How Zabbix database monitoring with agent 2 plugins fits your estate
Zabbix agent 2 plugins collect database metrics for Zabbix, covering MySQL, PostgreSQL, MongoDB, Microsoft SQL Server, Oracle and Redis. Database teams that run more than one engine often end up with a separate collection method, alert format and dashboard for each, which makes availability and performance hard to compare. Using the agent 2 plugin model that Zabbix documents gives you one collection pattern and one place to see problems across engines, in infrastructure your organization controls. The starting point is an inventory of which engines, hosts and environments the integration must reach, and that inventory shapes every later choice.
The integration runs agent 2 on or near each database host. The agent connects to the database through the plugin for that engine, gathers metrics and sends them to the Zabbix server or to a Zabbix proxy. Placing the agent on the database host keeps database credentials and connection paths local to that host. A proxy in the same network segment can serve hosts in a remote site or a segregated zone. Confirm with your network and security teams which path each segment allows, because firewall rules between the agent, the proxy and the server decide whether the data flow works at all.
Proxy placement also affects resilience. Zabbix 7.0 and later support proxy groups, which redistribute monitored hosts between proxies when one goes offline. The Zabbix server supports a native high availability cluster, in which one node is active, the others stand by, and failover occurs after a configurable delay. Both features apply to the Zabbix side of the estate only. They do not change how each database engine handles its own failover, so check the monitoring design against your database high availability design as a separate exercise.
Settle the decisions before you install anything. Decide which team owns the monitoring accounts on each engine and how their passwords are stored and rotated. Identify any engines that run in containers or managed services that the agent cannot reach directly. Decide how new database hosts are added to Zabbix and who approves them. Ask Zabbix or your support provider which plugin behavior applies to each engine version you run. Zabbix paid support runs in tiers from 8x5 with a one day response on Silver to 24x7 with a one hour response on Global, so weigh those tiers against how quickly a monitoring fault would need attention.
What you need before enabling database plugins
Six prerequisites decide whether database plugins run cleanly from the first check. They cover the Zabbix release, the agent 2 package, the network path, the monitoring accounts, the TLS settings and the engine versions, and each one has to agree with the plugin documentation for your chosen release.
Zabbix server or proxy version
Choose the Zabbix release first, because the agent 2 package and plugin documentation both follow from it. The life cycle page lists 7.0 LTS with full support until 30 June 2027 and limited support until 30 June 2029. Zabbix 8.0 LTS is planned for Q4 2026, so confirm the status of each line before you commit, and record the exact server and proxy versions in your change plan.
Matching agent 2 package
Install the agent 2 package from the same release line as your server and proxies so protocol and plugin behavior match. Built-in plugins for MySQL, Oracle and Redis ship with agent 2. MongoDB, MSSQL and PostgreSQL are loadable plugins that Zabbix documents as installed separately since 6.0, so add their packages to every host that runs those checks. Confirm the package names for your operating system in the agent 2 plugin documentation.
Network paths from agent 2
Map one path per database from the host running agent 2 to each listener, including any named instance, cluster address or load balancer in the route. Check firewall rules in both directions for each path, and confirm which ports each engine uses in your environment. Test every path from the agent host itself, using the same network zone the check will use.
Monitoring database accounts
Create a dedicated monitoring account on each engine and keep it separate from administrator and application logins. Grant only the privileges that the plugin documentation lists for that engine, then verify them with a test connection before you enable items. Store the password in the agent configuration or your secrets process, and plan how you rotate it without opening a monitoring gap.
TLS certificates for each engine
Where an engine accepts encrypted connections, decide whether agent 2 verifies the server certificate, which certificate authority it trusts, and whether the host name in the certificate matches the address in the item configuration. Check the expiry date of each certificate and assign an owner who renews it before it lapses. Plugin documentation names the connection options each engine supports, so confirm them before you write the agent configuration.
Engine version coverage in plugin docs
Zabbix publishes supported versions for its own server database, including MySQL, MariaDB, PostgreSQL and TimescaleDB for the 7.4 line. Those lists describe the backend that stores Zabbix data. They do not tell you which monitored engines are covered, so confirm the exact versions each plugin supports for your chosen release in the plugin docs, and treat any version outside that list as untested until you verify it.
Which database plugins ship in agent 2 and which install separately
Zabbix agent 2 includes several database plugins in the agent binary, among them MySQL, Oracle and Redis. Since Zabbix 6.0, some plugins are loadable plugins that you install separately, and the list includes MongoDB, MSSQL and PostgreSQL. The same split applies to other plugins such as Ember+ and NVIDIA GPU. Before you design packaging, confirm the current plugin list and the package names for your operating system in the Zabbix agent 2 plugins documentation, because the built-in and loadable sets are what determine your work.
