Zabbix items: types, keys and intervals

Everything Zabbix knows comes from Zabbix items. A template gives you hundreds of them, but sooner or later you need your own: is the web server port answering, how many Nginx workers are running, how fast is the home page, how many errors appeared in a log. This lesson takes items apart (type, key, value type, interval, history and trends) and then you build your own items for Nginx on web01.

You’ll also meet the three most common item errors on purpose, so that “Not supported” with a small red icon never scares you again. Lessons 8 to 11 build triggers, graphs, templates and preprocessing on top of the items you create here.

Where this lesson fits

Lesson 7 of 24 in Zabbix Monitoring · Phase 2: Items, triggers, templates and dashboards · Before this: Lesson 6, Zabbix auto-registration · Next: Lesson 8, Zabbix triggers

TimeYou needBy the end you can
About 85 minuteszbx01 and web01 from Lesson 6 (web01 auto-registered with PSK)Choose the right item type, key, value type and interval, create items for a service, and fix unsupported items

What it is, in one line

A Zabbix item is one thing you measure on one host: it has a type (how the value is collected), a key (what exactly to collect), a value type (how to store it) and an interval (how often).

In Simple Words

The health check-up form

When you go for an annual health check-up, the clinic hands you a form with rows: blood pressure, sugar fasting, sugar after food, weight. Each row says how the reading is taken (machine, blood test, weighing scale), the unit (mmHg, mg/dL, kg) and how often (blood pressure every visit, a full blood test once a year).

The clinic keeps every reading for a few months, and after that it keeps only the monthly average, lowest and highest, because nobody needs your exact weight on a Tuesday three years ago. Each row on that form is an item; the full readings are history and the monthly summary is trends.

Engineer's View

What makes up an item

FieldWhat it meansExample
TypeWho collects the value and howZabbix agent, Zabbix agent (active), Simple check, HTTP agent, Calculated, Dependent item, Script, Zabbix trapper, SNMP agent
KeyWhat to collect, with parameters in square bracketsvfs.fs.size[/,pused], net.tcp.service[http,,80], proc.num[nginx]
Type of informationHow the value is storedNumeric (unsigned), Numeric (float), Character, Log, Text, Binary, JSON (new in 8.0)
UnitsDisplay only; B, bps, %, s and others get automatic scalingB shows 2.5 GB instead of 2684354560
Update intervalHow often to collect1m, 30s, 1h; plus custom intervals
TimeoutHow long to wait (per item since 7.0, defaults from Administration > General > Timeouts)3s by default
History / TrendsHow long raw values and hourly aggregates are kept31d / 365d by default; trends only for numeric types

The key is the heart of an item. It must be unique on a host, and it must be something the collector understands: an agent key for agent items, an SNMP OID for SNMP items, a URL for HTTP agent items. Parameters in square brackets are comma-separated, and an empty parameter means “use the default”, which is why net.tcp.service[http,,80] has two commas.

How it works, step by step

1Item types: who does the work

TypeWho collectsTypical use
Zabbix agent / agent (active)Agent on the host, polled or pushedCPU, memory, disks, processes, files, logs (active only)
Simple checkZabbix server or proxy itselfnet.tcp.service, icmpping: is a port or host reachable from the monitoring side
HTTP agentServer or proxy, using libcurlREST APIs, status pages, JSON endpoints
CalculatedServer, from other itemsFormulas like percent used from two items
Dependent itemServer, from a master item’s valueMany values from one JSON or text response (Lesson 11)
ScriptServer or proxy, JavaScriptMulti-step API calls
Zabbix trapperSomething else pushes the value with zabbix_senderBackup scripts, cron jobs (Lesson 14)

An agent check tells you how the host sees itself; a simple check tells you how the network sees it. A web server whose Nginx is running but whose port is blocked by a firewall looks fine to the agent and broken to a simple check, which is why good monitoring usually has both. The terminal below shows a few agent keys answered one by one.

Zabbix items types compared: agent active, simple check and calculated item

2Keys and parameters

Each agent key has documented parameters. vfs.fs.size[/,pused] means file system “/” and mode “pused” (percent used). proc.num[nginx] counts processes named nginx. web.page.get[localhost,/,80] fetches a page and returns headers and body as text. Get a parameter wrong and the item becomes “Not supported” with a message that usually says exactly what’s wrong.

