zabbix查询历史数据
近期公司准备对zabbix监控告警进行完善，之前的好多阈值设置不合理，现在分配风控部门的同事与我合作，一块做这个事情；风控部门的同事主要对zabbix监控的历史数据进行分析，建模，以设定一个较合理的阈值；我的任务是先从zabbix数据库中取出相关监控项的历史数据，比如一个月的数据；之前不知道怎么取数，研究了两天，重于有点收获了，特此记录下取出历史数据的过程，如有错误，还请指出；
use zabbix；
1、先在hosts表中取出被监控主机的主机ip和主机id；
MariaDB [zabbix]> select host,hostid from hosts where host='10.20.8.100';
+-------------+--------+
| host | hostid |
+-------------+--------+
| 10.20.8.100 | 10172 |
+-------------+--------+
1 row in set (0.00 sec)
2、利用上面查处的hostid在items表中查询该主机有那些监控项，itemid为监控项的id，name为监控项的名称，key_为键值，也就是表达式，怎么对监控项取值；
MariaDB [zabbix]> select itemid,name,key_ from items where hostid=10172;
+--------+------------------------------------------------------------------+-------------------------------------------+
| itemid | name | key_ |
+--------+------------------------------------------------------------------+-------------------------------------------+
| 36319 | Host name of zabbix_agentd running | agent.hostname |
| 36320 | Agent ping | agent.ping |
| 36321 | Version of zabbix_agent(d) running | agent.version |
| 36322 | Maximum number of opened files | kernel.maxfiles |
| 36323 | Maximum number of processes | kernel.maxproc |
| 36324 | Network interface discovery | net.if.discovery |
| 39561 | Incoming network traffic on $1 | net.if.in[eno16777984] |
| 36325 | Incoming network traffic on $1 | net.if.in[{#IFNAME}] |
| 39562 | Outgoing network traffic on $1 | net.if.out[eno16777984] |
| 36326 | Outgoing network traffic on $1 | net.if.out[{#IFNAME}] |
| 52385 | nginx status server accepts | nginx.status[accepts] |
| 52386 | nginx status connections active | nginx.status[active] |
| 52387 | nginx status server handled | nginx.status[handled] |
| 52388 | nginx status PING | nginx.status[ping] |
| 52389 | nginx status connections reading | nginx.status[reading] |
| 52390 | nginx status server requests | nginx.status[requests] |
| 52391 | nginx status connections waiting | nginx.status[waiting] |
| 52392 | nginx status connections writing | nginx.status[writing] |
| 36327 | Number of running processes | proc.num[,,run] |
| 36328 | Number of processes | proc.num[] |
| 36329 | Host boot time | system.boottime |
| 36330 | Interrupts per second | system.cpu.intr |
| 36331 | Processor load (15 min average per core) | system.cpu.load[all,avg15] |
| 36332 | Processor load (1 min average per core) | system.cpu.load[all,avg1] |
| 36333 | Processor load (5 min average per core) | system.cpu.load[all,avg5] |
| 36334 | Context switches per second | system.cpu.switches |
| 36335 | CPU $2 time | system.cpu.util[,idle] |
| 36336 | CPU $2 time | system.cpu.util[,interrupt] |
| 36337 | CPU $2 time | system.cpu.util[,iowait] |
| 36338 | CPU $2 time | system.cpu.util[,nice] |
| 36339 | CPU $2 time | system.cpu.util[,softirq] |
| 36340 | CPU $2 time | system.cpu.util[,steal] |
| 36341 | CPU $2 time | system.cpu.util[,system] |
| 36342 | CPU $2 time | system.cpu.util[,user] |
| 36343 | Host name | system.hostname |
| 36344 | Host local time | system.localtime |
| 36345 | Free swap space | system.swap.size[,free] |