A loadable plugin adds an operational step that a built-in plugin does not. You must install a package for each host that runs the database, keep its version matched to the agent 2 version, and include it in every agent upgrade. A plugin that lags behind the agent can fail to start or fail to collect data, so the upgrade runbook should name the plugin package alongside the agent and test both together in a staging environment before rollout. Ask your Zabbix support provider or review the release notes for each upgrade to confirm which plugin versions the agent expects.
The most common gap appears when a host image lacks the loadable plugin. The agent starts without errors, the host shows as available, and the database items on a PostgreSQL or MSSQL host return unsupported or no data. Unless someone checks item states, the gap can stay hidden until a database outage goes unreported. Include the plugin in the golden image, add a check that confirms the plugin is present, and create a test item for each loadable plugin so that a missing package shows up as a problem during provisioning rather than during an incident.
Inventory each database host before you plan packaging. For each host, record the engine, the exact version, the agent 2 version, whether the engine's plugin is built in or loadable, the source of the package, and whether the image already includes it. For example, a host running PostgreSQL and Redis (illustrative) needs the loadable PostgreSQL plugin and uses the built-in Redis plugin, so the packaging list has one extra item for that host. Engine version matters too, because PostgreSQL 14 and the other supported lines have different end-of-support dates, and that affects the upgrade plan for the same hosts.
Mapping each database engine to its agent 2 plugin and packaging
This table maps each database engine in scope to its Zabbix agent 2 plugin, whether the plugin ships inside agent 2 or must be installed separately, and the account and connection it needs. Read it before planning installation, because loadable plugins add a packaging step to every agent host that monitors that engine. Confirm template names and item keys for your Zabbix version before building any check.
| Engine | Plugin and packaging | Account and connection | Item and template check |
|---|---|---|---|
| MySQL | MySQL plugin, built in to agent 2 | Dedicated monitoring user with the grants the plugin docs list for your MySQL version | Confirm the MySQL template name and item keys for your Zabbix version |
| Oracle | Oracle plugin, built in to agent 2 | Database user and connection string with read access to the views the plugin queries | Confirm the Oracle template name and item keys in your version's documentation |
| Redis | Redis plugin, built in to agent 2 | Connection URI and password if the instance requires authentication, set in the agent 2 configuration | Confirm the Redis template name and item keys for your Zabbix version |
| PostgreSQL | PostgreSQL plugin, loadable and installed separately (loadable since Zabbix 6.0) | Monitoring role using an authentication method your PostgreSQL server configuration allows | Install the plugin package first, then confirm template name and item keys |
| MongoDB | MongoDB plugin, loadable and installed separately (loadable since Zabbix 6.0) | Monitoring user on the target deployment with the roles the plugin docs specify | Install the plugin package first, then confirm template name and item keys |
| MSSQL | MSSQL plugin, loadable and installed separately (loadable since Zabbix 6.0) | SQL Server login with the server permissions the plugin docs specify for monitoring | Install the plugin package first, then confirm template name and item keys |
Zabbix database monitoring setup steps for agent 2
This sequence takes each database from unmonitored to reporting in Zabbix, with a check that closes every stage. It covers version confirmation, plugin installation, a read-only account per database, agent 2 connection settings, and template linking. The result is database metrics in Latest data that match what the database reports.
Confirm Zabbix and agent 2 versions
Start by recording the Zabbix server or proxy version and the agent 2 version on each monitored host. The agent and the server should belong to a compatible release line, and the plugin documentation for your agent version defines which plugins and parameters exist. Run the agent binary with its version flag on each host and compare the output with the documentation for your Zabbix line. The step is done when the versions are written down per host and any mismatch is resolved before you install anything.
Install loadable plugins where needed
Check which database plugins ship inside agent 2 and which are separate packages. MySQL, Oracle and Redis are built in, while PostgreSQL, MongoDB and MSSQL are installed separately as loadable plugins. Install the loadable packages that match the agent version on every host that will run them. The step closes when the agent starts cleanly and its log shows no plugin load errors for the installed plugins.
Create read-only monitoring accounts
On each database, create a dedicated monitoring account with read-only access limited to the views and statistics the plugin reads. Do not reuse administrator or application accounts. Take the list of required privileges from the plugin documentation for your version and grant only those. Store the account password in your secrets process and record which database and host it belongs to. Close the step by logging in with the new account from the agent host and running a read-only test query against the statistics it needs.
