近期公司準備對zabbix監控告警進行完善，之前的好多閾值設置不合理，現在分配風控部門的同事與我合作，一塊做這個事情；風控部門的同事主要對zabbix監控的歷史數據進行分析，建模，以設定一個較合理的閾值；我的任務是先從zabbix數據庫中取出相關監控項的歷史數據，比如一個月的數據；之前不知道怎麼取數，研究了兩天，重於有點收穫了，特此記錄下取出歷史數據的過程，如有錯誤，還請指出；
use zabbix；
1、先在hosts表中取出被監控主機的主機ip和主機id；
MariaDB [zabbix]> select host,hostid from hosts where host='10.20.8.100';
+-------------+--------+
| host | hostid |
+-------------+--------+
| 10.20.8.100 | 10172 |
+-------------+--------+
1 row in set (0.00 sec)
2、利用上面查處的hostid在items表中查詢該主機有那些監控項，itemid爲監控項的id，name爲監控項的名稱，key_爲鍵值，也就是表達式，怎麼對監控項取值；
MariaDB [zabbix]> select itemid,name,key_ from items where hostid=10172;
+--------+------------------------------------------------------------------+-------------------------------------------+
| itemid | name | key_ |
+--------+------------------------------------------------------------------+-------------------------------------------+
| 36319 | Host name of zabbix_agentd running | agent.hostname |
| 36320 | Agent ping | agent.ping |
| 36321 | Version of zabbix_agent(d) running | agent.version |
| 36322 | Maximum number of opened files | kernel.maxfiles |
| 36323 | Maximum number of processes | kernel.maxproc |
| 36324 | Network interface discovery | net.if.discovery |
| 39561 | Incoming network traffic on $1 | net.if.in[eno16777984] |
| 36325 | Incoming network traffic on $1 | net.if.in[{#IFNAME}] |
| 39562 | Outgoing network traffic on $1 | net.if.out[eno16777984] |
| 36326 | Outgoing network traffic on $1 | net.if.out[{#IFNAME}] |
| 52385 | nginx status server accepts | nginx.status[accepts] |
| 52386 | nginx status connections active | nginx.status[active] |
| 52387 | nginx status server handled | nginx.status[handled] |
| 52388 | nginx status PING | nginx.status[ping] |
| 52389 | nginx status connections reading | nginx.status[reading] |
| 52390 | nginx status server requests | nginx.status[requests] |
| 52391 | nginx status connections waiting | nginx.status[waiting] |
| 52392 | nginx status connections writing | nginx.status[writing] |
| 36327 | Number of running processes | proc.num[,,run] |
| 36328 | Number of processes | proc.num[] |
| 36329 | Host boot time | system.boottime |
| 36330 | Interrupts per second | system.cpu.intr |
| 36331 | Processor load (15 min average per core) | system.cpu.load[all,avg15] |
| 36332 | Processor load (1 min average per core) | system.cpu.load[all,avg1] |
| 36333 | Processor load (5 min average per core) | system.cpu.load[all,avg5] |
| 36334 | Context switches per second | system.cpu.switches |
| 36335 | CPU $2 time | system.cpu.util[,idle] |
| 36336 | CPU $2 time | system.cpu.util[,interrupt] |
| 36337 | CPU $2 time | system.cpu.util[,iowait] |
| 36338 | CPU $2 time | system.cpu.util[,nice] |
| 36339 | CPU $2 time | system.cpu.util[,softirq] |
| 36340 | CPU $2 time | system.cpu.util[,steal] |
| 36341 | CPU $2 time | system.cpu.util[,system] |
| 36342 | CPU $2 time | system.cpu.util[,user] |
| 36343 | Host name | system.hostname |
| 36344 | Host local time | system.localtime |
| 36345 | Free swap space | system.swap.size[,free] |
