做過Zabbix的同學都知道，Zabbix通過專用的Agent或者SNMP收集相關的監控數據，然後存儲到數據庫裏面實時在前臺展示。Zabbix監控數據主要分爲以下兩類：
歷史數據：history相關表,從history_uint表裏面可以查詢到設備監控項目的最大，最小和平均值,即存儲監控數據的原始數據。
趨勢數據：trends相關表,趨勢數據是經過Zabbix計算的數據，數據是從history_uint裏面彙總的，從trends_uint可以查看到監控數據每小時最大，最小和平均值，即存儲監控數據的彙總數據。
Zabbix可以通過兩種方式獲取歷史數據：
1.通過Zabbix前臺獲取歷史數據
通過Zabbix前臺查看歷史數據非常簡單，可以通過Monitoring->Lastest data的方式查看。也可以點擊右上角的As plain test按鈕保存成文本文件。
2.通過前臺獲取的數據進行處理和二次查詢有很多限制，因此可以通過SQL語句直接從後臺DB查詢數據。
首先大家應該熟悉SQL語句Select 常用用法：
SELECT [ALL | DISTINCT] Select_List [INTO [New_Table_name]
FROM { Table_name | View_name} [ [,{table2_name | view2_name}
[,...] ]
[ WHERE Serch_conditions ]
[ GROUP BY Group_by_list ]
[ HAVING Serch_conditions ]
[ ORDER BY Order_list [ASC| DEsC] ] 說明：
1)SELECT子句指定要查詢的特定表中的列，它可以是*，表達式，列表等。
2)INTO子句指定要生成新的表。
3)FROM子句指定要查詢的表或者視圖。
4)WHERE子句用來限定查詢的範圍和條件。
5)GROUP BY子句指定分組查詢子句。
6)HAVING子句用於指定分組子句的條件。
7)ORDER BY可以根據一個或者多個列來排序查詢結果，在該子句中，既可以使用列名，也可以使用相對列號，ASC表示升序，DESC表示降序。
8）mysql聚合函數：sum()，count()，avg()，max()，avg()等都是聚合函數，當我們在用聚合函數的時候，一般都要用到GROUP BY 先進行分組，然後再進行聚合函數的運算。運算完後就要用到Having子句進行判斷了,例如聚合函數的值是否大於某一個值等等。
從Zabbix數據庫中查詢監控項目方法,這裏已查詢主機的網卡流量爲例子：
1）通過hosts表查找host的ID。
mysql> select host,hostid from hosts where host="WWW05"; +-------+--------+ | host | hostid | +-------+--------+ | WWW05 | 10534 | +-------+--------+ 1 row in set (0.00 sec)
2）通過items表查找主的監控項和key以及itemid。
mysql> select itemid,name,key_ from items where hostid=10534 and key_="net.if.out[eth0]"; +--------+-----------------+------------------+ | itemid | name | key_ | +--------+-----------------+------------------+ | 58860 | 發送流量： | net.if.out[eth0] | +--------+-----------------+------------------+ 1 row in set (0.00 sec)
3）通過itemid查詢主機的監控項目（history_uint或者trends_uint)，單位爲M。
主機流入流量：
mysql> select from_unixtime(clock) as DateTime,round(value/1024/1024,2) as Traffic_in from history_uint where itemid="58855" and from_unixtime(clock)>='2014-09-20' and from_unixtime(clock)<'2014-09-21' limit 20; +---------------------+------------+ | DateTime | Traffic_in | +---------------------+------------+ | 2014-09-20 00:00:55 | 0.10 | | 2014-09-20 00:01:55 | 0.09 | | 2014-09-20 00:02:55 | 0.07 | | 2014-09-20 00:03:55 | 0.05 | | 2014-09-20 00:04:55 | 0.03 | | 2014-09-20 00:05:55 | 0.06 | | 2014-09-20 00:06:55 | 0.12 | | 2014-09-20 00:07:55 | 0.05 | | 2014-09-20 00:08:55 | 0.10 | | 2014-09-20 00:09:55 | 0.10 | | 2014-09-20 00:10:55 | 0.12 | | 2014-09-20 00:11:55 | 0.12 | | 2014-09-20 00:12:55 | 0.13 | | 2014-09-20 00:13:55 | 3.16 | | 2014-09-20 00:14:55 | 0.23 | | 2014-09-20 00:15:55 | 0.24 | | 2014-09-20 00:16:55 | 0.26 | | 2014-09-20 00:17:55 | 0.23 | | 2014-09-20 00:18:55 | 0.14 | | 2014-09-20 00:19:55 | 0.16 | +---------------------+------------+ 20 rows in set (0.82 sec)
主機流出流量：
mysql> select from_unixtime(clock) as DateTime,round(value/1024/1024,2) as Traffic_out from history_uint where itemid="58860" and from_unixtime(clock)>='2014-09-20' and from_unixtime(clock)<'2014-09-21' limit 20; +---------------------+-------------+ | DateTime | Traffic_out | +---------------------+-------------+ | 2014-09-20 00:00:00 | 4.13 | | 2014-09-20 00:01:00 | 3.21 | | 2014-09-20 00:02:00 | 2.18 | | 2014-09-20 00:03:01 | 1.61 | | 2014-09-20 00:04:00 | 1.07 | | 2014-09-20 00:05:00 | 0.92 | | 2014-09-20 00:06:00 | 1.23 | | 2014-09-20 00:07:00 | 2.76 | | 2014-09-20 00:08:00 | 1.35 | | 2014-09-20 00:09:00 | 3.11 | | 2014-09-20 00:10:00 | 2.99 | | 2014-09-20 00:11:00 | 2.68 | | 2014-09-20 00:12:00 | 2.55 | | 2014-09-20 00:13:00 | 2.89 | | 2014-09-20 00:14:00 | 4.98 | | 2014-09-20 00:15:00 | 6.56 | | 2014-09-20 00:16:00 | 7.34 | | 2014-09-20 00:17:00 | 6.81 | | 2014-09-20 00:18:00 | 7.67 | | 2014-09-20 00:19:00 | 4.11 | +---------------------+-------------+ 20 rows in set (0.74 sec)
