NOC Monitoring with Zabbix

Deploy Zabbix to monitor services, configure alerts, and run incident response.

Introduction

30 Second Summary

When a website goes down or a server crashes, someone in a Network Operations Center is the first to know. These analysts monitor dozens of systems around the clock, detect problems in seconds, and coordinate the response that gets services back online.

In this project, you will build a complete NOC monitoring lab using Zabbix on a virtual machine. You'll configure alerts, simulate a real outage, and walk through the incident response workflow that NOC analysts perform every shift.

What You'll Build

A fully operational Zabbix 7.0 LTS monitoring server running on Ubuntu Server 24.04 in Hyper-V that detects host and service failures in real time.

By the end of this project, you'll have:

  • A running Zabbix monitoring server with a web dashboard accessible from your Windows host.
  • Custom alert triggers configured with NOC-standard severity levels like Warning, High, and Disaster.
  • A simulated service outage with full incident documentation covering detection, triage, acknowledgment, and resolution.
  • Secret Mission: Configure automated alert escalation that notifies your team and auto-escalates unacknowledged critical alerts.

Are there any prerequisites?

You need a Windows machine with Hyper-V enabled. Basic familiarity with the command line is helpful but not required.

Set Up the Ubuntu Server VM in Hyper-V

Every monitoring system needs a server to run on. In a real NOC environment, Zabbix runs on dedicated Linux servers that collect metrics from hundreds of devices across the network.

In this step, you will create a virtual machine using Hyper-V, install Ubuntu Server 24.04 LTS on it, and confirm the VM can reach the internet. This VM becomes the foundation for your entire monitoring lab.

In this step, get ready to:
  • Create a Generation 2 VM in Hyper-V Manager with 2 GB RAM and a 25 GB virtual hard disk.
  • Install Ubuntu Server 24.04 LTS with SSH access enabled.
  • Verify network connectivity and update all system packages.
Create a new VM in Hyper-V Manager

You need a virtual machine to host your Zabbix server. The VM acts as an isolated Linux server running inside your Windows machine.

  • Download the Ubuntu Server 24.04 LTS ISO from ubuntu.com/download/server.
  • Save the ISO file somewhere you can find it easily (like your Downloads folder).
  • Press the Windows key to open your search bar.
  • Type Hyper-V Manager and press Enter to open it.
  • In the left pane, select your computer name under Hyper-V Manager.
  • In the Actions pane on the right, click New, then click Virtual Machine.
  • The New Virtual Machine Wizard opens. Click Next.

Now walk through the wizard pages one at a time.

  • On the Specify Name and Location page, enter zabbix-noc as the name. Click Next.
  • On the Specify Generation page, select Generation 2. Click Next.
  • On the Assign Memory page, set Startup memory to 2048 MB. Click Next.
  • On the Configure Networking page, select Default Switch from the dropdown. Click Next.
  • On the Connect Virtual Hard Disk page, keep Create a virtual hard disk selected and set the size to 25 GB. Click Next.
  • On the Installation Options page, select Install an operating system from a bootable image file. Click Browse and select the Ubuntu Server 24.04 LTS ISO you downloaded. Click Next.
  • Review the summary and click Finish.

Before starting the VM, you need to configure the Secure Boot template for Linux compatibility.

  • In Hyper-V Manager, right-click zabbix-noc and select Settings.
  • In the left pane, click Security.
  • Under Secure Boot, change the template dropdown from Microsoft Windows to Microsoft UEFI Certificate Authority.
  • Click OK.

Why change the Secure Boot template?

Generation 2 VMs have Secure Boot enabled by default with the Microsoft Windows template. Linux operating systems like Ubuntu need the Microsoft UEFI Certificate Authority template to boot properly. Without this change, your VM may fail to start.

Don't see Default Switch in the networking dropdown?

Default Switch is automatically created when Hyper-V is enabled. If it is missing, open PowerShell as Administrator and restart the Hyper-V Virtual Ethernet Adapter. You may need to disable and re-enable Hyper-V in Windows Features.

Help me troubleshoot my missing Default Switch in Hyper-V.