Configure plugin connection settings in agent 2
Add the connection settings for each database instance to the agent 2 configuration, using the parameter names from the plugin documentation for your version. Define the connection target, the monitoring account and the timeouts for each instance, and keep credentials out of shared files wherever your secret handling allows. Restart the agent after changes. Close the step with an agent test run for a key from the plugin, which should return a value.
Link the matching template in Zabbix
In the Zabbix frontend, create or select the host for each database instance and link the official template that matches the database and plugin. Set the template macros for the connection target and any thresholds, using the values the template documentation describes for your Zabbix version. Check that the host's agent interface points to the agent 2 instance. The step closes when the template is linked and the host shows its discovered items without unsupported item errors.
Verify that data arrives in Latest data
Wait for the first collection cycles, then open Monitoring and Latest data, filter by the database host, and confirm that values appear for core items such as availability, connections and query activity. Compare two or three values with the database's own status output taken at the same time. Check the host's item list for entries marked as not supported and read their error text, which usually points to a permission, parameter or version mismatch. The step is done when every expected item has a current value and no unsupported errors remain.
How PostgreSQL versions and upgrades change monitoring
Before you build PostgreSQL items in Zabbix, confirm which major version you run and whether it will still be supported for the life of the monitoring design. The supported majors are 18, 17, 16, 15 and 14. According to the PostgreSQL versioning policy, PostgreSQL 14 is supported until November 12, 2026, PostgreSQL 15 until November 11, 2027, PostgreSQL 16 until November 9, 2028, PostgreSQL 17 until November 8, 2029 and PostgreSQL 18 until November 14, 2030. Versions 13 and earlier are unsupported. Plan your monitoring review around these dates, because a major upgrade is the change most likely to alter what the PostgreSQL plugin reads.
Minor releases are the routine case. PostgreSQL minor releases never change the internal storage format, so applying one means replacing the executables and restarting the server. In most environments the monitoring role, its grants and the agent 2 PostgreSQL plugin configuration carry over unchanged. Still, confirm after each minor patch that the agent's connection check and a sample of items return values, since a restart can expose a changed connection setting or an expired password that was not visible before.
Major upgrades need more care. The PostgreSQL upgrading documentation describes three routes: dump and restore with pg_dumpall, pg_upgrade, and logical replication. Each route can change the statistics views and system catalogs that the plugin queries, and a new major version can add, rename or reshape columns. After cutover, check the templates and items that depend on those views, not only whether the server answers. Look for items in a not-supported state, values that have flatlined at zero and triggers that never fire.
PostgreSQL 18 changes the upgrade calculation somewhat. Its pg_upgrade retains planner statistics across major upgrades, which means the optimizer does not start cold, and it adds parallel jobs and a --swap option. That helps query performance after cutover but does not remove the need to verify monitoring, because the catalog changes are separate from the statistics. If you move to PostgreSQL 18, compare the item keys in your existing templates against the new server's views before the cutover window closes.
Logical replication is the option when downtime must be minimal. The PostgreSQL documentation states that it works between different major versions and allows a major upgrade with only several seconds of downtime. The monitoring cost is a second cluster with its own agent configuration, so the new instance needs the monitoring role, items and triggers before the switch. Whichever route you take, rerun item discovery and review every trigger after any major change, and record the result so the next upgrade starts from a verified baseline.
Securing database monitoring accounts and connections
Database monitoring gives the agent read access to engines that hold your most sensitive data, so the monitoring path needs the same controls as any other database client. The four cards below cover the account, the secret, the network path and the agent itself, which together decide how much exposure a monitoring deployment adds.
Least-privilege read-only monitoring accounts
Create a dedicated monitoring role for each engine instead of reusing an administrator or application account. Grant only the statistics and catalog views that the Zabbix agent 2 plugin queries, and confirm that list against the plugin documentation for your version. Do not grant write, DDL or superuser rights, and review the grants whenever you upgrade the plugin or the database engine.
Storing connection secrets outside templates
Keep database passwords out of exported templates, host macros visible to every Zabbix user, and agent configuration committed to shared repositories. Where the platform supports it, reference secrets from a vault or restricted macro type and limit who can read them. Check how your Zabbix version stores and displays secret macros before you rely on them.
