Introduction

Information about the Zabbix Database – Version 1.8.1 – June, 2010 – by ChinaNetCloud
Sorry for format – this is printed from our Wiki

Hosts
The actual servers and devices

Status
• 0 - Active
• 1 - Disabled
• 3 - Template
/* Check for servers not in any group */
SELECT *
FROM hosts where status <> 3 /* Not template */ and not exists (select * from
hosts_groups where hosts.hostid = hosts_groups.hostid)

mysql> describe hosts;

+--------------------+---------------------+------+-----+-----------+-------+
| Field | Type | Null | Key | Default | Extra |
+--------------------+---------------------+------+-----+-----------+-------+
| hostid | bigint(20) unsigned | NO | PRI | 0 | |
| proxy_hostid | bigint(20) unsigned | NO | MUL | 0 | |
| host | varchar(64) | NO | MUL | | |
| dns | varchar(64) | NO | | | |
| useip | int(11) | NO | | 1 | |
| ip | varchar(39) | NO | | 127.0.0.1 | |
| port | int(11) | NO | | 10050 | |
| status | int(11) | NO | MUL | 0 | |
| disable_until | int(11) | NO | | 0 | |
| error | varchar(128) | NO | | | |
| available | int(11) | NO | | 0 | |
| errors_from | int(11) | NO | | 0 | |
| lastaccess | int(11) | NO | | 0 | |
| inbytes | bigint(20) unsigned | NO | | 0 | |
| outbytes | bigint(20) unsigned | NO | | 0 | |
| useipmi | int(11) | NO | | 0 | |
| ipmi_port | int(11) | NO | | 623 | |
| ipmi_authtype | int(11) | NO | | 0 | |
| ipmi_privilege | int(11) | NO | | 2 | |
| ipmi_username | varchar(16) | NO | | | |
| ipmi_password | varchar(20) | NO | | | |
| ipmi_disable_until | int(11) | NO | | 0 | |
| ipmi_available | int(11) | NO | | 0 | |
| snmp_disable_until | int(11) | NO | | 0 | |
| snmp_available | int(11) | NO | | 0 | |
| maintenanceid | bigint(20) unsigned | NO | | 0 | |

By ChinaNetCloud – www.ChinaNetCloud 1/9 Zabbix DB.odt

| maintenance_status | int(11) | NO | | 0 | |
| maintenance_type | int(11) | NO | | 0 | |
| maintenance_from | int(11) | NO | | 0 | |
| ipmi_ip | varchar(64) | NO | | 127.0.0.1 | |
| ipmi_errors_from | int(11) | NO | | 0 | |
| snmp_errors_from | int(11) | NO | | 0 | |
| ipmi_error | varchar(128) | NO | | | |
| snmp_error | varchar(128) | NO | | | |
+--------------------+---------------------+------+-----+-----------+-------+

Items
TemplateId
• Points to parent ITEM, whose hostid points to the TEMPLATE
• So we know the parent item directly via template id and can compare/join to check for
differences

Types
• 0 = Agent
• 1 = ICMP ?
• 2=?
• 3 = Simple checks ?
• 4 = SNMP ?
• 5 = Zabbix internal ?
• 9 = Web checks
• 12 = IPMI ?

Status
• 0 = Active
• 1 = Disabled
• 3 = Error (error column has error)
mysql> select count(*), type from items group by type;
+----------+------+
| count(*) | type |
+----------+------+
| 41825 | 0 |
| 674 | 1 |
| 2421 | 2 |
| 18 | 3 |
| 4878 | 4 |
| 8 | 5 |
| 438 | 9 |
| 34 | 12 |
| 1 | 15 |

By ChinaNetCloud – www.ChinaNetCloud 2/9 Zabbix DB.odt

+----------+------+

• Get active items for agents and active hosts, that have no template
select count(*) from items i join hosts h on i.hostid = h.hostid where i.status =
0 and h.status = 0 and i.templateid = 0 and i.type = 0;

• Get items whose Interval (delay), history, trends times do not match the item in their template
item
select i.itemid, h.host, t.host, ip.delay, i.delay, ip.history, i.history,
ip.trends, i.trends, i.description, i.key_
from hosts h join items i on h.hostid = i.hostid /* real host */
join items ip on i.templateid = ip.itemid /* items parent from template */
join hosts t on ip.hostid = t.hostid /* template */
where i.status = 0
and ip.status = 0
and i.type = 0 /* Agent item */
and h.status = 0 /* Active host */
and t.status = 3 /* Template */
and i.templateid <> 0 /* Item has a template */
and (i.delay <> ip.delay /* Mismatch with template */
or i.history <> ip.history
or i.trends <> i.trends)