Install Ubuntu Server 24.04 LTS

With the VM created, you can now boot it from the ISO and install the operating system.

  • In Hyper-V Manager, right-click zabbix-noc and select Connect.
  • In the Virtual Machine Connection window that opens, click Start (the green play button).
  • The Ubuntu installer loads. Select your language and choose Install Ubuntu Server.
  • Accept the default keyboard layout and press Done.
  • On the network configuration screen, accept the default (the VM should already show an IP address from Default Switch). Press Done.
  • Skip the proxy configuration by pressing Done.
  • Accept the default Ubuntu archive mirror. Press Done.
  • On the storage configuration screen, accept the default disk partitioning. Press Done, then confirm by selecting Continue.
  • On the profile setup screen, enter your name, set the server name to zabbix-noc, choose a username, and set a password you will remember.
  • Skip Ubuntu Pro by selecting Continue.
  • On the SSH setup screen, check the box for Install OpenSSH server. Press Done.
  • Skip the featured server snaps screen by pressing Done.
  • Wait for the installation to complete. This takes a few minutes.
  • When you see Reboot Now, select it and press Enter.

What about removing the ISO?

The Ubuntu installer usually ejects the ISO automatically on reboot. If you see a message saying "Please remove the installation medium", just press Enter. Hyper-V handles this for you.

After the reboot, the VM presents a login prompt. Log in with the username and password you created during installation.

VM stuck on a black screen or won't boot?

If the VM hangs on a black screen after reboot, the Secure Boot template may still be set to the Windows template. Shut down the VM, go to Settings > Security, and confirm the template is set to Microsoft UEFI Certificate Authority. Then start the VM again.

Help me troubleshoot my Ubuntu VM not booting in Hyper-V.

Verify network connectivity and update packages

Before installing Zabbix, you need to confirm the VM can reach the internet and that all system packages are up to date.

  • In the VM console, find your IP address by running this command:
ip addr

What should I see?

Look for an eth0 interface with an inet address like 172.x.x.x. This is your VM's IP address on the Default Switch network. Write this address down. You will need it to access the Zabbix web interface later.

  • Confirm internet access by running:
ping -c 4 8.8.8.8

You should see four successful replies with response times. Press Ctrl+C if the ping continues running.

  • Update all system packages by running:
sudo apt update && sudo apt upgrade -y

What does this command do?

The apt update part refreshes the list of available packages from Ubuntu's repositories. The apt upgrade -y part installs all available updates without prompting for confirmation. This ensures your server has the latest security patches before you install Zabbix.

This may take a couple of minutes depending on how many updates are available.

  • Now test that you can SSH into the VM from your Windows host. Open a new PowerShell window on your Windows machine and run:
ssh [[VMUSER="your-username"]]@[[VMIP="your-vm-ip-address"]]
  • Type yes when prompted to accept the fingerprint, then enter your password.

You should see the Ubuntu welcome banner and a command prompt. This confirms SSH is working.

SSH connection refused or timed out?

If the connection is refused, SSH may not be running. Log into the VM console directly and run sudo systemctl start ssh to start the SSH service. If the connection times out, double-check the IP address by running ip addr in the VM console.

Help me connect to my Ubuntu VM via SSH from Windows.

Your Ubuntu Server VM is ready to go. Next up, you will install Zabbix and its components directly on this server.

Install Zabbix Server, Frontend, and Agent

Your Ubuntu Server VM is running and accessible over SSH. Now you need to install the monitoring software stack that will power your NOC environment.

Zabbix requires a full LAMP stack to operate: a Linux OS (done), Apache as the web server, MySQL as the database, and PHP for the frontend. In this step, you will install all of these components and wire them together so the Zabbix web dashboard becomes accessible from your Windows host.

In this step, get ready to:
  • Install the Zabbix 7.0 LTS repository and packages.
  • Set up and configure MySQL as the Zabbix database.
  • Configure the Zabbix server and start all services.
Install the Zabbix 7.0 LTS repository and packages

Zabbix distributes its software through its own package repository. You need to add this repository to your Ubuntu system before you can install any Zabbix packages.

