Zabbix health, housekeeping, upgrades and troubleshooting
-
Phase 1: Zabbix server and agents
-
Phase 2: Items, triggers, templates and dashboards
-
Phase 3: Alerts, proxies, SNMP and automation
Zabbix troubleshooting starts with Zabbix watching itself. The server measures how busy its own processes are, how full its caches are and how many checks are late, and it ships a template that raises a problem before you notice slow alerts.
In this last lesson you’ll read those health numbers, talk to the running server with zabbix_server -R, plan housekeeping and database growth, take a backup and rehearse the 7.0 LTS to 8.0 LTS upgrade. Then you’ll overload a poller, fill the history cache and break a database version check on purpose, and finish with a fixed order for the three questions you’ll hear every week: why is this host red, why is this item grey, why did nobody get the alert.
Where this lesson fits
Lesson 24 of 24 in Zabbix Monitoring · Phase 3: Alerts, proxies, SNMP and automation · Before this: Lesson 23, Grafana and Prometheus · Next: The course page and your final project
| Time | You need | By the end you can |
|---|---|---|
| About 2 hours 30 minutes | zbx01, web01 and zbxprx01 from Lessons 1 to 23, with the Python venv and write token from Lesson 22 | A Zabbix server you can read and tune, a tested backup, an upgrade checklist and a troubleshooting order you can use at work |
What it is, in one line
Zabbix health and troubleshooting means reading the server’s own internal items (process busy %, cache use, queue), tuning the matching settings in zabbix_server.conf, keeping the database in shape with housekeeping and backups, and checking problems in a fixed order: collection, item, trigger, action.
In Simple Words
The railway ticket counter
Think of the reservation counter at Lucknow Charbagh station in the summer rush. There are five windows, and each clerk can serve one passenger at a time. If thirty people arrive every minute and each takes ten seconds, the five clerks are busy most of the minute and the line still moves.
Now one passenger at window 2 argues for five minutes. The line behind window 2 stops, people move to other windows, and soon every clerk is busy all the time and the queue reaches the gate. The station master doesn’t shout at the passengers; he looks at how busy each window is and opens two more.
Zabbix pollers are the clerks, items are the passengers, and the health template is the station master’s notebook. Slow checks are the arguing passenger, and the history cache is the waiting room where tickets wait before they go into the big register, the database.
Engineer's View
What the server measures about itself
The Zabbix server health template is linked to the host “Zabbix server” on a fresh install. Its items are Zabbix internal items with keys like zabbix[process,poller,avg,busy], collected by the server itself with no agent. The triggers compare averages over 10 minutes with the macro {$ZABBIX.SERVER.UTIL.MAX} (75) and recover below {$ZABBIX.SERVER.UTIL.MIN} (65).
| Item (name in 8.0) | Key | What a bad value means |
|---|---|---|
| Utilization of poller data collector processes, in % | zabbix[process,poller,avg,busy] | Simple, external, SSH, Telnet and Script checks wait; raise StartPollers or fix slow checks |
| Utilization of agent poller data collector processes, in % | zabbix[process,agent poller,avg,busy] | Passive agent checks wait; StartAgentPollers or MaxConcurrentChecksPerPoller |
| History write cache, % used | zabbix[wcache,history,pused] | Values can’t reach the database fast enough; HistoryCacheSize or a slow DB |
| Configuration cache, % used | zabbix[rcache,buffer,pused] | Too little CacheSize for hosts, items and triggers |
| Value cache, % used | zabbix[vcache,buffer,pused] | Trigger functions read the DB instead of memory; ValueCacheSize |
| Queue over 10 minutes | zabbix[queue,10m] | Checks are more than 10 minutes late |
Since 7.0 the server has separate pollers per check type. Passive agent, HTTP agent and SNMP get/walk items use asynchronous pollers (default 1 each, up to 1000 checks in flight per poller), while the classic synchronous poller (StartPollers, default 5) runs simple checks, external checks, SSH, Telnet, Script items and old-style SNMP OIDs one at a time.