Restricting host access to database ports
Allow connections to each database port only from the agent hosts or proxies that monitor it. Enforce this with host firewalls, security groups or the database's own host-based access rules, and confirm that no broader network path exists. Record the allowed sources in your change records so reviewers can verify them.
PostgreSQL client authentication methods
PostgreSQL supports several client authentication methods, including password, GSSAPI, SSPI, LDAP, RADIUS, certificate, PAM and OAuth. Choose the method that matches your identity design for the monitoring role, and avoid MD5 password authentication, which PostgreSQL 18 deprecates in favor of SCRAM. Confirm which methods your PostgreSQL version and plugin support against the current authentication documentation.
Agent 2 TLS and configuration file access
Review the TLS settings on Zabbix agent 2 and on connections between the agent and the server or proxy, including certificate validity and which hosts are trusted. Restrict read and write access to the agent configuration files and plugin settings to the service account and administrators who maintain them. Treat these files as credential-bearing configuration.
Confirming controls against vendor documentation
Authentication options, supported TLS versions and privilege requirements change between releases of Zabbix, each database engine and each plugin. Before you finalize the design, confirm every control in this section against the current documentation for the exact versions you run. Record the versions you checked so that a later review can repeat the verification.
How to verify database items before you trust alerts
Do not treat a database item as reliable until someone has checked its value against the database it describes. Start with a per-engine test pass. For each MySQL, PostgreSQL, MongoDB, MSSQL, Oracle and Redis target, run the relevant agent 2 plugin item through the Zabbix frontend test or the agent's test mode, and confirm that it returns a value of the expected type with no error text. Record the plugin name, the agent 2 build, the connection parameters and the key used. For PostgreSQL, MongoDB and MSSQL, also confirm that the loadable plugin is installed on the agent host and loads without error, because a missing plugin often looks like an item that simply never receives data.
Next, compare the returned values with a direct query on the same database, run by a DBA or an engineer with equivalent read access. Choose a small set of items that cover different behavior, such as connection counts, uptime, database size, replication state or cache hit figures. Run the native query at about the same moment as the agent test, then note whether the two results agree within the tolerance your team sets for that metric. Where they differ, check the item's units, its preprocessing steps and the monitoring account's privileges before changing any threshold.
Then check discovery and per-database items. Where a template uses low-level discovery to create items for each database, schema or instance, compare the discovered list with the databases the engine reports, and confirm that excluded system or test databases are absent by design. Confirm that the monitoring user can see every database it should, since a restricted account can produce a complete-looking list that omits some databases without any error. Finally, run a controlled trigger test: cause a known, harmless condition in a non-production environment or an agreed window, confirm that the problem opens with the expected severity, that notifications reach the right people, and that the problem resolves when the condition clears.
The reason for this effort is that unverified items fail in two directions. A broken item can leave a silent gap, where a database is down or unreachable and no problem is raised because no data arrives to evaluate. A misread item can produce false problems, which train operators to ignore alerts. Keep the verification record with the host configuration and the date each check was run, and repeat the relevant checks after plugin, agent or database upgrades. This record gives operations reviews concrete evidence of what was tested, what was found and what was accepted as a known limitation, and it shows auditors how monitoring coverage was confirmed.
Common database monitoring failures and their fixes
This table lists common failures when Zabbix agent 2 monitors PostgreSQL, MongoDB, MSSQL and other database targets, with the likely cause and a general fix for each. Start with the agent log, since it usually names the failing plugin, connection or item. Exact settings belong in the Zabbix plugin documentation for your agent and engine versions.
| Symptom | Likely cause | Fix |
|---|---|---|
| Plugin not found after agent install | A loadable plugin, such as PostgreSQL, MongoDB or MSSQL, was not installed separately | Install the matching plugin package, confirm the plugin path in agent 2 configuration, restart the agent and check its log. |
| No PostgreSQL data after a major upgrade | The monitoring role lost grants, or statistics extensions were not recreated on the new cluster | Recheck the monitoring role and its privileges, confirm required extensions are loaded, then follow the plugin docs for exact grants. |
| Authentication failures after moving to SCRAM or certificate auth | The monitoring password was stored in an older format, or client certificate paths and CA trust were not updated | Reset the monitoring password so it is stored under SCRAM, update host-based access rules, and confirm certificate paths and CA trust. |
| Agent starts but the plugin fails to load | The plugin package version does not match the agent 2 version | Install plugin packages from the same release line as the agent, then restart the agent and recheck the log. |
| Items time out or show connection refused | A firewall or security group blocks the database port between the agent host and the database | Test the port from the agent host, open only the path the agent needs, and restrict the source to the agent address. |
| Template items show as not supported | The template expects features missing from an older engine version or an engine outside the supported range | Read the item error text, move to a supported engine version, or disable the items the engine cannot serve. |
Questions buyers ask about database monitoring with Zabbix
Does Zabbix database monitoring have a license cost?