  • In your SSH session to the VM, download and install the Zabbix repository package by running these commands:
wget https://repo.zabbix.com/zabbix/7.0/ubuntu/pool/main/z/zabbix-release/zabbix-release_latest+ubuntu24.04_all.deb
sudo dpkg -i zabbix-release_latest+ubuntu24.04_all.deb
sudo apt update

What do these commands do?

  • wget downloads the Zabbix repository definition file for Ubuntu 24.04.
  • dpkg -i installs that file, which adds the Zabbix package source to your system.
  • apt update refreshes the package list so Ubuntu can see the newly available Zabbix packages.
  • Install the Zabbix server, frontend, and agent packages by running:
sudo apt install zabbix-server-mysql zabbix-frontend-php zabbix-apache-conf zabbix-sql-scripts zabbix-agent -y

What is each package for?

  • zabbix-server-mysql is the core monitoring engine that collects data and evaluates triggers.
  • zabbix-frontend-php is the PHP-based web dashboard you will access from your browser.
  • zabbix-apache-conf provides the Apache configuration to serve the frontend.
  • zabbix-sql-scripts contains the database schema that Zabbix needs to store its configuration and historical data.
  • zabbix-agent is the lightweight process that collects metrics from the host it runs on.
  • Confirm the installation succeeded by checking the Zabbix server version:
zabbix_server --version

You should see output showing Zabbix version 7.0 with a revision number.

Package not found?

  • Make sure you ran sudo apt update after installing the repository package. Without the refresh, Ubuntu cannot find the Zabbix packages.
  • Check that you downloaded the correct .deb file for Ubuntu 24.04. If you accidentally used a 22.04 package, re-run the wget command with the correct URL shown above.

Ask for help: Why can't Ubuntu find the Zabbix packages after I ran apt install?

Install and configure MySQL

Zabbix stores all of its configuration, collected metrics, and alert history in a database. You will set up MySQL as that database, create a dedicated user for Zabbix, and import the required schema.

  • Install MySQL server by running:
sudo apt install mysql-server -y
  • Verify MySQL is running:
sudo systemctl status mysql

You should see active (running) in the output. Press q to exit the status view.

  • Create the Zabbix database and user by running these commands one at a time:
sudo mysql -e "create database zabbix character set utf8mb4 collate utf8mb4_bin;"
sudo mysql -e "create user 'zabbix'@'localhost' identified by 'ZabbixN0C2024';"
sudo mysql -e "grant all privileges on zabbix.* to 'zabbix'@'localhost';"
sudo mysql -e "set global log_bin_trust_function_creators = 1;"

What do these database commands do?

The first command creates a database called zabbix with the utf8mb4 character set, which Zabbix requires for proper text handling.

The second and third commands create a dedicated MySQL user named zabbix with the password ZabbixN0C2024 and grant it full access to the zabbix database only.

The fourth command enables log_bin_trust_function_creators, which MySQL requires for importing the Zabbix schema when binary logging is active. You will disable this setting after the import.

  • Import the Zabbix database schema by running:
zcat /usr/share/zabbix-sql-scripts/mysql/server.sql.gz | mysql --default-character-set=utf8mb4 -uzabbix -p'ZabbixN0C2024' zabbix

What does the schema import do?

This command decompresses the Zabbix schema file (server.sql.gz) and pipes it into MySQL to create all the tables, indexes, and default data that Zabbix needs to operate. This process takes 30-60 seconds depending on your VM's performance.

  • After the import completes, disable the log_bin_trust_function_creators setting by running:
sudo mysql -e "set global log_bin_trust_function_creators = 0;"

Your database is now ready for Zabbix to use.

Schema import stuck or failing?

  • If you see an access denied error, double-check that the password ZabbixN0C2024 matches what you used in the create user command. They must be identical.
  • If the import seems to hang, give it time. The schema is large and can take up to a minute on a 2 GB RAM VM. Do not interrupt it.

Ask for help: Why is my Zabbix schema import to MySQL failing?

Configure the Zabbix server and start services

The Zabbix server process needs to know the database password so it can connect to MySQL. You also need to start the three services that make up the monitoring stack.