| Setting in zabbix_server.conf | Default | Range |
|---|---|---|
| StartPollers | 5 | 0-1000 |
| StartAgentPollers / StartHTTPAgentPollers / StartSNMPPollers | 1 each | 0-1000 |
| StartPreprocessors | 16 | 1-1000 |
| StartDBSyncers | 4 | 1-100 |
| CacheSize | 32M | 128K-64G |
| HistoryCacheSize / HistoryIndexCacheSize | 16M / 4M | 128K-16G |
| TrendCacheSize | 4M | 128K-16G |
| ValueCacheSize | 8M | 0, 128K-64G |
| HousekeepingFrequency / MaxHousekeeperDelete | 1 hour / 5000 | 0-24 / 0-1000000 |
How it works, step by step
1Follow one value through the server
A poller gets a value, the preprocessing manager hands it to a worker for steps like JSONPath or “Change per second”, and the result lands in the history cache in shared memory. Four history syncers (StartDBSyncers) take values from the cache, calculate triggers and write history and trends to the database in batches.
Every stage has a matching health item, so when alerts are slow you can see which stage is the bottleneck. The diagram below shows the path and where it backs up.
2Read busy %, caches and housekeeping together
A process type at 100% busy means checks wait; a cache near 100% means memory is too small or the next stage is slow. Don’t raise numbers blindly: more pollers help when checks wait on the network, but if MySQL is slow, more pollers only fill the history cache faster.
The housekeeper deletes old history, trends, events and sessions every hour (HousekeepingFrequency=1), at most 5000 rows per item per run. Item settings decide retention (31 days history, 365 days trends by default), unless Administration > Housekeeping has “Override item history period” switched on.
3How an upgrade runs
Zabbix upgrades the database schema itself. When the new server binary starts, it compares its required version with the dbversion table, runs every patch in order and logs each step, and the frontend refuses to work until both match. There is no automatic way back, so the backup before the upgrade is the only rollback you have; the diagram below shows the order.
4A fixed order for troubleshooting
Most tickets are one of three: a host with a red availability icon, an item marked “Not supported”, or a problem that nobody was told about. Check them in the order data flows: can Zabbix reach the host, can it get the item, does the trigger fire, does the action send.
| Symptom | First place to look | Typical cause |
|---|---|---|
| Host availability red (ZBX) | Hover the icon on Data collection > Hosts; server or proxy log | Firewall, Server= list, PSK mismatch, wrong proxy |
| Item “Not supported” | Info icon on the item, or Test > Get value | Wrong key or parameter, permissions, missing plugin, preprocessing error |
| Problem shown but no message | Reports > Action log, then the problem’s Actions column | Action conditions, maintenance, user media severity, media type error |
| Values arrive late | Administration > Queue, health template | Busy pollers, unreachable hosts, proxy link down |
Hands-on lab: server health, runtime control, backup and upgrade checks
Before you run any command, double-check it
Read every command twice before you press Enter. Check the target: the server name, the user, the disk or device name, the path and the sizes. These commands are for learning and were tested in our lab, not on your system. At work, run the read-only commands first, follow your change process, make sure a backup exists, and ask a second person to check anything that changes or deletes data. You run them at your own risk.
Everything runs on zbx01 (192.168.56.80) unless a step says otherwise. web01 is monitored through zbxprx01 (192.168.56.82) since Lesson 19, which matters in step 9. The zabbix_server -R outputs, log lines and error messages were captured on a real Zabbix 8.0.0 server.
1Read the server’s health numbers
Open Monitoring > Latest data, set Hosts to Zabbix server and type Utilization in Name. Then repeat with cache and Queue.
You should see these items (your values will differ):

On a lab this small everything is close to zero, which is your baseline. If “Zabbix server health” isn’t linked, add it on Data collection > Hosts > Zabbix server > Templates.
✅ Checkpoint: Latest data shows the Utilization, cache and Queue items for Zabbix server with fresh values.