• Get number of items for each Interval/delay, for active items and hosts
select count(*), delay
from items join hosts on items.hostid = hosts.hostid
where items.type = 0 and items.status = 0 and hosts.status = 0 group by delay;

select count(*), history, trends

from items join hosts on items.hostid = hosts.hostid
where items.type = 0 and items.status = 0 and hosts.status = 0
group by history, trends;

mysql> describe items;

+-----------------------+---------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-----------------------+---------------------+------+-----+---------+-------+
| itemid | bigint(20) unsigned | NO | PRI | 0 | |
| type | int(11) | NO | | 0 | |
| snmp_community | varchar(64) | NO | | | |
| snmp_oid | varchar(255) | NO | | | |
| snmp_port | int(11) | NO | | 161 | |
| hostid | bigint(20) unsigned | NO | MUL | 0 | |
| description | varchar(255) | NO | | | |
| key_ | varchar(255) | NO | | | |
| delay | int(11) | NO | | 0 | |
| history | int(11) | NO | | 90 | |
| trends | int(11) | NO | | 365 | |
| lastvalue | varchar(255) | YES | | NULL | |

By ChinaNetCloud – www.ChinaNetCloud 3/9 Zabbix DB.odt

| lastclock | int(11) | YES | | NULL | |
| prevvalue | varchar(255) | YES | | NULL | |
| status | int(11) | NO | MUL | 0 | |
| value_type | int(11) | NO | | 0 | |
| trapper_hosts | varchar(255) | NO | | | |
| units | varchar(10) | NO | | | |
| multiplier | int(11) | NO | | 0 | |
| delta | int(11) | NO | | 0 | |
| prevorgvalue | varchar(255) | YES | | NULL | |
| snmpv3_securityname | varchar(64) | NO | | | |
| snmpv3_securitylevel | int(11) | NO | | 0 | |
| snmpv3_authpassphrase | varchar(64) | NO | | | |
| snmpv3_privpassphrase | varchar(64) | NO | | | |
| formula | varchar(255) | NO | | 1 | |
| error | varchar(128) | NO | | | |
| lastlogsize | int(11) | NO | | 0 | |
| logtimefmt | varchar(64) | NO | | | |
| templateid | bigint(20) unsigned | NO | MUL | 0 | |
| valuemapid | bigint(20) unsigned | NO | | 0 | |
| delay_flex | varchar(255) | NO | | | |
| params | text | NO | | NULL | |
| ipmi_sensor | varchar(128) | NO | | | |
| data_type | int(11) | NO | | 0 | |
| authtype | int(11) | NO | | 0 | |
| username | varchar(64) | NO | | | |
| password | varchar(64) | NO | | | |
| publickey | varchar(64) | NO | | | |
| privatekey | varchar(64) | NO | | | |
| mtime | int(11) | NO | | 0 | |
+-----------------------+---------------------+------+-----+---------+-------+

Triggers
Status
0 - Active
1 - Disabled

URL
• URL - URL shown in UI

Error
• error - Error text, meaning unclear, as not tied to status

Type
• type - ? Always 0

By ChinaNetCloud – www.ChinaNetCloud 4/9 Zabbix DB.odt

Value
0 - Normal ? 1 - Not sure ? 2 - Not sure ?
• templateid - Important, linked parent trigger FROM template (not template itself, so
TEMPLATED object, not template)
• 0 - No parent template, host-level
• ID - Template ID
Hooking Template to Items and Hosts uses functions
• To get a trigger's host, the key relation is functions.triggerid points to containing trigger
• And function points to item which points to host
select h.status, h.host, t.description, t.url
from hosts h, items i, functions f, triggers t
where h.hostid = i.hostid and i.itemid = f.itemid and f.triggerid = t.triggerid
and h.status in (0,3)
and t.status = 0
and t.templateid = 0
and t.url not like '%tiki%'
order by h.status, h.host, t.description

• Get a trigger's details or all triggers info

• Note a trigger can have multiple functions, that can use items from multiple hosts
select t.triggerid, h.host, f.functionid, f.function, f.parameter, t.expression,
i.description, i.key_, t.description, i.itemid
from triggers t
join functions f on t.triggerid = f.triggerid
join items i on f.itemid = i.itemid
join hosts h on i.hostid = h.hostid
where t.status = 0
and t.templateid <> 0
and t.triggerid = 37580 /* Remove for all triggers */
order by t.triggerid desc
limit 50