  • Open the Zabbix server configuration file by running:
sudo nano /etc/zabbix/zabbix_server.conf
  • Press Ctrl+W to open the search bar.
  • Type DBPassword and press Enter to jump to that line.
  • You will see a commented line that says # DBPassword= in the file.
  • Delete that line and type the following on a new line:
DBPassword=ZabbixN0C2024
  • Press Ctrl+O then Enter to save.
  • Press Ctrl+X to exit nano.

Why does Zabbix need this configuration?

The Zabbix server daemon reads /etc/zabbix/zabbix_server.conf at startup to learn how to connect to its database. Without the password, the server cannot authenticate with MySQL and will fail to start.

  • Start and enable the Zabbix server, Zabbix agent, and Apache services by running:
sudo systemctl restart zabbix-server zabbix-agent apache2
sudo systemctl enable zabbix-server zabbix-agent apache2

What is the difference between restart and enable?

The restart command starts the services right now. The enable command ensures they start automatically every time the VM boots, so your monitoring survives a reboot.

  • Verify all three services are running:
sudo systemctl status zabbix-server zabbix-agent apache2

You should see active (running) for all three services. Press q to exit.

Zabbix server not running?

  • Check the Zabbix server log for details by running sudo tail -20 /var/log/zabbix/zabbix_server.log. Look for a database connection error.
  • If you see a password authentication error, re-open /etc/zabbix/zabbix_server.conf and confirm the DBPassword line has no leading # character and the password is exactly ZabbixN0C2024.
  • Make sure there are no extra spaces before or after the = sign on the DBPassword line.

Ask for help: Why is my Zabbix server service failing to start?

Now that all services are running, you can access the Zabbix web frontend from your Windows host to complete the initial setup wizard.

  • On your Windows machine, open a web browser.
  • Navigate to http://your VM's IP address/zabbix (use the IP you found with ip addr in Step 1).
  • You should see the Zabbix frontend installation wizard welcome screen.

What are the wizard steps?

The wizard walks through these pages: Welcome, Check of prerequisites, Configure DB connection, Settings, Pre-installation summary, Install, and Log in. Most pages just need you to click Next step.

  • On the Welcome screen, leave the default language and click Next step.
  • On the Check of pre-requisites page, verify all items show OK. Click Next step.
  • On the Configure DB connection page, enter ZabbixN0C2024 in the Password field. Leave all other fields at their defaults.
  • Click Next step.
  • On the Settings page, leave the defaults and click Next step.
  • On the Pre-installation summary page, review the settings and click Next step.
  • Click Finish to complete the installation.
  • Log in with the username Admin (capital A) and password zabbix.

You should now see the Zabbix dashboard. This is the same kind of interface that NOC analysts monitor during their shifts.

Can't reach the Zabbix web page?

  • Confirm Apache is running on the VM with sudo systemctl status apache2.
  • Double-check the VM's IP address by running ip addr inside the SSH session. Make sure you are using the correct IP in your browser URL.
  • Ensure the URL ends with /zabbix (not just the IP address by itself).

Ask for help: Why can't my Windows browser reach the Zabbix frontend on my Hyper-V VM?

Your monitoring stack is fully installed and accessible. Next up, you will configure hosts and apply monitoring templates so Zabbix starts collecting real data from your server.

Configure Hosts and Monitoring Templates

Your Zabbix server is installed and running. Now it's time to tell Zabbix what to actually monitor.

In a real NOC environment, monitoring templates define what data gets collected from each host. In this step, you'll verify that the Zabbix agent is communicating, then link templates that automatically start collecting CPU, memory, disk, and service metrics.

In this step, get ready to:
  • Verify the Zabbix server host and agent connectivity.
  • Link monitoring templates for Linux, Apache, and MySQL.
  • Confirm live metrics are flowing into the dashboard.
Verify the Zabbix server host and agent connectivity

Before linking templates, you need to confirm that the Zabbix agent on your server is communicating with the Zabbix server process. A green availability icon confirms this connection is healthy.