2Ask the running server for its status
Run this on zbx01:
sudo zabbix_server -R status
ps -eo args | grep 'zabbix_server: poller #' | grep -v grepYou should see this (your timings will differ, and ps lists all five pollers):
configuration syncer #1 [synced configuration in 0.013639 sec, idle 10 sec]
event manager #1 [assessed:9 processed:0 discarded:0 events, idle 5.0s, during 5.0s]
preprocessing manager #1 [queued 1, processed 1 values, idle 5.009264 sec during 5.009377 sec]
service manager #1 [processed 0 events, updated 0 event tags, deleted 0 problems, synced 0 service updates, idle 5.004933 sec during 5.004973 sec]
/usr/sbin/zabbix_server: poller #1 [got 0 values in 0.000010 sec, idle 5 sec]
/usr/sbin/zabbix_server: poller #2 [got 0 values in 0.000040 sec, idle 5 sec]-R status is new in 8.0 and asks the manager processes what they did in their last cycle. The ps line shows the title every Zabbix process sets for itself, which is the fastest way to see a poller stuck on “getting values”.
✅ Checkpoint: Both commands print process lines, and you can see five poller processes in ps.

3Look inside the history cache
Run this on zbx01:
sudo zabbix_server -R diaginfo=historycacheYou should see:
Runtime control command was forwarded successfullyThen read the log:
sudo grep -A6 'history cache diagnostic' /var/log/zabbix/zabbix_server.log | tail -7== history cache diagnostic information ==
Items:10 values:1 time:0.000007
Memory.data:
size: free:16776760 used:48
chunks: free:1 used:1 min:16776760 max:16776760
buckets:
256+:1“values:1” means one value is waiting to be written, and “free:16776760” of the default 16M is unused. On a healthy server this number stays near the full size; in break 2 you’ll see it drop to zero.
✅ Checkpoint: The log shows “history cache diagnostic information” with a large free value.
4Change logging and reload the cache without a restart
Run this on zbx01:
sudo zabbix_server -R log_level_increase=poller
sudo zabbix_server -R log_level_decrease=poller
sudo zabbix_server -R config_cache_reload
sudo grep -E 'log level has been|forced reloading' /var/log/zabbix/zabbix_server.log | tail -4You should see this (your PIDs and times will differ):
Runtime control command was forwarded successfully
Runtime control command was forwarded successfully
Runtime control command was forwarded successfully
14926:20261108:101404.834 log level has been increased to 4 (debug)
14926:20261108:101406.841 log level has been decreased to 3 (warning)
14879:20261108:101410.112 forced reloading of the configuration cache
14879:20261108:101410.130 finished forced reloading of the configuration cacheA target such as poller, "agent poller" or "history syncer,2" raises the level for those processes only, so the log doesn’t explode. A wrong name is refused with invalid process type: "nosuch", and you should always decrease again after collecting what you need.
✅ Checkpoint: The log shows the level going to 4 and back to 3, and a forced configuration cache reload.
5Set housekeeping and run it once
Open Administration > Housekeeping. In the History section keep “Enable internal housekeeping” on, switch on “Override item history period” and set Data storage period to 14d; in Trends keep 365d. Click Update.
Run this on zbx01:
sudo zabbix_server -R housekeeper_execute
sleep 5; sudo grep 'housekeeper \[' /var/log/zabbix/zabbix_server.log | tail -1You should see this (your counts and times will differ):
Runtime control command was forwarded successfully
14890:20261108:101408.048 housekeeper [deleted 203 hist/trends, 0 events, 0 problems, 0 sessions, 0 alarms, 0 audit, 0 autoreg_host, 0 records, 0 sets, 0 expired device authentication records in 0.054674 sec, idle for 1 hour(s)]The line tells you how many rows each run removed and how long it took. If one run starts taking minutes on a big server, that’s the sign to look at partitioning the history tables (MySQL partitions, or TimescaleDB on PostgreSQL) and switching internal housekeeping off for history and trends.
Administration > Housekeeping: history override switched on with a 14d storage period✅ Checkpoint: Housekeeping shows the 14d override, and the log has a “housekeeper [deleted …” line.