4）如果是兩臺設備，彙總流量，假如公司出口有兩臺設備，可以用下面的SQL語句彙總每天的流量。下面SQL語句是彙總上面主機網卡的進出流量的。
mysql> select from_unixtime(clock,"%Y-%m-%d %H:%i") as DateTime,sum(round(value/1024/1024,2)) as Traffic_total from history_uint where itemid in (58855,58860) and from_unixtime(clock)>='2014-09-20'and from_unixtime(clock)<'2014-09-21' group by from_unixtime(clock,"%Y-%m-%d %H:%i") limit 20; +------------------+---------------+ | DateTime | Traffic_total | +------------------+---------------+ | 2014-09-20 00:00 | 4.23 | | 2014-09-20 00:01 | 3.30 | | 2014-09-20 00:02 | 2.25 | | 2014-09-20 00:03 | 1.66 | | 2014-09-20 00:04 | 1.10 | | 2014-09-20 00:05 | 0.98 | | 2014-09-20 00:06 | 1.35 | | 2014-09-20 00:07 | 2.81 | | 2014-09-20 00:08 | 1.45 | | 2014-09-20 00:09 | 3.21 | | 2014-09-20 00:10 | 3.11 | | 2014-09-20 00:11 | 2.80 | | 2014-09-20 00:12 | 2.68 | | 2014-09-20 00:13 | 6.05 | | 2014-09-20 00:14 | 5.21 | | 2014-09-20 00:15 | 6.80 | | 2014-09-20 00:16 | 7.60 | | 2014-09-20 00:17 | 7.04 | | 2014-09-20 00:18 | 7.81 | | 2014-09-20 00:19 | 4.27 | +------------------+---------------+ 20 rows in set (1.52 sec)
5)查詢一天中主機流量的最大值，最小值和平均值。
mysql> select date as DateTime,round(min(traffic)/2014/1024,2) as TotalMinIN,round(avg(traffic)/1024/1024,2) as TotalAvgIN,round(max(traffic)/1024/1024,2) as TotalMaxIN from (select from_unixtime(clock,"%Y-%m-%d") as date,sum(value) as traffic from history_uint where itemid in (58855,58860) and from_unixtime(clock)>='2014-09-20' and from_unixtime(clock)<'2014-09-21' group by from_unixtime(clock,"%Y-%m-%d %H:%i") ) tmp; +------------+------------+------------+------------+ | DateTime | TotalMinIN | TotalAvgIN | TotalMaxIN | +------------+------------+------------+------------+ | 2014-09-20 | 0.01 | 4.63 | 191.30 | +------------+------------+------------+------------+ 1 row in set (1.74 sec)
6）查詢主機組裏面所有主機CPU Idle平均值（原始值）。
mysql> select from_unixtime(hi.clock,"%Y-%m-%d %H:%i") as DateTime,g.name as Group_Name,h.host as Host, hi.value as Cpu_Avg_Idle from hosts_groups as hg join groups g on g.groupid = hg.groupid join items i on hg.hostid = i.hostid join hosts h on h.hostid=i.hostid join history hi on i.itemid = hi.itemid where g.name='上海機房--項目測試' and i.key_='system.cpu.util[,idle]' and from_unixtime(clock)>='2014-09-24' and from_unixtime(clock)<'2014-09-25' group by h.host,from_unixtime(hi.clock,"%Y-%m-%d %H:%i") limit 10; +------------------+----------------------------+----------+--------------+ | DateTime | Group_Name | Host | Cpu_Avg_Idle | +------------------+----------------------------+----------+--------------+ | 2014-09-24 00:02 | 上海機房--項目測試 | testwb01 | 94.3960 | | 2014-09-24 00:07 | 上海機房--項目測試 | testwb01 | 95.2086 | | 2014-09-24 00:12 | 上海機房--項目測試 | testwb01 | 95.4308 | | 2014-09-24 00:17 | 上海機房--項目測試 | testwe01 | 95.4580 | | 2014-09-24 00:22 | 上海機房--項目測試 | testwb01 | 95.4611 | | 2014-09-24 00:27 | 上海機房--項目測試 | testwb01 | 95.2939 | | 2014-09-24 00:32 | 上海機房--項目測試 | testwb01 | 96.0896 | | 2014-09-24 00:37 | 上海機房--項目測試 | testwb01 | 96.5286 | | 2014-09-24 00:42 | 上海機房--項目測試 | testwb01 | 96.8086 | | 2014-09-24 00:47 | 上海機房--項目測試 | testwb01 | 96.6854 | +------------------+----------------------------+----------+--------------+ 10 rows in set (0.75 sec)