  • In the Zabbix web interface, click Data collection in the left sidebar menu.
  • Click Hosts.
  • You will see Zabbix server already listed. Click on its name to open the host configuration form.
  • Verify the agent interface is set to 127.0.0.1 on port 10050.
  • Click Cancel to return to the hosts list without making changes.
  • Wait about one minute, then check the Availability column. You should see a green ZBX icon next to the host.

What does the green ZBX icon mean?

The green icon means the Zabbix server successfully connected to the agent on that host. A gray icon means the connection hasn't been attempted yet. A red icon means the connection failed.

The agent listens on port 10050 and responds to data collection requests from the server. This is how Zabbix gathers metrics from the host.

Still seeing a gray ZBX icon?

The agent might need a moment to send its first heartbeat. Wait another 60 seconds and refresh the page.

If the icon turns red, verify the agent is running by switching to your SSH session and running sudo systemctl status zabbix-agent. The service should show as active.

Help me troubleshoot my Zabbix agent connection

Link monitoring templates to the host

Zabbix uses templates to define what data gets collected from a host. Each template bundles together items (data collection points) and triggers (alert conditions) for a specific service or system component.

  • In the Data collection menu, click Hosts.
  • Click on Zabbix server to open its configuration.
  • Click the Templates tab near the top of the form.
  • In the Link new templates field, type Linux by Zabbix agent and select it from the dropdown.
  • Repeat for Apache by HTTP and MySQL by Zabbix agent.
  • Click Update to save the template links.

What do these templates monitor?

Linux by Zabbix agent monitors CPU utilization, available memory, disk space, and network interfaces.

Apache by HTTP monitors the web server that hosts the Zabbix frontend.

MySQL by Zabbix agent monitors the database that stores all your monitoring data. Together, these templates give you full visibility into your server's health.

Template not appearing in the dropdown?

Make sure you are typing the exact template name. Template search is case-sensitive. Try typing just the first few characters and wait for the dropdown to populate.

If no templates appear at all, the zabbix-sql-scripts package may not have been imported correctly in the previous step. Templates are loaded from the initial database schema.

Help me find the monitoring templates in Zabbix

Confirm live metrics are flowing

With templates linked, Zabbix begins collecting data immediately. It takes 1-2 minutes for the first metrics to appear.

  • Click Monitoring in the left sidebar menu.
  • Click Hosts.
  • Click on Zabbix server to open the host menu.
  • Click Latest data in the host menu.
  • Confirm you see metrics for CPU utilization, available memory, disk space, and MySQL status. If the page looks empty, wait another minute and refresh.

What am I looking at?

The Latest data page shows every metric Zabbix is actively collecting from the host. Each row represents one item (a single measurement) with its most recent value and timestamp.

You should see groups of items organized by category: CPU, filesystem, memory, network interfaces, MySQL queries, and Apache connections. This is the raw data that powers dashboards and triggers alerts.

Not seeing any metrics after 2 minutes?

Switch to your SSH session and verify the agent is running with sudo systemctl status zabbix-agent. The service must be active for data collection to work.

Also check that the host shows a green ZBX icon in the Availability column. If it's red, the server cannot reach the agent and no data will flow.

Help me troubleshoot why Zabbix is not collecting metrics

Your monitoring infrastructure is now collecting real data. Next up, you'll create custom alert triggers that fire when services go down, just like a real NOC environment.

Create NOC-Style Alert Triggers and Simulate an Outage

Your Zabbix server is collecting live metrics from the host. Raw data alone is not useful to a NOC analyst staring at a wall of screens during a night shift. What they need is instant notification when something breaks.

Triggers are the rules that turn raw metric data into actionable alerts. In this step, you will create custom triggers with different severity levels (mirroring real NOC escalation tiers) and then simulate an actual service outage to watch your monitoring detect and record it in real time.

In this step, get ready to:
  • Create a Disaster-severity trigger that fires when Apache goes down.
  • Create a Warning-severity trigger for sustained high CPU usage.
  • Simulate and recover from a service outage, verifying detection timestamps.
Create a Disaster-severity trigger for Apache

A Disaster-severity trigger represents the highest escalation level in a NOC. It means an externally visible service is completely down and requires immediate action.