6Measure the database
Run this on zbx01:
sudo mysql -e "SELECT table_name, ROUND((data_length+index_length)/1024/1024,1) AS size_mb
FROM information_schema.tables WHERE table_schema='zabbix'
ORDER BY (data_length+index_length) DESC LIMIT 5;"
sudo du -sh /var/lib/mysql/zabbixYou should see this (your sizes will differ):
TABLE_NAME size_mb
history_uint 48.5
history 31.2
trends_uint 12.8
items 10.4
history_text 6.1
182M /var/lib/mysql/zabbixThe history tables are almost always at the top. Write this number down every month; a rough formula for planning is new values per second × bytes per value (about 90 on MySQL) × seconds of retention, so 1000 NVPS kept for 14 days is around 100 GB of history.
✅ Checkpoint: You know the size of your zabbix schema and which tables are the largest.
7Back up the database and configuration
Paste this whole block on zbx01:
mkdir -p ~/backup && cd ~/backup
sudo mysqldump --single-transaction --quick zabbix | gzip > zabbix-db-$(date +%F).sql.gz
sudo tar czf zabbix-etc-$(date +%F).tgz /etc/zabbix /etc/nginx/conf.d/zabbix.conf \
/etc/ssl/certs/zbx01.lab.crt /etc/ssl/private/zbx01.lab.key
ls -lh ~/backup
gunzip -c zabbix-db-$(date +%F).sql.gz | grep -c 'CREATE TABLE'You should see this (your dump size and dates will differ):
tar: Removing leading `/' from member names
tar: Removing leading `/' from hard link targets
total 41M
-rw-rw-r-- 1 student student 41M Nov 8 10:32 zabbix-db-2026-11-08.sql.gz
-rw-r--r-- 1 root root 21K Nov 8 10:32 zabbix-etc-2026-11-08.tgz
230The two tar lines are normal. tar stores the paths without the leading slash, so a later tar xzf unpacks into the folder you’re in instead of writing straight over /etc. The configuration archive comes to about 21K because zabbix_server.conf alone is about 35 KB of comments and defaults, and gzip shrinks that well. /etc/nginx/conf.d/zabbix.conf is only a symlink to /etc/zabbix/nginx.conf, created by the zabbix-nginx-conf package, so the real Nginx file is already inside /etc/zabbix.

--single-transaction takes a consistent copy of InnoDB tables without stopping the server. The second file holds the server, agent, frontend (/etc/zabbix/web/zabbix.conf.php) and Nginx configuration, plus the certificate. Copy both files off the VM, because a backup on the same disk isn’t a backup.
✅ Checkpoint: ~/backup has a .sql.gz with about 230 CREATE TABLE lines and a .tgz of the configuration.
8Rehearse the upgrade checks
Run this on zbx01:
zabbix_server -V | head -1
mysql -V
php -r 'echo PHP_VERSION, PHP_EOL;'
sudo mysql zabbix -e "SELECT mandatory, optional FROM dbversion;"You should see:
zabbix_server (Zabbix) 8.0.0
mysql Ver 8.4.11-0ubuntu0.26.04.1 for Linux on x86_64 ((Ubuntu))
8.5.4
mandatory optional
8000000 8000000Your lab is already on 8.0, so you can’t upgrade it, but these four checks are what you run first on a 7.0 server at work. Zabbix 8.0 needs MySQL 8.4 or newer (MariaDB 10.11, PostgreSQL 15) and PHP 8.2 or newer, and a 7.0 database shows 7000000 here.
The upgrade on Ubuntu, after a backup, is short:
sudo systemctl stop zabbix-server
wget https://repo.zabbix.com/zabbix/8.0/release/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest_8.0+ubuntu26.04_all.deb
sudo dpkg -i zabbix-release_latest_8.0+ubuntu26.04_all.deb
sudo apt update
sudo apt install --only-upgrade zabbix-server-mysql zabbix-frontend-php zabbix-nginx-conf zabbix-sql-scripts zabbix-agent2
grep -n 'root' /etc/zabbix/nginx.conf # must be /usr/share/zabbix/ui
sudo systemctl start zabbix-server
sudo tail -f /var/log/zabbix/zabbix_server.logThe server log during the database upgrade looks like this:
current database version (mandatory/optional): 07000000/07000030
required mandatory version: 07050196
starting automatic database upgrade
completed 1% of database upgrade
...
database upgrade fully completedNote the new /release/ part of the repository URL, and that the frontend moved to /usr/share/zabbix/ui in 7.2, so an old Nginx root line gives a 404. Templates and media types are not upgraded for you: import the new versions afterwards, and upgrade proxies to the same major version soon after the server.
