While SNMP is the preferred monitoring method for most network devices, servers and workstations often require deeper visibility than SNMP can provide. This is the role of the Zabbix Agent.
The agent collects operating system metrics directly from the monitored host and enables detailed performance monitoring, service validation and application-specific checks. Because it operates locally, it has access to information that is either unavailable or impractical to retrieve through external polling.
For most enterprise environments, agent-based monitoring should be considered the primary method for Linux and Windows systems.
A Zabbix Agent can collect a broad range of operational metrics, including:
Unlike SNMP, the agent understands the operating system it is running on, making it suitable for monitoring business services as well as infrastructure.
Current enterprise deployments should use Zabbix Agent 2 unless compatibility requirements dictate otherwise.
Agent 2 provides a modern architecture with improved extensibility and supports numerous plugins for technologies such as:
Selecting Agent 2 also simplifies future upgrades as new functionality is increasingly delivered through plugins rather than the legacy agent.
The Zabbix Agent supports two communication models.
With passive monitoring, the Zabbix Server or Proxy connects to the agent and requests data.
Zabbix Server
│
▼
Zabbix Agent
This approach is simple and easy to troubleshoot, making it suitable for internal networks where direct connectivity exists.
With active monitoring, the agent initiates communication with the Zabbix Server or Proxy.
Zabbix Agent
│
▼
Zabbix Server
This model is particularly useful for:
Because the monitored host establishes the connection, fewer inbound firewall rules are required.
Neither method is universally better.
A common enterprise design is:
| Environment | Recommended method |
|---|---|
| Internal servers | Passive |
| Remote offices | Active |
| Cloud workloads | Active |
| Workstations | Active |
| High-security internal servers | Passive or Hybrid |
Many organizations successfully operate a hybrid environment where both methods coexist.
Remote systems should generally communicate with a local Zabbix Proxy rather than directly with the central server.
Central Zabbix Server
│
▼
Zabbix Proxy
│
▼
Linux / Windows Hosts
This reduces WAN dependency, allows local buffering during outages and simplifies firewall configuration.
The operating system template forms the foundation of agent monitoring.
Typical examples include:
Additional templates should be linked only when required by the server’s role.
For example, a PostgreSQL database server may inherit:
A domain controller or web server should receive a different set of templates.
The monitoring configuration should reflect the purpose of the system rather than the operating system alone.
One of the greatest strengths of the Zabbix Agent is the ability to collect organization-specific metrics.
Examples include:
These checks allow monitoring to move beyond infrastructure and measure actual business availability.
Whenever possible, custom checks should return structured and predictable values that can be reused across multiple hosts.
Because the Zabbix Agent communicates with privileged operating system components, security should be considered from the beginning.
Recommended practices include:
Monitoring systems often become trusted infrastructure. Protect them accordingly.
The Zabbix Agent has a very small resource footprint under normal circumstances.
Performance problems usually result from poor monitoring design rather than the agent itself.
Examples include:
Before adding a new item, ask whether the collected information will support:
If the answer is no, the metric may not be worth collecting.
Enterprise environments benefit from standardized deployment.
A consistent rollout should include:
Avoid configuring every server individually. Consistency greatly reduces long-term operational effort.
The following issues are frequently encountered in production environments:
Most of these problems can be avoided through standardization.
The Zabbix Agent provides deep operating system visibility that cannot be achieved through SNMP alone.
A successful enterprise deployment emphasizes consistency over customization. Standardized templates, secure communication and well-designed custom checks create a monitoring platform that scales with the infrastructure instead of becoming increasingly difficult to maintain.
The next chapter introduces web monitoring and explains how Zabbix can validate websites, APIs and business-critical online services from an end-user perspective.