3Value types, history and trends

The value type decides how Zabbix stores and processes a value. Numbers can go into graphs, trends and maths; Character, Text and Log are stored as text and can be searched with trigger functions like find(). If the collector returns “vm” but the item says Numeric (unsigned), the value is rejected and the item goes unsupported, as you’ll see in Break It.

The diagram below shows where values go once they’re collected.

Zabbix items value path: collector, preprocessing, type check, history and trends

4Intervals: normal, flexible and scheduled

Update interval fieldMeaning
1mEvery minute, all the time
1m plus flexible 10s / 1-5,09:00-18:00Every 10 seconds during weekday office hours, every minute otherwise
0 plus scheduling h9m0Only at 09:00 every day (delay 0 means “only on the schedule”)
1h for inventory-style valuesSystem name, OS version, agent version rarely change

Every value costs database space and server work. A rough rule: 1,000 items every 60 seconds is about 17 new values per second, so if you halve every interval you double that number. Reports > System information shows “Required server performance, new values per second” for your whole installation, and it’s worth checking after big template changes.

Hands-on lab: build Nginx items on web01

Before you run any command, double-check it

Read every command twice before you press Enter. Check the target: the server name, the user, the disk or device name, the path and the sizes. These commands are for learning and were tested in our lab, not on your system. At work, run the read-only commands first, follow your change process, make sure a backup exists, and ask a second person to check anything that changes or deletes data. You run them at your own risk.

You’ll install Nginx on web01 and create items that watch it from three angles: the agent (process count, page), the server (simple TCP check) and a calculated percentage. Commands run on web01 unless marked zbx01. web01 talks to zbx01 with PSK since Lesson 6, so zabbix_get commands include the PSK options; if you skipped Lesson 6, drop them.

1Install Nginx on web01

Run this on web01:

sudo apt install -y nginx
sudo ufw allow from 192.168.56.0/24 to any port 80 proto tcp
systemctl is-active nginx
curl -sI http://localhost/ | head -1

You should see this:

active
HTTP/1.1 200 OK

The ufw rule lets zbx01 reach the web server for the simple check later. Nginx starts a master process and one worker per CPU core by default, which is what the process count will show.

✅ Checkpoint: Nginx is active on web01 and returns HTTP 200 on localhost.

2Try the keys from the server first

Run this on zbx01 (put web01’s key in /tmp/web01.psk first, chmod 600):

P="--tls-connect psk --tls-psk-identity 'PSK web01' --tls-psk-file /tmp/web01.psk"
for k in 'proc.num[nginx]' 'net.tcp.service[http,,80]' 'vfs.fs.size[/,pused]' 'nginx.status'; do
  echo "== $k"; eval zabbix_get -s 192.168.56.81 -k "'$k'" $P
done

You should see this (the disk value is live and will differ):

== proc.num[nginx]
2
== net.tcp.service[http,,80]
1
== vfs.fs.size[/,pused]
48.534803
== nginx.status
ZBX_NOTSUPPORTED: Unsupported item key.

Testing keys with zabbix_get before creating items saves a lot of clicking. Two processes is one master and one worker: Ubuntu’s Nginx uses worker_processes auto, which starts one worker per CPU core, and web01 has 1 vCPU. nginx.status isn’t a real agent key, which you’ll use in Break It.

✅ Checkpoint: zabbix_get returns numbers for proc.num[nginx] and net.tcp.service, and “Unsupported item key.” for nginx.status.

Zabbix items tested with zabbix_get from zbx01: proc.num, net.tcp.service, vfs.fs.size and an unsupported key
Testing item keys with zabbix_get before creating items

3Create an agent item: Nginx processes

Open Data collection > Hosts, click Items next to web01, then Create item:

FieldValue
NameNginx: number of processes
TypeZabbix agent (active)
Keyproc.num[nginx]
Type of informationNumeric (unsigned)
Update interval1m
History / Trends31d / 365d (defaults)
Tagscomponent: nginx

Click Add. Use the active type because web01 runs active checks (Lesson 4); a passive “Zabbix agent” item would also work here since web01 still accepts passive PSK connections. Tags let you filter Latest data and, later, route alerts.

✅ Checkpoint: The item “Nginx: number of processes” appears in web01’s item list as Enabled.

4Use Test before you save

Create a second item and, before saving, click Test at the bottom of the form:

FieldValue
NameNginx: home page
TypeZabbix agent (passive, so Test can query it)
Keyweb.page.get[localhost,/,80]
Type of informationText
Update interval5m
History7d

In the Test dialog tick Get value from host and click Get value and test. Zabbix asks the agent through the server, using the host interface 192.168.56.81:10050 and its PSK settings, and shows the result. The Test button can only fetch a value for item types the server polls itself, so for “Zabbix agent (active)” items it can test preprocessing but can’t get a value from the host.

