Solve 1 problem by using 2 triggers, Zabbix

Original video: https://www.youtube.com/watch?v=FgBepdItxvE

What is this?

When CPU utilization goes up, how to highlight process name (root cause) and possibly send an email.

Prerequsites

zabbix_sender utility installed on every Linux server
```
sudo dnf install zabbix-sender
```
zabbix_server.conf:Timeout=30, zabbix_proxy.conf:Timeout=29, zabbix_agentd.conf:Timeout=28
"Zabbix agent (active)" checks are mandatory to work. Fix it by following this tutorial https://www.youtube.com/watch?v=VxrssOn9YJI
Remote commands enabled on inside zabbix_agentd.conf:
```
AllowKey=system.run[*]
```
Existing item key 'system.cpu.util' inside template

Tested and works with

Zabbix server 7.0.8
Zabbix proxy 7.0.8
Zabbix agentd 7.0.8. It's OK if host does not have any interface/IP address

Tested and NOT works

Zabbix server 7.0.0
Zabbix proxy 7.0.0, 7.0.6

Global macro:

{$CMD:cpu.pct} = ps -eo args --sort pcpu | tac | head -1 | base64 -w0

Template macros:

{$CPU.PCT:room} = 10
{$CPU:window} = 1m

Calculated item 'cpu.avg.graph':

avg(/{HOST.HOST}/system.cpu.util,1h) + {$CPU.PCT:room}

On the top of 'cpu.avg.graph', create dependent item 'cpu.avg.trigger':

Create "Zabbix trapper" item:

Install JavaScript preprocessing step:

return String.fromCharCode.apply(this,[].slice.call(atob(value)));

First trigger:
Name:

CPU increase VS trends

Event name:

CPU: {{ITEM.VALUE1}.fmtnum(2)} VS trends: {{ITEM.VALUE2}.fmtnum(2)}

Expression:

(
last(/linux mod/cpu.avg.trigger) < 100
and
min(/linux mod/system.cpu.util,{$CPU:window}) >= last(/linux mod/cpu.avg.trigger)
)
or
(
last(/linux mod/cpu.avg.trigger) >= 100
and
min(/linux mod/system.cpu.util,{$CPU:window}) >= (last(/linux mod/cpu.avg.trigger) - {$CPU.PCT:room})
)

Description:

zabbix_sender -c /etc/zabbix/zabbix_agentd.conf -s "{HOST.HOST}" -k cpu.pct -o $({$CMD:cpu.pct})

Tags:

collect: extra

"Alerts" => "Scripts" => "Create script" Name:

execute trigger description

Scope:

Action operation

Type:

Script

Type:

Script

Execute on:

Zabbix agent

Commands:

{TRIGGER.DESCRIPTION}

Trigger actions:

Second trigger:
Name:

Unusual CPU activity

Event name:

{{ITEM.VALUE1}.regsub("^(.{1,128})",\1)} consumes CPU: {{?last(//system.cpu.util)}.fmtnum(2)}

Expression:

nodata(/linux mod/cpu.pct,{$CPU:window}) = 0
and
min(/linux mod/system.cpu.util,{$CPU:window}) < 75

Tags:

cpuhot

Name:

CPU hot

Event name:

{{ITEM.VALUE1}.regsub("^(.{1,128})",\1)} consumes CPU: {{?last(//system.cpu.util)}.fmtnum(2)}

Expression:

nodata(/linux mod/cpu.pct,{$CPU:window}) = 0
and
min(/linux mod/system.cpu.util,{$CPU:window}) >= 75

Tags:

cpuhot