| 36346 | Free swap space in % | system.swap.size[,pfree] |
| 36347 | System information | system.uname |
| 36348 | System uptime | system.uptime |
| 36349 | Number of logged in users | system.users.num |
| 128437 | tomcat报错 | tomcat_monitor |
| 36350 | Checksum of $1 | vfs.file.cksum[/etc/passwd] |
| 36351 | Mounted filesystem discovery | vfs.fs.discovery |
| 39563 | Free inodes on $1 (percentage) | vfs.fs.inode[/,pfree] |
| 39564 | Free inodes on $1 (percentage) | vfs.fs.inode[/boot,pfree] |
| 52913 | Free inodes on $1 (percentage) | vfs.fs.inode[/data/lifeCircleMerch,pfree] |
| 36352 | Free inodes on $1 (percentage) | vfs.fs.inode[{#FSNAME},pfree] |
| 39565 | Free disk space on $1 | vfs.fs.size[/,free] |
| 39567 | Free disk space on $1 (percentage) | vfs.fs.size[/,pfree] |
| 39569 | Total disk space on $1 | vfs.fs.size[/,total] |
| 39571 | Used disk space on $1 | vfs.fs.size[/,used] |
| 39566 | Free disk space on $1 | vfs.fs.size[/boot,free] |
| 39568 | Free disk space on $1 (percentage) | vfs.fs.size[/boot,pfree] |
| 39570 | Total disk space on $1 | vfs.fs.size[/boot,total] |
| 39572 | Used disk space on $1 | vfs.fs.size[/boot,used] |
| 52914 | Free disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,free] |
| 52915 | Free disk space on $1 (percentage) | vfs.fs.size[/data/lifeCircleMerch,pfree] |
| 52916 | Total disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,total] |
| 52917 | Used disk space on $1 | vfs.fs.size[/data/lifeCircleMerch,used] |
| 36353 | Free disk space on $1 | vfs.fs.size[{#FSNAME},free] |
| 36354 | Free disk space on $1 (percentage) | vfs.fs.size[{#FSNAME},pfree] |
| 36355 | Total disk space on $1 | vfs.fs.size[{#FSNAME},total] |
| 36356 | Used disk space on $1 | vfs.fs.size[{#FSNAME},used] |
| 39676 | Inactive + cached + free memory | vm.memory.size[available] |
| 39677 | Cache for things like file system metadata | vm.memory.size[buffers] |
| 39678 | Cache for various things | vm.memory.size[cached] |
| 39679 | Memory that is readily available to any entity requesting memory | vm.memory.size[free] |
| 39680 | Inactive + cached + free memory in relation to 'total' in % | vm.memory.size[pavailable] |
| 39681 | Active + wired memory in relation to total in % | vm.memory.size[pused] |
| 39682 | Total physical memory available | vm.memory.size[total] |
| 39683 | Active + wired memory | vm.memory.size[used] |
+--------+------------------------------------------------------------------+-------------------------------------------+
72 rows in set (0.00 sec)
3、以下面的监控项为例子，进行取值历史数据
监控项：CPU user time
| itemid | name | key_ |
| 36342 | CPU $2 time | system.cpu.util[,user] |
Zabbix中存储历史数据的表是以history开头的，目前zabbix 4.2 中主要有以下几张表。
history Numeric(float)
history_log -log
history_str -Character
history_text -text
history_uint -Numeric(unsigned)
MariaDB [zabbix]> desc history;
+--------+---------------------+------+-----+---------+-------+
| Field | Type | Null | Key | Default | Extra |
+--------+---------------------+------+-----+---------+-------+
| itemid | bigint(20) unsigned | NO | MUL | NULL |监控项id|