You should see the HTTP response headers followed by the Nginx welcome page HTML. Close the dialog and click Add.

Zabbix items Test dialog for web.page.get on web01 returning HTTP 200 from Nginx
The Test item dialog: Get value from host fetched the HTTP 200 response from web01

✅ Checkpoint: Test returned an HTTP 200 response, and the “Nginx: home page” item is saved with type Text and 7d history.

5Add a simple check from the server side

FieldValue
NameNginx: HTTP port reachable from Zabbix
TypeSimple check
Keynet.tcp.service[http,,80]
Host interface192.168.56.81:10050 (simple checks use the IP, not the port)
Type of informationNumeric (unsigned)
Update interval1m

A simple check is run by the server itself, so it tests the network path from zbx01 to web01 port 80, including web01’s firewall. It returns 1 when the TCP connection works and 0 when it doesn’t, which is not an error, just a value.

✅ Checkpoint: The simple check item is saved and, after a minute, Latest data shows 1.

6Add a calculated item

Calculated items do maths on other items. This one turns two template items into a percentage of memory used:

FieldValue
NameMemory used, %
TypeCalculated
Keymem.used.pct
Formula100 – last(/web01/vm.memory.size[pavailable])
Type of informationNumeric (float)
Units%
Update interval1m

The key of a calculated item is just a unique name you choose. The formula uses the same function syntax as triggers: last(/host/key). Calculated items are evaluated by the server, so they don’t put any load on the agent.

✅ Checkpoint: “Memory used, %” shows a value in Latest data that, added to Available memory in %, makes 100.

7Watch the new items in Latest data

Open Monitoring > Latest data, filter host web01 and tag component: nginx, and click Apply.

Zabbix items in Latest data for web01 filtered on the component: nginx tag
Monitoring > Latest data for web01, tag component: nginx

Click History on the home page item to see the full text, and Graph on a numeric item to see its values over time. Text items have no graph, only a list of values.

✅ Checkpoint: All three Nginx items show recent values in Latest data.

8Use a flexible interval

Edit “Nginx: HTTP port reachable from Zabbix” and under Custom intervals add a Flexible row: interval 10s, period 1-5,09:00-18:00. Click Update. During weekday office hours the check now runs every 10 seconds, and every minute the rest of the time.

Note that Zabbix uses the server’s time zone for these periods.

✅ Checkpoint: The item shows “1m” with a custom interval, and during 09:00 to 18:00 on weekdays Last check updates every 10 seconds.

Break It, Then Fix It

Three item errors that every Zabbix admin meets. Each one shows a red “Not supported” icon in the item list, and hovering over it shows the reason.

1“Unsupported item key.”

Create an item on web01: Name “Nginx status (wrong key)”, Type Zabbix agent (active), Key nginx.status, Numeric (unsigned), interval 30s.

After a minute, the item list shows:

Nginx status (wrong key)    nginx.status    30s    Not supported
  Info: Unsupported item key.

The agent doesn’t have a key called nginx.status. Agent 2 has plugins for many things, but not this name; the Nginx stub_status page is read with an HTTP agent item or with the “Nginx by Zabbix agent” template’s web.page.get plus preprocessing (Lesson 11). Test any key on the host itself with zabbix_agent2 -t before you create the item, and look up the real key names in the agent 2 item key list in the manual.

Fix: delete the item, and test keys on the host first:

# on web01
sudo zabbix_agent2 -t nginx.status
sudo zabbix_agent2 -t 'web.page.get[localhost,/,80]' | head -c 120
nginx.status                                  [m|ZBX_NOTSUPPORTED] [Unsupported item key.]
web.page.get[localhost,/,80]                  [s|HTTP/1.1 200 OK
Server: nginx/1.28.3 (Ubuntu)

The [m|ZBX_NOTSUPPORTED] line is exactly what the server would get, and the second command shows a key that works.

✅ Checkpoint: The wrong item is deleted and zabbix_agent2 -t shows which keys the agent understands.

2Wrong value type

Create an item: Name “Hostname as number”, Type Zabbix agent (active), Key system.hostname, Type of information Numeric (unsigned). Zabbix refuses to save it because the Linux template already has this key:

Cannot add item
An item with key "system.hostname" already exists on the host "web01".