• In theory this will show triggers that have 2+ hosts in their functions
select tz.triggerid, (select count(distinct h.hostid)
from triggers t1 join functions f on t1.triggerid = f.triggerid
join items i on f.itemid = i.itemid join hosts h on i.hostid = h.hostid
where t1.triggerid = tz.triggerid) cnt_diff_hosts
from triggers tz
where tz.status = 0
and tz.templateid <> 0
order by cnt_diff_hosts desc
limit 10

• Find triggers with different function parameters than their templates

• Probably impossible to create such data, as you can't edit a trigger on a host if it has a
template
select t.triggerid, pf.triggerid, h.host, f.parameter, pf.parameter, f.function,

By ChinaNetCloud – www.ChinaNetCloud 5/9 Zabbix DB.odt

t.expression
from triggers t join functions f on t.triggerid = f.triggerid join items i on
f.itemid = i.itemid join hosts h on i.hostid = h.hostid
join triggers pt on t.templateid = pt.triggerid join functions pf on pf.triggerid
= pt.triggerid
where t.templateid <> 0 /* Has a trigger */
and t.status = 0 /* Active */
and i.type = 0 /* Agent item */
and h.status = 0 /* Active host */
and f.parameter <> pf.parameter /* Func param <> Template func param */
and f.function <> 'regexp' /* Skip regex for disk space and other things,
including some woyo */

• Find triggers that don't match their parents from a template; only for single item expressions
right now
• All together, show main local trigger and templated trigger:
select t.triggerid, (select t2.triggerid
from triggers t2 join functions f2 on t2.triggerid = f2.triggerid
join items i2 on f2.itemid = i2.itemid join hosts h2 on i2.hostid = h2.hostid
where t.triggerid <> t2.triggerid /* Don't find self */
and (h.hostid = h2.hostid /* Match on hosts */
and i.itemid = i2.itemid) /* Match on items */
/* Differneces were are looking for */
/* Expression mismatch */
and (right(t.expression, length(t.expression) - INSTR(t.expression, '}') )
<> right(t2.expression, length(t2.expression) - INSTR(t2.expression, '}') )
OR /* Parameter mismatch - usually for time, # of samples, etc. */
f.parameter <> f2.parameter)
) trig2,
h.host, t.expression, f.function, f.parameter,
i.description, i.key_, t.description, i.itemid,t.status, h.status, t.templateid
from triggers t join functions f on t.triggerid = f.triggerid
join items i on f.itemid = i.itemid join hosts h on i.hostid = h.hostid
where
t.status = 0 /* Active */
and h.status = 0 /* For a host, not a template */
and t.templateid = 0 /* Not from template */
/* Can't have two } in expression; too complex */
and instr(right(t.expression, length(t.expression) - INSTR(t.expression, '}')),
'}') = 0
and exists
(select *
from triggers t2 join functions f2 on t2.triggerid = f2.triggerid
join items i2 on f2.itemid = i2.itemid join hosts h2 on i2.hostid = h2.hostid
where
t2.status = 1 /* Disabled, since it was cloned */
and t2.templateid <> 0 /* From a template */
/* Matches */
and (h.hostid = h2.hostid /* Match on hosts */
and i.itemid = i2.itemid) /* Match on items */
/* Differneces were are looking for */
/* Expression mismatch */
and (right(t.expression, length(t.expression) - INSTR(t.expression, '}') )
<> right(t2.expression, length(t2.expression) - INSTR(t2.expression, '}') )

By ChinaNetCloud – www.ChinaNetCloud 6/9 Zabbix DB.odt

OR
/* Parameter mismatch */
f.parameter <> f2.parameter)
)
limit 10

• List all triggers without templates, so are connected to just one host
select t.triggerid, h.host, f.functionid, f.function, f.parameter, t.expression,
i.description, i.key_, t.description, i.itemid
from triggers t
join functions f on t.triggerid = f.triggerid
join items i on f.itemid = i.itemid
join hosts h on i.hostid = h.hostid
where t.status = 0
and t.templateid = 0 /* No template */
order by t.triggerid desc

mysql> describe triggers;