| 36346 | Free swap space in % | system.swap.size[,pfree] |
| 36347 | System information | system.uname |
| 36348 | System uptime | system.uptime |
| 36349 | Number of logged in users | system.users.num |
| 128437 | tomcat報錯 | tomcat_monitor |
| 36350 | Checksum of $1 | vfs.file.cksum[/etc/passwd] |
| 36351 | Mounted filesystem discovery | vfs.fs.discovery |
| 39563 | Free inodes on $1 (percentage) | vfs.fs.inode[/,pfree] |
| 39564 | Free inodes on $1 (percentage) | vfs.fs.inode[/boot,pfree] |
| 52913 | Free inodes on $1 (percentage) | vfs.fs.inode[/data/lifeCircleMerch,pfree] |
| 36352 | Free inodes on $1 (percentage) | vfs.fs.inode[{#FSNAME},pfree] |
| 39565 | Free disk space on $1 | vfs.fs.size[/,free] |
| 39567 | Free disk space on $1 (percentage) | vfs.fs.size[/,pfree] |
| 39569 | Total disk space on $1 | vfs.fs.size[/,total] |
| 39571 | Used disk space on $1 | vfs.fs.size[/,used] |
| 39566 | Free disk space on $1 | vfs.fs.size[/boot,free] |
| 39568 | Free disk space on $1 (percentage) | vfs.fs.size[/boot,pfree] |
| 39570 | Total disk space on $1 | vfs.fs.size[/boot,total] |
| 39572 | Used disk space on $1 | vfs.fs.size[/boot,used] |
| 52914 | Free disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,free] |
| 52915 | Free disk space on $1 (percentage) | vfs.fs.size[/data/lifeCircleMerch,pfree] |
| 52916 | Total disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,total] |
| 52917 | Used disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,used] |
| 36353 | Free disk space on $1 | vfs.fs.size[{#FSNAME},free] |
| 36354 | Free disk space on $1 (percentage) | vfs.fs.size[{#FSNAME},pfree] |
| 36355 | Total disk space on $1 | vfs.fs.size[{#FSNAME},total] |
| 36356 | Used disk space on $1 | vfs.fs.size[{#FSNAME},used] |
| 39676 | Inactive + cached + free memory | vm.memory.size[available] |
| 39677 | Cache for things like file system metadata | vm.memory.size[buffers] |
| 39678 | Cache for various things | vm.memory.size[cached] |
| 39679 | Memory that is readily available to any entity requesting memory | vm.memory.size[free] |
| 39680 | Inactive + cached + free memory in relation to 'total' in % | vm.memory.size[pavailable] |
| 39681 | Active + wired memory in relation to total in % | vm.memory.size[pused] |
| 39682 | Total physical memory available | vm.memory.size[total] |
| 39683 | Active + wired memory | vm.memory.size[used] |
+--------+------------------------------------------------------------------+-------------------------------------------+
72 rows in set (0.00 sec)
3、以下面的監控項爲例子，進行取值歷史數據
監控項：CPU user time
| itemid | name | key_ |
| 36342 | CPU $2 time | system.cpu.util[,user] |
Zabbix中存儲歷史數據的表是以history開頭的，目前zabbix 4.2 中主要有以下幾張表。
history Numeric(float)
history_log -log
history_str -Character
history_text -text
history_uint -Numeric(unsigned)
MariaDB [zabbix]> desc history;
+--------+---------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+--------+---------------------+------+-----+---------+-------+
| itemid | bigint(20) unsigned | NO | MUL | NULL |監控項id|
