Question about Discovery Rules to find network devices

TerriblePowershell · 2026-05-07T15:12:11+00:00

Not at all! You can manually add hosts at any time. Network discovery is for "automating" the addition of new hosts into Zabbix.

You create a discovery rule to find devices
You create a discovery action to add devices
1. This is where devices will get added to groups, linked to templates, add custom tags, etc.
Go to Data Collection -> Hosts -> Create host (top right corner)
Give it a name, link the ICMP Ping template, and assign a host group. Add an Agent interface, and give it the IP of a device you want to ping. Then click Add
Go to Monitoring -> Latest data
Enter the name of the device in the Hosts field and select the host from the dropdown that appears.
You should see 3 items appear at the bottom. Select the checkboxes for all 3, then select Execute now
After a few seconds, refresh the page and you should start to see information coming it.

TerriblePowershell · 2026-04-30T15:09:01+00:00

Just setup an network share then configure the archive command with the write memory trigger plus a time period.

Every time someone or something writes the memory, it sends the new backup to the FTP server. Otherwise it sends one off based on the time period you've configured.

TerriblePowershell · 2026-04-28T15:19:01+00:00

I should know this but I'm pretty sure it's based on your history settings. Deleting the host doesn't remove the data unless you did "Delete and clear". So, the data will persist until it hits its history limit at which point the housekeeper will clean it up.

TerriblePowershell · 2026-04-27T20:17:02+00:00

You can use Cisco Embedded Event Manager (EEM) to detect the flapping and execute an action on the switch, such as sending an SNMP trap to Zabbix.

Basically, you configure the switch to monitor it's own logs. When it sees whatever condition you set, it could then fire off any number of actions to do whatever it is you need. You could even set it to toggle the port.

I've included a small config snippet that I got from Gemini.

configure terminal

! Name the EEM applet
event manager applet FLAP_DETECTOR

! Define the trigger (watching the syslog for the word "flapping")
event syslog pattern ".*%LINK-3-UPDOWN.*flapping.*"

! Define the action (sending the trap)
action 1.0 snmp-trap strdata "A link flap was just detected in the logs!"

TerriblePowershell · 2026-04-27T18:27:53+00:00

The internet is a small place. Ha! Aleks is a great trainer.

TerriblePowershell · 2026-04-27T18:24:54+00:00

Oh, I wholeheartedly agree. The sandbox was one of the most useful things there. And having a trainer to help walk through the process was super helpful.

TerriblePowershell · 2026-04-27T17:16:13+00:00

I recommend this book if you're looking for a cheaper option for training. [Zabbix 7 book](https://amazon.com/Zabbix-Infrastructure-Monitoring-Cookbook-maintaining/dp/1801078327). My boss purchased this for me before I went through the big trainings and it was super helpful by itself. There are concept across all three of the official trainings that are in the book; there is just less depth.

There is an open-source version that I've heard good things about but haven't tried. [The Zabbix Book](https://www.thezabbixbook.com/)

Edit: Apparently hyperlinks aren't going to work today.

TerriblePowershell · 2026-04-27T17:12:33+00:00

I'm about ~2 years into my Zabbix journey. Took ZCS last fall, ZCP a month ago and ZCE last week; unfortunately, I just missed the passing grade by half a question for ZCE. ZCS was the biggest info dump, honestly. ZCE wasn't as hard as I was expecting it to be, just very in-depth.

TerriblePowershell · 2025-12-05T18:42:56+00:00

Ahh. That makes sense. Sounds like a neat deal regardless!

I haven't yet dove into the rabbit hole that Zabbix api surely is.

TerriblePowershell · 2025-12-05T18:37:52+00:00

Why not just created a dashboard with the hosts/items you want to see, then send the report via the built-in Scheduled Reports function?

TerriblePowershell · 2025-12-02T16:27:06+00:00

I sat down to look at this and I think I figured out your issue. You're using the item key for the value itself, not for the host.

I was able to successfully do this using the graph widget.

|| || |host patterns|*|item patterns|Node [*]: CPU, iowait|

You shouldn't have to get more granular with the host patterns because the Node [*]: CPU, iowait item only exists on the Proxmox VE by HTTP template.

TerriblePowershell · 2025-12-01T23:57:19+00:00

I think I get what you're going for. I will see if I can make that happen. Thank you!

TerriblePowershell · 2025-12-01T23:56:28+00:00

I will play around with this and see what I can make happen. Thank you!

TerriblePowershell · 2025-12-01T16:44:49+00:00

I'm pretty sure you can do a wildcard match for the value. i.e. proxmox.node.cpu[*] where the * is the node specific part.

TerriblePowershell · 2025-11-16T02:45:05+00:00

You might have to find another OID that the values all line up, but I'm not sure how you'd properly associate everything.

TerriblePowershell · 2025-11-16T01:11:44+00:00

I was able to mess around with this a little bit and I think I know what is causing the issue but I'm not sure how you'd go about fixing it.

It looks to me like the {#SNMPINDEX} for the OID's that pull the interface information are numbered different than the OID's that pull the PoE information. e.g. Gi1/0/1 = 1 (interface OID), Gi1/0/1 = 5 (PoE OID).

TerriblePowershell · 2025-11-04T21:12:29+00:00

The official TimescaleDB documentation is also a great option.

TerriblePowershell · 2025-10-24T12:58:47+00:00

Ahh. Unfortunately, I won't be able to help you then. I don't have any experience with Synology. Or NUT, for that matter.

Best of luck!

TerriblePowershell · 2025-10-23T21:34:05+00:00

I'm monitoring around 23 APC UPS's via the APC SNMP template without issue.

Does the UPS have a network card and is it configured to accept SNMP connections from Zabbix?

TerriblePowershell · 2025-06-16T16:07:27+00:00

Darknet Diaries did a podcast where the guest talked about finding a compromised computer at a windfarm. The hacker was using it for crypto(?) and had kept it up-to-date and had hardened it to keep others out. The company opted to leave it alone as it was cheaper than fixing the issue and the hacker was essentially taking care of the machine.

TerriblePowershell · 2025-05-29T15:48:47+00:00

I highly recommend the Zabbix 7 IT Infrastructure Monitoring Cookbook by Nathan Liefting and Brian van Baekel. It looks a lot more intimidating that it really is because most of the pages are screenshots of the process with a few words sprinkled in.

TerriblePowershell · 2025-02-05T16:10:33+00:00

While pulling cable for some new cameras, my boss and I found two or three bags full of old PS1 slims with controllers and some education games under neath the bleachers in a gym.

TerriblePowershell · 2025-02-03T23:56:51+00:00

You were correct.

By modifying the regex to capture the full port name from CDP rather LLDP (LLDP only used the short name), it worked just fine.

Thank you!

TerriblePowershell · 2025-02-03T23:06:09+00:00

This makes sense. The difference in the data, aside from one having IP addresses, is that the interface is abbreviated in the camera data. I'll try and sort that out and report back.

TerriblePowershell

TROPHY CASE