[ZBX-24656] Wrong Trigger prototype in windows_agent_active Created: 2024 Jun 13  Updated: 2024 Jun 19  Resolved: 2024 Jun 19

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Templates (T)
Affects Version/s: 6.4.15
Fix Version/s: None

Type: Problem report Priority: Major
Reporter: Alexander Assignee: Aleksejs Abrosimovs
Resolution: Won't Do Votes: 0
Labels: Windows, disk, idle
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Story Points: 0.5

 Description   

Steps to reproduce:

Wrong trigger prototype 

{#DEVNAME}

: Disk is overloaded

 

Using min(/Windows by Zabbix agent active/perf_counter_en"\PhysicalDisk({#DEVNAME})% Idle Time",60,15m)>{$VFS.DEV.UTIL.MAX.WARN} 

but 

Physical Disk% Idle Time

The % Idle Time counter is the percent of time that a disk was idle during the sampling interval. An idle time of less than 20 percent indicates that the disk may be overloaded.

 

So, the right body should be like this:

max(/Windows by Zabbix agent active/perf_counter_en"\PhysicalDisk({#DEVNAME})&#37; Idle Time",60,15m)<{$VFS.DEV.IDLE.MIN.WARN}

Where {$VFS.DEV.IDLE.MIN.WARN} = 20 



 Comments   
Comment by Aleksejs Abrosimovs [ 2024 Jun 19 ]

Hello.

 

"{#DEVNAME}: Disk is overloaded" trigger is using "{#DEVNAME}: Disk utilization by idle time" item's value, which is getting the disk utilization time percentage, calculated from idle time counter, but not the idle time percentage itself. 
Misleading could have been caused by the fact that the item 
"{#DEVNAME}: Disk utilization by idle time" has preprocessing with mentioned above calculations, which is not shown in the trigger expression.
As a conclusion, all components (the trigger, the item, the macros) correspond with each other are all right.
The item and its trigger are about utilization, not about idle time.

 

Hope this will help.

Comment by Alexander [ 2024 Jun 19 ]

You are not right in your conclusion.
Trigger uses directly Windows perfmon metric Disk %Idle Time.
This metric shows how long the disk is idle. A description of the metric can be found in open sources. The longer the disk is idle, the less loaded it is. Your trigger is triggered when the idle value is more than 95%, that is, when the disk is almost not in use.
It should trigger on the contrary when the idle disk is less than 20%.

We analyzed the behavior of the trigger on a real infrastructure, tracking the real load on hosts and disks.
The trigger was triggered falsely on idle disks.
Based on our analysis, the trigger prototype should look exactly as I suggested.

Comment by Aleksejs Abrosimovs [ 2024 Jun 19 ]

The item "{#DEVNAME}: Disk utilization by idle time" gets idle value by using "perf_counter_en"\PhysicalDisk({#DEVNAME})% Idle Time",60" function/command and then transforms it to utilization value in preprocessing by using JavaScript: return (100 - value). So the resulted value is the opposite of idle time. And that value is stored in the database and is used by the trigger. Trigger by itself uses values received by items only, triggers do not get values to its expressions other way, even if it looks like otherwise. For example, "perf_counter_en"\PhysicalDisk({#DEVNAME})&#37; Idle Time",60" in the trigger expression is a literal string (the key, which value will be used), but not the command/function itself to evaluate. This is the place where the confusion could have been originated.

The changes you suggested will work correctly (if preprocessing will be removed too), as well as the current template works correctly. The difference is that your option operates with the idle time percentage, while the current template operates with the opposite - utilization time percentage.

Hope this will clear things up.

You can also check descriptions and preprocessing steps here:
https://www.zabbix.com/integrations/windows

Generated at Wed Jul 16 11:11:42 EEST 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.