| clock | int(11) | NO | | 0 |時間戳 |
| value | double(16,4) | NO | | 0.0000 |監控項值|
| ns | int(11) | NO | | 0 | |
+--------+---------------------+------+-----+---------+-------+
4 rows in set (0.00 sec)
查詢半個月的數據
select itemid,from_unixtime(clock) as time,value from history where itemid=36342 and clock >= unix_timestamp('2019/05/01 00:00:00') and clock <= unix_timestamp('2019/05/16 00:00:00');
+--------+---------------------+---------+
| itemid | time | value |
+--------+---------------------+---------+
| 36342 | 2019-05-08 20:39:42 | 2.8362 |
| 36342 | 2019-05-08 20:40:42 | 3.4503 |
| 36342 | 2019-05-08 20:41:42 | 2.7704 |
| 36342 | 2019-05-08 20:42:42 | 2.5180 |
| 36342 | 2019-05-08 20:43:42 | 2.5769 |
| 36342 | 2019-05-08 20:44:42 | 2.7991 |
| 36342 | 2019-05-08 20:45:42 | 2.9668 |
| 36342 | 2019-05-08 20:46:42 | 2.4573 |
| 36342 | 2019-05-08 20:47:42 | 2.4801 |
| 36342 | 2019-05-08 20:48:42 | 2.4218 |
| 36342 | 2019-05-08 20:49:42 | 2.5934 |
| 36342 | 2019-05-08 20:50:42 | 3.5542 |
| 36342 | 2019-05-08 20:51:42 | 2.7452 |
| 36342 | 2019-05-08 20:52:42 | 2.4514 |
| 36342 | 2019-05-08 20:53:42 | 2.4313 |
| 36342 | 2019-05-08 20:54:42 | 2.4126 |
| 36342 | 2019-05-08 20:55:42 | 3.2328 |
| 36342 | 2019-05-08 20:56:42 | 2.7098 |
| 36342 | 2019-05-08 20:57:42 | 2.9196 |
| 36342 | 2019-05-08 20:58:42 | 2.5210 |
| 36342 | 2019-05-08 20:59:42 | 2.3487 |
| 36342 | 2019-05-08 21:00:42 | 2.6845 |
| 36342 | 2019-05-08 21:01:42 | 2.1861 |
| 36342 | 2019-05-08 21:02:42 | 2.1778 |
| 36342 | 2019-05-08 21:03:42 | 2.6672 |
| 36342 | 2019-05-08 21:04:42 | 2.4291 |
| 36342 | 2019-05-08 21:05:42 | 2.9483 |
| 36342 | 2019-05-08 21:06:42 | 2.3956 |
| 36342 | 2019-05-08 21:07:42 | 2.2232 |
| 36342 | 2019-05-08 21:08:42 | 2.4544 |
| 36342 | 2019-05-08 21:09:42 | 2.2823 |
| 36342 | 2019-05-08 21:10:42 | 2.8147 |
| 36342 | 2019-05-08 21:11:42 | 2.2619 |
| 36342 | 2019-05-08 21:12:42 | 3.3703 |
...............
此處以部分數據作爲展示，數據太多
擴張：
from_unixtime()函數是將時間戳轉換爲格式化時間，人類可讀；
unix_timestamp()函數是將格式化時間轉換爲時間戳，計算機可讀；
MariaDB [zabbix]> select * from history limit 3;
+--------+------------+--------+-----------+
| itemid | clock | value | ns |
+--------+------------+--------+-----------+
| 129524 | 1538271759 | 0.0000 | 208189217 |
| 129524 | 1538271879 | 0.0000 | 32806085 |
| 129524 | 1538271998 | 0.0000 | 965794957 |
+--------+------------+--------+-----------+
3 rows in set (0.00 sec)
MariaDB [zabbix]> select from_unixtime('1538271759');
+-----------------------------+
| from_unixtime('1538271759') |
+-----------------------------+
| 2018-09-30 09:42:39 |
+-----------------------------+
1 row in set (0.00 sec)
MariaDB [zabbix]> select unix_timestamp('2019/05/16 00:00:00');
+---------------------------------------+
| unix_timestamp('2019/05/16 00:00:00') |
+---------------------------------------+
| 1557936000 |
+---------------------------------------+
1 row in set (0.01 sec)
完畢，待後續有其他的繼續更新、、、
參考：https://blog.51cto.com/nanwangting/1048493
附：zabbix根據不同的時間段設置不同的閾值，例如早上09:00:00-晚上21:00:00爲白天段；晚上21:00:00到第二天早上09:00:00爲夜間段；