  • In your Zabbix web frontend, click Data collection in the left sidebar.
  • Click Hosts.
  • In the row for Zabbix server, click Triggers.
  • Click Create trigger in the top right corner.

The trigger configuration form opens. Fill in the following fields:

  • In the Name field, enter NOC CRITICAL: Apache service down.
  • Set Severity to Disaster (the red option, the highest level).
  • In the Expression field, paste the following expression:
last(/Zabbix server/net.tcp.service[http,,80])=0
  • Click Add at the bottom of the form to save the trigger.

What does this expression do?

The function last() grabs the most recent value of the net.tcp.service[http,,80] item key. This built-in Zabbix check tests whether a TCP service (HTTP) is reachable on port 80.

When the check returns 0, it means port 80 is unreachable. The trigger fires and creates a Problem event with Disaster severity.

Your new trigger should now appear in the triggers list for the Zabbix server host.

Don't see the trigger in the list?

Make sure you clicked Add (not Cancel) at the bottom of the form. If the expression shows a validation error, double check that every character matches exactly, including the forward slashes, square brackets, and commas.

Help me fix my trigger expression

Create a Warning-level CPU trigger

NOC teams use tiered severity levels to prioritize their response. A Warning-level trigger tells the analyst to keep an eye on the situation. It does not require dropping everything.

  • Return to the triggers list by clicking Data collection then Hosts in the left sidebar.
  • In the row for Zabbix server, click Triggers.
  • Click Create trigger.
  • In the Name field, enter NOC WARNING: High CPU utilization (>80%).
  • Set Severity to Warning (the yellow option).
  • In the Expression field, paste the following:
avg(/Zabbix server/system.cpu.util,5m)>80
  • Click Add to save the trigger.

What does this expression do?

The avg() function calculates the average value of system.cpu.util over the last 5 minutes. If that average exceeds 80%, the trigger fires with Warning severity.

This tiered approach (Warning vs. Disaster) lets NOC analysts know at a glance which alerts need immediate action and which can be monitored.

You should now see both custom triggers listed alongside the template-provided triggers for the Zabbix server host.

Expression validation failed?

The most common mistake is a space issue in the host name within the expression. The host name inside the expression must match Zabbix server exactly (with a space between the two words, capital Z).

Help me debug my CPU trigger expression

Simulate an Apache outage

Time to put your monitoring to the test. You will stop the Apache service to simulate a real outage, then restart it and check how Zabbix recorded the event.

Stopping Apache will kill the Zabbix web frontend

Since the Zabbix frontend runs on Apache, you will lose access to the web interface while Apache is stopped. This is expected. You will restart Apache after a short wait and then check the recorded problem event.

  • Switch to your SSH session connected to the VM.
  • Stop the Apache service by running this command:
sudo systemctl stop apache2
  • Wait 1-2 minutes for Zabbix to detect the outage. The Zabbix server process (separate from Apache) is still running and polling the agent.
  • Restart Apache by running:
sudo systemctl start apache2
  • Switch back to your browser and navigate to Monitoring in the left sidebar.
  • Click Problems.
  • Look for the NOC CRITICAL: Apache service down entry. It should show the Disaster severity tag, a detection timestamp (when the trigger fired), and a resolution timestamp (when Apache came back).

Why does the resolved problem still appear?

Zabbix keeps a full history of problem events. Even after a trigger recovers, the event stays in the Problems view (marked as Resolved) so analysts can review what happened. This historical record is critical for post-incident reports in a real NOC.

Not seeing the resolved event?

By default, the Problems page may filter to show only current (unresolved) problems. Click the Show filter dropdown and select Recent problems or History to include resolved events in the list.

No problem event recorded at all?

Make sure you waited at least 60 seconds with Apache stopped before restarting. Zabbix checks net.tcp.service at its configured interval (default 60 seconds). If you restarted too quickly, the check may not have caught the downtime.

Also confirm the trigger expression uses last(/Zabbix server/net.tcp.service[http,,80])=0 with the exact host name and item key. A typo will prevent the trigger from linking to collected data.

Help me figure out why my outage alert didn't fire

Your monitoring system just detected and recorded a real service outage automatically. Next up, you will walk through the full NOC incident response workflow, documenting the event exactly the way a NOC analyst would during a shift.