Keys must be unique per host. Add a harmless parameter to make it unique, system.hostname[host], and save. A minute later:

Hostname as number    system.hostname[host]    Not supported
  Info: Value of type "string" is not suitable for value type "Numeric (unsigned)". Value "web01"

The agent returned text, and the item expected a number, so the server rejected it. This happens a lot with HTTP agent items that sometimes return an error page instead of a number. The fix is to choose the right type of information, or to extract the number with preprocessing.

Fix:

Edit the item, set Type of information to Character, click Update.
The next value is stored and the item becomes supported.

✅ Checkpoint: The item shows “web01” as its last value and is no longer Not supported.

3ZBX_NOTSUPPORTED: permission denied

The agent runs as the zabbix user, so it can only read what that user can read. Ask it for a root-only file:

Run this on zbx01 (with the PSK file from step 2):

eval zabbix_get -s 192.168.56.81 -k "'vfs.file.contents[/etc/shadow]'" $P
eval zabbix_get -s 192.168.56.81 -k "'vfs.file.contents[/etc/hostname]'" $P

You’ll get this error, then a value:

ZBX_NOTSUPPORTED: Cannot open file: [13] Permission denied
web01

Error 13 is the Linux EACCES error. Don’t fix this by running the agent as root: give the zabbix user read access to exactly what it needs (group membership like adm for /var/log files, an ACL with setfacl, or a sudo rule for a specific script in Lesson 14). Also note vfs.file.contents is limited to 16 MB, and log files should be read with log[] items (Lesson 13), which only work as active checks; a passive log[] returns “Accessible only as active check.”

Fix:

Use a file the zabbix user may read, or grant read access to that one file:
sudo setfacl -m u:zabbix:r /path/to/file

✅ Checkpoint: You can explain why the zabbix user gets “Permission denied” and how to grant access safely.

This happened at work

The exam results page that “was up”

I was helping an online education platform in Bengaluru on the morning their board exam results went live. Their Zabbix showed everything green: CPU fine, Nginx processes running, port 443 answering. Meanwhile the support team had hundreds of tickets saying the results page showed a blank screen.

The team’s first move was to restart Nginx on all six web servers, because “it’s a web problem”. The page stayed blank. Someone finally opened the page in a browser and saw a 200 response with a tiny body: the PHP backend was timing out and Nginx was serving an error template with the status code still set to 200.

All their items checked whether things were running, and none checked whether the page worked. We added an HTTP agent item that fetched the results page every 30 seconds, kept the body length and response time with preprocessing, and a trigger when the body was under 2 KB or the time was over 3 seconds. Within 20 minutes of adding it they saw the same failure on a second server that nobody had reported.

The rule we wrote in their runbook: for every service, have at least one item that does what a user does, from outside the host, and checks the answer, not only the status code.

Common mistakes and troubleshooting

MistakeWhat happensWhat to do instead
Picking Numeric for a value that can be textThe item goes Not supported whenever the source returns an error messageUse Character or Text, or extract the number with preprocessing
Every item at 30s “to be safe”The database grows fast and the server needs far more new values per secondUse 1m for most metrics and 1h or more for things that rarely change
Duplicating a template key on the host“An item with key … already exists”Reuse the template item, or add a parameter to make the key unique
Running the agent as root to fix permissionsAny compromise of the agent gives root accessGrant the zabbix user read access to the specific files only
Only checking from the agentThe host looks healthy while users can’t reach itAdd a simple check or HTTP agent item from the server side
Keeping long history for text itemsLarge text values fill the databaseShort history (7d) for Text and Log items, and no trends (they have none)
Ignoring “Not supported” itemsReal problems hide among dozens of red iconsFix or disable them; review the count in System information

Interview questions

Click a question to open it. Each one is written the way an interviewer would ask it. Under it you will see why they ask it and one way you could answer, in your own words.

Fresher level

1. What is the difference between a Zabbix agent item and a simple check?

Why they ask this: They want to see that you know who does the collecting.

How you might answer: A Zabbix agent item is collected by the agent on the host, so it shows how the host sees itself: CPU, processes, files. A simple check like net.tcp.service is run by the Zabbix server or proxy, so it shows whether the service is reachable over the network. I usually use both for important services.

2. What are history and trends in Zabbix?

Why they ask this: A basic storage question.

How you might answer: History keeps every collected value, by default for 31 days. Trends keep one row per hour per numeric item with the minimum, average and maximum, by default for 365 days, so long-term graphs stay fast and cheap. Text, log and character items have no trends.

