_Processor] @@ -4772,11 +2327,8 @@ Because the changes are so gradual, you are better off using this Page File % Us 2 - 5 + GRADIENT_LINE 0000EE - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT PercentUserTime FROM Win32_PerfFormattedData_PerfOS_Processor] @@ -4784,11 +2336,8 @@ Because the changes are so gradual, you are better off using this Page File % Us 3 - 5 + GRADIENT_LINE A54F10 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2, SELECT PercentPrivilegedTime FROM Win32_PerfFormattedData_PerfOS_Processor] @@ -4798,32 +2347,16 @@ Because the changes are so gradual, you are better off using this Page File % Us Memory - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 1 - 1 - 0 - 0.0000 - 0.0000 - 0 - 2 - 0 + STACKED + ITEM Template OS Windows Active wmi.get[root\cimv2,select TotalPhysicalMemory from Win32_ComputerSystem] - 0 - 1 + FILLED_REGION FF3333 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT CommittedBytes FROM Win32_PerfRawData_PerfOS_Memory] @@ -4831,11 +2364,8 @@ Because the changes are so gradual, you are better off using this Page File % Us 1 - 1 + FILLED_REGION 3333FF - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT PoolNonpagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory] @@ -4843,11 +2373,8 @@ Because the changes are so gradual, you are better off using this Page File % Us 2 - 1 + FILLED_REGION FFFF33 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT PoolPagedBytes FROM Win32_PerfFormattedData_PerfOS_Memory] @@ -4855,11 +2382,7 @@ Because the changes are so gradual, you are better off using this Page File % Us 3 - 0 33FF33 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,select FreePhysicalMemory from Win32_OperatingSystem] @@ -4867,11 +2390,7 @@ Because the changes are so gradual, you are better off using this Page File % Us 4 - 0 FC6EA3 - 0 - 2 - 0 Template OS Windows Active wmi.get[root\cimv2,SELECT CacheBytes FROM Win32_PerfFormattedData_PerfOS_Memory]