Execute the NOC Incident Response Workflow

In the previous step, you created custom triggers and simulated an outage that Zabbix detected in real time.

Detecting a problem is only half the job. In a real NOC, every alert that fires must be acknowledged, investigated, documented, and resolved. This step walks you through the full incident lifecycle that NOC analysts perform every shift.

In this step, get ready to:
  • Acknowledge the Apache outage event and add analyst notes.
  • Document the full incident lifecycle from detection to resolution.
  • Build a custom NOC operations dashboard with monitoring widgets.
Practice the acknowledgment workflow

When a NOC analyst receives an alert, the first action is always to acknowledge it. This tells the rest of the team that someone is actively working the problem.

  • In the Zabbix web frontend, navigate to Monitoring in the left sidebar.
  • Click Problems.
  • Find the NOC CRITICAL: Apache service down event in the list.
  • Click the event timestamp in the Time column to open the event details page.

What is problem acknowledgment?

Acknowledgment in Zabbix signals that a human has seen the alert and is taking ownership. It prevents duplicate effort across a team because other analysts can see that someone is already investigating.

In a production NOC, acknowledgment also triggers audit trails. Managers review acknowledgment times to measure how quickly the team responds to incidents.

  • Click Update in the Update column to open the problem update popup.
  • In the Message field, type the following analyst note:
NOC Analyst investigating. Service confirmed down at [time]. Escalating to L2 if not resolved in 15 minutes.

Why this message format?

NOC teams use structured acknowledgment messages so anyone reviewing the incident later can immediately understand what happened. The message names who is working it, confirms the failure, and sets a clear escalation timer.

  • Replace [time] with the actual detection time shown in the event details.
  • Check the Acknowledge checkbox.
  • Click Update.

The event now shows a green checkmark in the acknowledgment column, confirming it has been claimed by an analyst.

Don't see the Acknowledge checkbox?

Make sure you are logged in as Admin. Only users with read permissions to the corresponding triggers can acknowledge events. If the checkbox is grayed out, the event may already be acknowledged.

help me troubleshoot why I cannot acknowledge a problem event in Zabbix

Document the incident lifecycle

Every NOC incident follows a lifecycle: detection, triage, resolution, and post-mortem. Recording these details is what separates a reactive team from a professional one.

  • Return to Monitoring > Problems.
  • Click the event timestamp for your Apache outage to open the event details.
  • Using the information visible on this page, record the following data points on your own computer (in a text file or notes app):
  • Detection Time: the timestamp when Zabbix first fired the alert.
  • Severity: Disaster.
  • Triage Notes: root cause was that the Apache service was manually stopped.
  • Resolution Action: restarted Apache with sudo systemctl start apache2.
  • Resolution Time: the timestamp when the problem cleared (shown in the Recovery Time column).
  • Total Downtime: the difference between Detection Time and Resolution Time.

Why document all of this?

This is exactly the data NOC analysts enter into ticketing systems like ServiceNow or Jira Service Management. Incident documentation feeds into SLA reporting, capacity planning, and post-incident reviews.

Being able to produce a clean incident record from monitoring tool data is a core NOC analyst skill that hiring managers look for.

Can't find the Recovery Time?

If the Recovery Time column is empty, the problem may still be in an active state. Make sure Apache is running by checking with sudo systemctl status apache2 in your SSH session. Zabbix takes 1-2 minutes to detect the recovery after the service restarts.

help me find the recovery timestamp for my Apache outage event in Zabbix

Build a NOC operations dashboard

Real NOC teams display wall-mounted dashboards that show the overall health of their environment at a glance. You will now create a similar dashboard inside Zabbix.

  • In the left sidebar, click Dashboards.
  • Click Create dashboard in the upper right.
  • In the dialog that appears, enter NOC Operations in the Name field.
  • Click Apply.

An empty dashboard opens in editing mode. Now you will add three widgets.