✅ Checkpoint: You have the four version numbers of your lab written next to the 8.0 minimums.
9Drill the troubleshooting order
Run the three checks on your own lab. First the host: open Data collection > Hosts, note that web01 shows “remote-proxy” under Monitored by, so any test must come from zbxprx01.
Run this on zbxprx01 (copy web01’s key from /etc/zabbix/zabbix_agent2.d/web01.psk first):
sudo apt install -y zabbix-get
echo 'PASTE_THE_64_HEX_KEY' > /tmp/web01.psk && chmod 600 /tmp/web01.psk
zabbix_get -s 192.168.56.81 -k agent.ping \
--tls-connect psk --tls-psk-identity "PSK web01" --tls-psk-file /tmp/web01.pskYou should see:
1Then the item: on web01 open Items, filter State Not supported and hover the red info icon; the text is the agent’s own reason. Then the alert: open Reports > Action log for the last day and check each sent, failed or missing message against Lesson 16’s action and the user’s media severity.
1. Collection : availability icon, zabbix_get from the server OR proxy that polls the host
2. Item : item error text, Test > Get value, zabbix_agent2 -t KEY on the host
3. Trigger : Monitoring > Problems (show suppressed), trigger expression on latest values
4. Action : Reports > Action log, action conditions, maintenance, user media and severity✅ Checkpoint: zabbix_get from zbxprx01 returns 1 for web01, and you know where each of the four checks lives.
10Final project: monitor a new service end to end
Pick a service on web01 you haven’t monitored yet, for example Mailpit on zbx01 or a second Nginx site, and use everything from the course in one go. Treat it like a real request from a team lead.
| Part | From lesson | Done when |
|---|---|---|
| Host, template and macros | 4 to 9 | Data arrives in Latest data |
| Two triggers with severity and tags | 10 to 12 | A test failure opens a problem |
| Action with escalation to email or webhook | 16, 17 | The message arrives and Action log shows Sent |
| Dashboard and a Grafana panel | 15, 23 | One screen shows the service |
| Maintenance and an API report | 22 | A Python script lists the service’s problems |
| Health check | 24 | Busy % and queue stay low after the change |
✅ Checkpoint: Your new service has data, triggers, an alert that reaches you, a dashboard and a backup taken after the change.
Break It, Then Fix It
Three failures every Zabbix admin meets sooner or later. Take a VirtualBox snapshot of zbx01 first and name it “before-l24-breaks”.
1“Utilization of poller processes is high”
Make one slow external check and give the server only one poller for it.
Run this on zbx01:
sudo tee /usr/lib/zabbix/externalscripts/slow_check.sh >/dev/null <<'EOF'
#!/bin/sh
sleep 2
echo 1
EOF
sudo chmod 755 /usr/lib/zabbix/externalscripts/slow_check.sh
sudo sed -i 's/^# StartPollers=5/StartPollers=1/' /etc/zabbix/zabbix_server.conf
sudo systemctl restart zabbix-serverCreate host slowlab (group Linux servers, agent interface 127.0.0.1) with an item: Type External check, Key slow_check.sh[1], Numeric (unsigned), interval 10s. Clone it five times with keys slow_check.sh[2] to slow_check.sh[6]. After a few minutes look at Latest data and ps:
Utilization of poller data collector processes, in % 100 %
/usr/sbin/zabbix_server: poller #1 [got 3 values in 6.015147 sec, getting values]Six checks of two seconds every ten seconds need twelve seconds of work, and one poller has only ten. After ten minutes the template opens “Zabbix server: Utilization of poller processes is high” (event name “…over 75%”), and Administration > Queue shows slowlab’s items getting later.