+-------------+---------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+-------------+---------------------+------+-----+---------+-------+
| triggerid | bigint(20) unsigned | NO | PRI | 0 | |
| expression | varchar(255) | NO | | | |
| description | varchar(255) | NO | | | |
| url | varchar(255) | NO | | | |
| status | int(11) | NO | MUL | 0 | |
| value | int(11) | NO | MUL | 0 | |
| priority | int(11) | NO | | 0 | |
| lastchange | int(11) | NO | | 0 | |
| dep_level | int(11) | NO | | 0 | |
| comments | blob | NO | | NULL | |
| error | varchar(128) | NO | | | |
| templateid | bigint(20) unsigned | NO | | 0 | |
| type | int(11) | NO | | 0 | |
+-------------+---------------------+------+-----+---------+-------+

Trigger URL Checks

select h.status, h.host, t.description, t.url
from hosts h, items i, functions f, triggers t
where h.hostid = i.hostid and i.itemid = f.itemid and f.triggerid = t.triggerid
and h.status in (0,3) /* Active & Triggers */
and t.status = 0 /* Active */
and t.templateid = 0 /* No parent */
and t.url not like '%tiki%' /* Special not old wiki */
order by h.status, h.host, t.description

By ChinaNetCloud – www.ChinaNetCloud 7/9 Zabbix DB.odt

Web Check Queries
/* Get all web steps that are enabled*/
select hs.* from httpstep hs, httptest ht
where hs.httptestid = ht.httptestid
and ht.status = 0 /* Enabled */

/* Get all web steps that have blank Required text*/

select hs.* from httpstep hs, httptest ht
where hs.httptestid = ht.httptestid
and ht.status = 0 /* Enabled */
and length(required) < 2 /* Allows 'ok' */

/* Get all web steps with short or long timeouts */

select hs.* from httpstep hs, httptest ht
where hs.httptestid = ht.httptestid
and ht.status = 0 /* Enabled */
and (timeout < 30 or timeout > 60)

/* Get all web steps with status code <> 200 */

select hs.* from httpstep hs, httptest ht
where hs.httptestid = ht.httptestid
and ht.status = 0 /* Enabled */
and status_codes <> 200

/* Not sure how to use this */

select * from httptest

ACK and Event Time Duration

• Try this - added new (select ...) which gets time to next OK event for this trigger. This is very
slow if you choose a lot of events, so be patient.
select distinct
SUBSTRING_INDEX(from_unixtime(e.clock),' ',1) AlertDate,
SUBSTRING_INDEX(from_unixtime(e.clock),' ',-1) AlertTime,
(select floor((eb.clock-e.clock)/60) from events eb where value = 0
and eb.eventid > e.eventid and eb.objectid=e.objectid
order by eb.eventid limit 1 ) as Duration,
h.host, t.description, t.priority,
from_unixtime(a.clock) ACK, u.name, a.acknowledgeid,
a.message, floor((a.clock-e.clock)/60) response_time
from triggers t join functions f on f.triggerid=t.triggerid
right join items i on f.itemid=i.itemid
join hosts h on h.hostid=i.hostid
right join events e on t.triggerid=e.objectid
left join acknowledges a on a.eventid=e.eventid
left join users u on u.userid=a.userid
where e.value=1
and t.triggerid<>19072
and e.clock>unix_timestamp('2010-04-01 09:00:00') and

By ChinaNetCloud – www.ChinaNetCloud 8/9 Zabbix DB.odt

e.clock<unix_timestamp('2010-04-01 18:00:00')
order by e.clock;

Queue
• Query to check queue, mostly from queue.php
SELECT lastclock+delay-unix_timestamp() lag, from_unixtime(i.lastclock+i.delay)
nextcheck
,i.itemid, i.lastclock, i.description, i.key_, i.type, h.host, h.hostid,
h.proxy_hostid, i.delay, i.delay_flex
FROM items i JOIN hosts h on i.hostid=h.hostid
WHERE h.status=0
AND i.status=0
AND i.type=0
AND NOT i.lastclock IS NULL
AND from_unixtime(i.lastclock+i.delay+10) < now()
AND i.key_ <> 'status' AND key <> 'zabbix[log]' /* Skip these */
ORDER BY i.lastclock, h.host, i.description, i.key_
limit 100;

• Get count and max delay by host:

SELECT h.hostid, host, max(lastclock+delay-unix_timestamp()) as max_delay,
count(*)
FROM items i JOIN hosts h on i.hostid=h.hostid
AND h.status=0 AND i.status=0 AND i.type=0 AND NOT i.lastclock IS NULL
AND i.key_ <> 'status' AND key <> 'zabbix[log]' /* Skip these */
AND i.lastclock + i.delay + 5 < unix_timestamp() group by h.hostid;

By ChinaNetCloud – www.ChinaNetCloud 9/9 Zabbix DB.odt