| clock | int(11) | NO | | 0 |时间戳 |
| value | double(16,4) | NO | | 0.0000 |监控项值|
| ns | int(11) | NO | | 0 | |
+--------+---------------------+------+-----+---------+-------+
4 rows in set (0.00 sec)
查询半个月的数据
select itemid,from_unixtime(clock) as time,value from history where itemid=36342 and clock >= unix_timestamp('2019/05/01 00:00:00') and clock <= unix_timestamp('2019/05/16 00:00:00');
+--------+---------------------+---------+
| itemid | time | value |
+--------+---------------------+---------+
| 36342 | 2019-05-08 20:39:42 | 2.8362 |
| 36342 | 2019-05-08 20:40:42 | 3.4503 |
| 36342 | 2019-05-08 20:41:42 | 2.7704 |
| 36342 | 2019-05-08 20:42:42 | 2.5180 |
| 36342 | 2019-05-08 20:43:42 | 2.5769 |
| 36342 | 2019-05-08 20:44:42 | 2.7991 |
| 36342 | 2019-05-08 20:45:42 | 2.9668 |
| 36342 | 2019-05-08 20:46:42 | 2.4573 |
| 36342 | 2019-05-08 20:47:42 | 2.4801 |
| 36342 | 2019-05-08 20:48:42 | 2.4218 |
| 36342 | 2019-05-08 20:49:42 | 2.5934 |
| 36342 | 2019-05-08 20:50:42 | 3.5542 |
| 36342 | 2019-05-08 20:51:42 | 2.7452 |
| 36342 | 2019-05-08 20:52:42 | 2.4514 |
| 36342 | 2019-05-08 20:53:42 | 2.4313 |
| 36342 | 2019-05-08 20:54:42 | 2.4126 |
| 36342 | 2019-05-08 20:55:42 | 3.2328 |
| 36342 | 2019-05-08 20:56:42 | 2.7098 |
| 36342 | 2019-05-08 20:57:42 | 2.9196 |
| 36342 | 2019-05-08 20:58:42 | 2.5210 |
| 36342 | 2019-05-08 20:59:42 | 2.3487 |
| 36342 | 2019-05-08 21:00:42 | 2.6845 |
| 36342 | 2019-05-08 21:01:42 | 2.1861 |
| 36342 | 2019-05-08 21:02:42 | 2.1778 |
| 36342 | 2019-05-08 21:03:42 | 2.6672 |
| 36342 | 2019-05-08 21:04:42 | 2.4291 |
| 36342 | 2019-05-08 21:05:42 | 2.9483 |
| 36342 | 2019-05-08 21:06:42 | 2.3956 |
| 36342 | 2019-05-08 21:07:42 | 2.2232 |
| 36342 | 2019-05-08 21:08:42 | 2.4544 |
| 36342 | 2019-05-08 21:09:42 | 2.2823 |
| 36342 | 2019-05-08 21:10:42 | 2.8147 |
| 36342 | 2019-05-08 21:11:42 | 2.2619 |
| 36342 | 2019-05-08 21:12:42 | 3.3703 |
...............
此处以部分数据作为展示，数据太多
扩张：
from_unixtime()函数是将时间戳转换为格式化时间，人类可读；
unix_timestamp()函数是将格式化时间转换为时间戳，计算机可读；
MariaDB [zabbix]> select * from history limit 3;
+--------+------------+--------+-----------+
| itemid | clock | value | ns |
+--------+------------+--------+-----------+
| 129524 | 1538271759 | 0.0000 | 208189217 |
| 129524 | 1538271879 | 0.0000 | 32806085 |
| 129524 | 1538271998 | 0.0000 | 965794957 |
+--------+------------+--------+-----------+
3 rows in set (0.00 sec)
MariaDB [zabbix]> select from_unixtime('1538271759');
+-----------------------------+
| from_unixtime('1538271759') |
+-----------------------------+
| 2018-09-30 09:42:39 |
+-----------------------------+
1 row in set (0.00 sec)
MariaDB [zabbix]> select unix_timestamp('2019/05/16 00:00:00');
+---------------------------------------+
| unix_timestamp('2019/05/16 00:00:00') |
+---------------------------------------+
| 1557936000 |
+---------------------------------------+
1 row in set (0.01 sec)
完毕，待后续有其他的继续更新、、、
参考：https://blog.51cto.com/nanwangting/1048493
附：zabbix根据不同的时间段设置不同的阈值，例如早上09:00:00-晚上21:00:00为白天段；晚上21:00:00到第二天早上09:00:00为夜间段；