Fix:
sudo sed -i 's/^StartPollers=1/StartPollers=5/' /etc/zabbix/zabbix_server.conf
sudo systemctl restart zabbix-serverUtilization of poller data collector processes, in % 26.5 %With five pollers the same work uses about a quarter of their time. At work, fix the slow check first (a two-second script is a smell), then add pollers; and if the slow items are many simple checks to a far site, move them to a proxy there.
✅ Checkpoint: Poller utilization is under 65% and the problem has resolved. Delete host slowlab.
2History cache is full
Shrink the history cache to the minimum, freeze the database writes for a minute and push values in with zabbix_sender.
Run this on zbx01:
echo 'HistoryCacheSize=128K' | sudo tee -a /etc/zabbix/zabbix_server.conf
sudo systemctl restart zabbix-serverCreate host floodlab with a Zabbix trapper item, Key lab.flood, type Text (Allowed hosts stays {$TRAPPER.ALLOWED_HOSTS}, which allows 127.0.0.1). Wait one minute for the configuration cache, then:
python3 -c "
for i in range(20000): print('floodlab lab.flood', 'x'*200)" > /tmp/flood.txt
sudo apt install -y zabbix-sender
(sudo mysql -e "FLUSH TABLES WITH READ LOCK; SELECT SLEEP(75);" >/dev/null &)
sleep 3; zabbix_sender -z 127.0.0.1 -i /tmp/flood.txt | tail -2
sudo zabbix_server -R diaginfo=historycache
sudo grep -A2 'History cache is full' /var/log/zabbix/zabbix_server.log | tail -3You’ll get this (your numbers will differ):
Response from "127.0.0.1:10051": "processed: 250; failed: 0; total: 250; seconds spent: 0.000738"
Sending failed. Use option -vv for more detailed output.
== history cache diagnostic information ==
Items:139 values:256 time:0.000015
Memory.data:
size: free:0 used:116088
13751:20261108:101024.964 History cache is full. Sleeping for 1 second.
13751:20261108:101024.964 items with most values in history cache:
itemid:72507 values:452With writes blocked, the syncers can’t empty the cache, it reaches free:0, and the process that wants to add values sleeps. That’s why the sender stops being answered. The log helpfully lists the items with the most waiting values, which at work points to the item or host flooding you.
Fix:
sudo sed -i '/^HistoryCacheSize=128K/d' /etc/zabbix/zabbix_server.conf
sudo systemctl restart zabbix-server
sudo zabbix_server -R diaginfo=historycacheAt work the cause is rarely the cache size itself. Check the database first (slow disk, locks, a long backup without --single-transaction), then the busy % of history syncers, and only then raise HistoryCacheSize.
✅ Checkpoint: diaginfo shows a large free value again and no new “History cache is full” lines. Delete host floodlab.
3Server and database versions don’t match
This is what you see after rolling packages back to an older server once the database was already upgraded to a newer version. Make a fresh backup (step 7) before this one.
Run this on zbx01:
sudo systemctl stop zabbix-server
sudo mysql zabbix -e "UPDATE dbversion SET mandatory=8020005, optional=8020005;"
sudo systemctl start zabbix-server
sudo tail -2 /var/log/zabbix/zabbix_server.logYou’ll get this:
14609:20261108:101110.854 The server does not match Zabbix database. Current database version (mandatory/optional): 08020005/08020005. Required mandatory version: 08000000.
14609:20261108:101110.854 Zabbix Server stopped. Zabbix 8.0.0 (revision c81e276e505).The frontend shows “Database error: The Zabbix database version does not match current requirements. Your database version: 8020005. Required version: 8000000.” Zabbix never downgrades a schema, so the only real fix after a failed upgrade is restoring the backup taken before it.
Fix (put the real version back):
sudo mysql zabbix -e "UPDATE dbversion SET mandatory=8000000, optional=8000000;"
sudo systemctl start zabbix-serverThe other version error you’ll meet is the database server itself. Upgrading Zabbix on Ubuntu 24.04 with its MySQL 8.0 stops at start with this real message:
Unable to start Zabbix server due to unsupported MySQL database version (8.0.46).
Should be at least (8.4.0).