  • Click the Add button (or the arrow next to it) and select Add widget.
  • In the Type dropdown, select Problems.
  • Leave the default settings (this shows active alerts sorted by severity).
  • Click Add.
  • Click the Add button again and select Add widget.
  • In the Type dropdown, select Host availability.
  • This widget displays the up/down status of monitored hosts.
  • Click Add.
  • Click the Add button one more time and select Add widget.
  • In the Type dropdown, select System information.
  • This widget shows the health of the Zabbix server itself (uptime, version, queue size).
  • Click Add.
  • Arrange the three widgets by dragging them so they fill the dashboard area without overlapping.
  • Click Save changes in the upper right to save your dashboard.

Your NOC Operations dashboard now shows active problems, host availability, and server health on a single screen.

What makes a good NOC dashboard?

The three widgets you added cover the three questions every NOC analyst asks at the start of their shift: Are there any active alerts? Are all hosts reachable? Is the monitoring system itself healthy?

Production NOCs often add additional widgets like graphs for network throughput, maps showing physical topology, and SLA reports. The pattern is always the same: prioritize at-a-glance visibility.

Dashboard not saving?

Make sure you clicked Apply after naming the dashboard and before adding widgets. If the Save changes button is grayed out, you may not be in editing mode. Click the pencil icon in the upper right to re-enter editing mode.

help me save my custom dashboard in Zabbix 7.0

Secret mission

Configure Alert Escalation and Notification

Real NOC teams never rely on someone staring at a dashboard 24/7. They build automated alerting pipelines that notify the right people at the right time and escalate unacknowledged alerts automatically. In this secret mission, you will configure a custom script-based notification system and create an escalation policy that mirrors real enterprise NOC procedures.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally on your machine, so there are no ongoing monetary costs. The only resource to manage is your Hyper-V VM, which uses approximately 2 GB of RAM while running and 25 GB of disk space.

Decide whether to keep your VM running, pause it to come back later, or delete it entirely.

Resources you used:

  • Hyper-V VM (zabbix-noc) running Ubuntu Server 24.04 LTS with Zabbix 7.0 LTS, MySQL, and Apache.

Keep everything running

No action needed. Choose this if you are still actively experimenting with your monitoring lab.

  • Your VM continues running in the background using approximately 2 GB of RAM.
  • Access the Zabbix dashboard anytime at http://vm-ip-address/zabbix from your Windows browser.
  • The VM uses 25 GB of disk space on your host machine.

Pause - I'll come back to this later

Shut down the VM to free up RAM while keeping all your files and configuration intact. Start it again anytime from Hyper-V Manager.

  • Open Hyper-V Manager on your Windows host.
  • Right-click the zabbix-noc VM in the list.
  • Select Shut Down to gracefully power off the VM.
  • When you are ready to return, right-click the VM and select Start to boot it back up.
  • The 25 GB virtual hard disk remains on your host, but RAM is freed immediately.

Delete - I don't want to use this again

Remove the VM and its virtual hard disk completely to reclaim all disk space.

  • Open Hyper-V Manager on your Windows host.
  • If the zabbix-noc VM is running, right-click it and select Turn Off.
  • Right-click the zabbix-noc VM and select Delete. This removes the VM configuration from Hyper-V Manager.
  • Open File Explorer and navigate to the folder where you stored the virtual hard disk during VM creation (the default is C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks\).
  • Delete the .vhdx file associated with your VM to reclaim the 25 GB of disk space.
  • Delete the Ubuntu Server ISO file if you no longer need it.

Nice Work!

Nice Work!

You just built a fully operational NOC monitoring lab from scratch. You deployed enterprise monitoring infrastructure, configured meaningful alerts, simulated outages, and executed the same incident response workflow that NOC analysts perform every shift.

Here's what you accomplished:

  • Deployed Zabbix 7.0 LTS on Ubuntu Server 24.04 in a Hyper-V VM, complete with MySQL database and Apache web frontend.
  • Created custom NOC-style alert triggers with tiered severity levels and simulated a real service outage to observe detection in real time.
  • Executed the full NOC incident response lifecycle and built an operations dashboard for at-a-glance host health and active problem monitoring.
  • Secret Mission: Configured automated alert notifications with an escalation policy that auto-escalates unacknowledged critical alerts.

Ready to quiz yourself?