7)查詢主機組裏面所有主機CPU Idle平均值（彙總值）。
mysql> select from_unixtime(hi.clock,"%Y-%m-%d %H:%i") as Date,g.name as Group_Name,h.host as Host, hi.value_avg as Cpu_Avg_Idle from hosts_groups as hg join groups g on g.groupid = hg.groupid join items i on hg.hostid = i.hostid join hosts h on h.hostid=i.hostid join trends hi on i.itemid = hi.itemid where g.name='上海機房--項目測試' and i.key_='system.cpu.util[,idle]' and from_unixtime(clock)>='2014-09-10' and from_unixtime(clock)<'2014-09-11' group by h.host,from_unixtime(hi.clock,"%Y-%m-%d %H:%i") limit 10; +------------------+----------------------------+----------+--------------+ | Date | Group_Name | Host | Cpu_Avg_Idle | +------------------+----------------------------+----------+--------------+ | 2014-09-10 00:00 | 上海機房--項目測試 | testwb01 | 99.9826 | | 2014-09-10 01:00 | 上海機房--項目測試 | testwb01 | 99.9826 | | 2014-09-10 02:00 | 上海機房--項目測試 | testwb01 | 99.9825 | | 2014-09-10 03:00 | 上海機房--項目測試 | testwb01 | 99.9751 | | 2014-09-10 04:00 | 上海機房--項目測試 | testwb01 | 99.9843 | | 2014-09-10 05:00 | 上海機房--項目測試 | testwb01 | 99.9831 | | 2014-09-10 06:00 | 上海機房--項目測試 | testwb01 | 99.9829 | | 2014-09-10 07:00 | 上海機房--項目測試 | testwb01 | 99.9843 | | 2014-09-10 08:00 | 上海機房--項目測試 | testwb01 | 99.9849 | | 2014-09-10 09:00 | 上海機房--項目測試 | testwb01 | 99.9849 | +------------------+----------------------------+----------+--------------+ 10 rows in set (0.01 sec)
8）其它與Zabbix相關的SQL語句。
查詢主機已經添加但沒有開啓監控主機：
select host from hosts where status=1;
查詢NVPS的值：
mysql> SELECT round(SUM(1.0/i.delay),2) AS qps FROM items i,hosts h WHERE i.status='0' AND i.hostid=h.hostid AND h.status='0' AND i.delay<>0; +--------+ | qps | +--------+ | 503.40 | +--------+ 1 row in set (0.11 sec)
查詢IDC機房的資產信息：
mysql> select name,os,tag,hardware from host_inventory where hostid in (select hostid from hosts_groups where groupid=69) limit 2; +-------+----------------------------+------+-------------------+ | name | os | tag | hardware | +-------+----------------------------+------+-------------------+ | SHDBM | CentOS release 5.2 (Final) | i686 | ProLiant DL360 G5 | | SHDBS | CentOS release 5.2 (Final) | i686 | ProLiant DL360 G5 | +-------+----------------------------+------+-------------------+ 2 rows in set (0.00 sec)
查詢Zabbix interval分佈情況：
mysql> select delay,count(*),concat(round(count(*) / (select count(*) from items where status=0)*100,2),"%") as percent from items where status=0 group by delay order by 2 desc; +-------+----------+---------+ | delay | count(*) | percent | +-------+----------+---------+ | 3600 | 41168 | 38.92% | | 300 | 35443 | 33.51% | | 600 | 16035 | 15.16% | | 60 | 12178 | 11.51% | | 0 | 902 | 0.85% | | 36000 | 46 | 0.04% | | 30 | 1 | 0.00% | +-------+----------+---------+ 7 rows in set (0.68 sec)
總結：通過SQL語句可以查詢出任何監控項目的數據，並且在SQL語句的末尾通過into outfile '/tmp/zabbix_result.txt'直接把查詢的結果保存到系統上面，在通過腳本發送查詢結果到指定的用戶，實現自動化查詢的過程，網上很少有介紹Zabbix數據庫查詢的文章，希望對大家有所幫助。