Use of supported database version is highly recommended.
Override by setting AllowUnsupportedDBVersions=1 in Zabbix server configuration file at your own risk.The override exists, but on a server you care about, upgrade MySQL to 8.4 (or move to 26.04) before Zabbix, not after.
✅ Checkpoint: The server is running again, the frontend loads, and dbversion shows 8000000.
This happened at work
Late alerts in the Lucknow summer
One June afternoon at a state power distribution company in Lucknow, the control room called our team: a feeder trip had shown up in Zabbix eleven minutes late. My team lead opened the Zabbix server host and saw “Utilization of poller processes is high” open since morning, and Administration > Queue had thousands of items in the over-5-minutes column.
The first fix was to give the VM two more CPUs and 8 GB more RAM. Nothing changed, because the pollers weren’t short of CPU; they were waiting. A week earlier someone had added TCP port checks for 1,200 substation RTUs as simple checks with a 30-second interval, and in the heat many sites were on generator with their links down, so each check sat for the full timeout.
We moved the substation checks to two proxies in the regional offices, set the interval to 2 minutes and raised StartPollers from 5 to 20 on the proxies, not the server. The queue was empty by evening.
The lasting change was a habit: anyone adding more than a hundred items now looks at the health template before and after, and the poller and history cache triggers send to the Zabbix admins’ group with their own escalation.
Common mistakes and troubleshooting
| Mistake | What happens | What to do instead |
|---|---|---|
| Unlinking or ignoring the Zabbix server health template | You learn about overload from angry users | Keep it linked and route its problems to the admins |
| Raising every Start* value to 100 | More DB connections and memory, same slow DB | Raise the process type that is busy, after fixing slow checks |
| Raising HistoryCacheSize when the DB is slow | The bigger cache fills later and the data loss risk grows | Fix database speed first, then size caches |
| Keeping 90 days of history on every item | Database grows past the disk and housekeeping runs for hours | Short history plus trends; override in Administration > Housekeeping |
| Upgrading without a tested database backup | A failed schema patch leaves no way back | mysqldump with single-transaction, copied off the VM and restored once as a test |
| Upgrading Zabbix before MySQL on Ubuntu 24.04 | “unsupported MySQL database version (8.0.x)” and the server won’t start | Move to MySQL 8.4 or Ubuntu 26.04 first |
| Testing a proxied host with zabbix_get from the server | Refused, and you chase a problem that isn’t there | Test from the proxy that monitors the host |
Interview questions
Click a question to open it. Each one is written the way an interviewer would ask it. Under it you will see why they ask it and one way you could answer, in your own words.
Fresher level
1. A host shows a red ZBX icon. Walk me through what you check.
Why they ask this: They want an order, not random guesses.
How you might answer: I hover the icon to read the error, then check which server or proxy monitors the host. From that machine I run zabbix_get with the same encryption settings, and if it fails I look at the agent’s Server list, the firewall and the agent log, which says whether it rejected the connection or never saw it.
2. What does the Zabbix server health template tell you?
Why they ask this: A check that you know Zabbix monitors itself.
How you might answer: It uses internal items to show how busy each process type is, how full the configuration, history and value caches are, and how many items are late in the queue. Its triggers fire when a process type is over 75% busy for 10 minutes or the history cache is filling, so I hear about overload before users do.
2–5 years experience
3. Poller utilization is 100% but CPU on the server is low. Why, and what do you do?
Why they ask this: They are checking that you understand pollers wait on I/O.
How you might answer: Synchronous pollers run one check at a time, so slow external scripts or simple checks to unreachable hosts keep them busy without CPU. I find the slow items in the queue details, shorten their timeout or interval, move far-away checks to a proxy, and then raise StartPollers if it is still above 75%.
For agent, HTTP and SNMP checks in 8.0 I look at the asynchronous pollers and MaxConcurrentChecksPerPoller instead.
4. You see “History cache is full. Sleeping for 1 second.” in the log. What is your next step?
Why they ask this: They want you to find the cause behind the cache.