2–5 years experience

3. An item shows “Value of type string is not suitable for value type Numeric (unsigned)”. How do you fix it?

Why they ask this: They check you understand value types and preprocessing.

How you might answer: The collector returned text where the item expects an unsigned number, often an error message from an HTTP endpoint or a script. If the value really is text I change the type of information to Character or Text; if I want a number I add preprocessing to extract it, for example a regular expression or JSONPath step, plus a “Check for not supported value” step to handle errors cleanly.

4. How do you decide update intervals for a new template with 200 items?

Why they ask this: They want to hear about cost and usefulness, not “every 30 seconds”.

How you might answer: I match the interval to how fast the thing changes and how fast someone would act on it: 1m for CPU, memory and service checks, 5m or 15m for disk space, 1h or 1d for inventory items like OS version. I use flexible intervals where business hours matter, and I check the new values per second in System information before and after rolling it out.

Senior level

5. Your Zabbix server’s required performance jumped from 800 to 3,000 new values per second after a template change. How do you investigate and fix it?

Why they ask this: They test capacity thinking and knowledge of where to look.

How you might answer: I’d compare the template versions to find which items changed interval or which discovery rules now create many more items, and check the Zabbix server health dashboard for history syncer and preprocessing load. Usually it’s an LLD rule discovering far more entities than expected or someone setting 10s intervals.

The fix is to filter discovery, raise intervals for slow-changing values, use dependent items so one request feeds many values, and discard unchanged values with heartbeat in preprocessing.

6. When would you choose a dependent item over several separate agent items?

Why they ask this: They want to see you design for efficiency.

How you might answer: When one request already returns everything I need, like a JSON status page or a command that prints many counters. A master item fetches it once, and dependent items extract each value with preprocessing, so the agent or endpoint is hit once per interval instead of ten times and all values share the same timestamp.

Quick quiz

Q1. Which item type is collected by the Zabbix server itself, not by the agent?

  1. Zabbix agent (active)
  2. Simple check
  3. Zabbix trapper
  4. Dependent item
Show answer

B — Simple checks such as net.tcp.service run on the server or proxy.

Q2. What does the empty parameter in net.tcp.service[http,,80] mean?

  1. It is an error
  2. Use the default value for that parameter
  3. Check all IPs
  4. Disable the check
Show answer

B — An empty parameter means the default, here the default IP (127.0.0.1 from the agent, or the interface IP for a simple check).

Q3. Which value types have trends?

  1. All of them
  2. Only Text and Log
  3. Numeric (float) and Numeric (unsigned)
  4. Only JSON
Show answer

C — Trends store hourly min, average and max, which only make sense for numbers.

Q4. An item returns “ZBX_NOTSUPPORTED: Cannot open file: [13] Permission denied”. What is wrong?

  1. The file does not exist
  2. The zabbix user cannot read the file
  3. The key is wrong
  4. The agent is passive
Show answer

B — Error 13 means the agent’s user lacks read permission.

Q5. What does an update interval of 0 with scheduling h9m0 do?

  1. Collects every 9 minutes
  2. Collects only at 09:00
  3. Disables the item
  4. Collects every hour
Show answer

B — Delay 0 means collect only on the custom schedule, here 09:00 every day.

Quick recap

  • An item is type + key + value type + interval, with history and trends deciding how long its values live.
  • Agent items show the host’s view; simple checks and HTTP agent items show the network and user view.
  • Test keys with zabbix_get or the item Test button before saving, and read the “Not supported” reason when one fails.
  • Value type mismatches, unknown keys and permission errors are the three classic item failures.
  • web01 now has items for Nginx processes, the home page, port 80 reachability and memory used.

Next lesson

Lesson 8: Zabbix triggers and problem expressions → You turn these items into problems with trigger expressions, severities, recovery rules, dependencies and tags.

Further reading: Zabbix items

Want to go deeper into Zabbix items? The Zabbix manual covers creating an item, all Zabbix agent item keys, custom intervals and history and trends. For the Linux side of what these keys read, see Linux performance monitoring, and compare with how Prometheus names metrics in Prometheus Node Exporter.

You can also see the full plan for this course on the Zabbix Monitoring course page.

Scroll to Top

This website uses cookies

We use a few cookies to keep this site working. If you allow it, we also use Google Analytics to count visits so we can improve our lessons. You can accept all, deny the optional ones, or choose what to allow.