How you might answer: That means history syncers can’t write values as fast as they arrive. I check database health first: slow disk, locks, a backup holding tables, long housekeeper runs. The log lists the items with the most values in the cache, so I also look for one host flooding the server, and I raise HistoryCacheSize only after that.
Senior level
5. Plan an upgrade from Zabbix 7.0 LTS to 8.0 LTS for a large installation.
Why they ask this: They are checking risk control and the real prerequisites.
How you might answer: I check the floors first: MySQL 8.4, MariaDB 10.11 or PostgreSQL 15, and PHP 8.2, because 8.0 refuses older database versions. I rehearse on a copy of the production database to time the schema upgrade, take a consistent backup, stop the server and proxies, switch to the 8.0 repository with the /release/ URL, upgrade packages, fix the Nginx root to /usr/share/zabbix/ui and start the server while watching the log.
Afterwards I upgrade proxies to 8.0, import new templates and media types, and keep the backup until the team is sure.
6. The Zabbix database is 2 TB and housekeeping can’t keep up. What are your options?
Why they ask this: They want partitioning, retention and storage design.
How you might answer: First I cut retention: shorter history on high-frequency items and trends for long ranges. Then I partition history and trends by day on MySQL, or use TimescaleDB on PostgreSQL, and turn internal housekeeping off for those tables so old data is dropped a whole partition at a time.
For very high volumes 8.0 can also send history to Elasticsearch or ClickHouse through HistoryProvider, but I treat that as a separate project.
Quick quiz
Q1. Which internal item key shows how busy the synchronous pollers are?
- zabbix[queue]
- zabbix[process,poller,avg,busy]
- zabbix[wcache,history,pused]
- agent.ping
Show answer
B — The process key with type poller and avg,busy gives the busy percentage.
Q2. At what default level does the health template raise a utilization problem?
- 50%
- 65%
- 75%
- 95%
Show answer
C — {$ZABBIX.SERVER.UTIL.MAX} is 75, and it recovers below 65.
Q3. Which command reloads the configuration cache without restarting the server?
- zabbix_server -R config_cache_reload
- systemctl reload zabbix-server
- zabbix_server -t
- zabbix_get -k reload
Show answer
A — Runtime control commands go to the running server through -R.
Q4. The log says “The server does not match Zabbix database”. What is the safe fix after a failed upgrade?
- Edit dbversion by hand
- Restore the backup taken before the upgrade
- Delete the history tables
- Set AllowUnsupportedDBVersions=1
Show answer
B — Zabbix doesn’t downgrade schemas; the pre-upgrade backup is the rollback.
Q5. Where should you run zabbix_get to test web01 in this lab?
- On zbx01
- On your laptop
- On zbxprx01, the proxy that monitors web01
- On web01 against 127.0.0.1 only
Show answer
C — web01 accepts passive checks only from the proxy since Lesson 19.
Quick recap
- The Zabbix server health template measures busy % per process type, cache use and the queue; its triggers fire over 75% for 10 minutes.
- Fix slow checks first, then raise the matching Start* setting; fix the database before raising HistoryCacheSize.
- zabbix_server -R gives you status, diaginfo, log levels per process, cache reloads and a forced housekeeper run without restarts.
- Housekeeping, retention and a monthly look at table sizes keep the database healthy; partition when one housekeeper run takes too long.
- For 7.0 to 8.0: check MySQL 8.4 and PHP 8.2, back up, switch to the /release/ repository, upgrade, fix the Nginx root and watch the log.
- Troubleshoot in data order: collection, item, trigger, action.
What’s next
That’s the end of the Zabbix Monitoring course, and well done for building all of it by hand. Go back to the Zabbix Monitoring course page to review any lesson, then try the Prometheus Monitoring course to compare a pull-based system, and the Grafana Dashboards course to put Zabbix and Prometheus on one screen.
Further reading: Zabbix troubleshooting
Want to go deeper into Zabbix troubleshooting? The Zabbix manual covers internal items, server runtime control and upgrade procedures, and the requirements page lists the supported database versions. For the Linux side of slow servers see Linux performance monitoring, and for proxies revisit Lesson 19.
You can also see the full plan for this course on the Zabbix Monitoring course page.