Zabbix open source has no license fee. Zabbix states that its open source software has no license fee, no device limits and no feature gates, and from Zabbix 7.0 onward it is released under AGPL version 3. The money you spend goes elsewhere: labor to design, deploy and tune the agent 2 plugins, infrastructure to run the Zabbix server, database and proxies, support subscriptions if you buy paid Zabbix support, and review time from your own staff who approve changes and respond to alerts. Ask any partner to break its quote into these components so you can see who is paid for what.
What drives the cost of monitoring databases with Zabbix?
The main drivers are the number of database engines, the number of instances per engine, the versions in your estate and your security constraints. Built-in agent 2 plugins for MySQL, Oracle and Redis need less packaging work than separately installed loadable plugins such as PostgreSQL, MongoDB and MSSQL, because those plugins must be built, installed and kept in step with the agent version. Mixed versions, air-gapped hosts, restricted service accounts and certificate-based connections all add design and testing time. A written scope should list each engine, instance count, version, network path and credential method so that the quote reflects your real environment.
How long does a Zabbix database monitoring rollout take?
The duration depends on scope, so the only reliable answer comes from a written quote based on your environment. No general timeline is given here. The schedule is shaped by how many engines and instances you monitor, whether loadable plugins need packaging, how quickly your database and security teams can create monitoring accounts and approve network paths, and how many alert and dashboard rules you want at go-live. Ask the partner to show the phases, the dependencies on your team and the points where your staff must sign off.
What does our team need to provide for a database monitoring project?
Your team typically provides access, decisions and sign-off. Expect to supply an inventory of database instances with engine and version, read-only monitoring accounts created by your database administrators, firewall rules between the agent hosts and the databases, and a named owner who approves alert thresholds. You will also need a place to run agents and a decision on where the Zabbix server and proxies sit. Confirm these needs in the written scope, because missing accounts or network approvals are a common reason monitoring projects slow down.
Can our internal team set up Zabbix database monitoring using the documentation?
Yes, a capable internal team can often deliver a small, single-engine deployment using the Zabbix documentation, provided it has Linux and database administration skills. The documentation covers agent 2 plugin configuration and the supported engine versions. The harder parts are packaging loadable plugins for PostgreSQL, MongoDB or MSSQL, keeping agent and plugin versions aligned through upgrades, setting alert thresholds that avoid noise, and documenting the result for audits. Assess your team against that list. If several of those skills are thin, a fixed-scope engagement can cover the gaps while your staff learn to operate the result.
What should a written scope for Zabbix database monitoring include?
A useful written scope lists the engines and versions in use, the instance count per engine, the hosts that will run agent 2 and plugins, the network paths and ports, the credential method for each database, and the alerting and dashboard requirements. It should also state which plugins are built in and which are installed separately, how packaging and updates will be handled, what documentation and handover you receive, and what your team must provide and approve. Ask for each deliverable and each dependency to be named, so you can compare quotes on the same basis.
When is a paid Zabbix support subscription worth considering?
A paid Zabbix support subscription is relevant when you need a contractual response time from the vendor, especially for production databases. Zabbix publishes tiers from Silver, with 8x5 support and a 1 day response, through Gold with a 4 hour response, to 24x7 options with response times of 2 hours (Platinum), 1.5 hours (Enterprise) and 1 hour (Global). Subscriptions are separate from the software, which stays free. Compare the response commitment with how fast your team needs help, and ask the partner how support tickets and plugin issues are handled alongside any subscription you buy.
How DeployOpen scopes and delivers database monitoring
DeployOpen plans, builds, documents and supports Zabbix database monitoring with agent 2 plugins inside your own infrastructure. We start from the database engines you run, which plugins they need, and how those agents reach your databases and your Zabbix server or proxies. Engagements are fixed-scope, with the scope agreed in writing before work begins.
How we scope
- Inventory each MySQL, PostgreSQL, MongoDB, MSSQL, Oracle and Redis instance, including versions and hosting model
- Confirm which agent 2 plugins are built in and which must be installed as separate loadable plugins
- Agree the monitoring accounts, network paths and proxy placement in the written scope before any build starts
How we build
- Install and configure the required loadable plugins alongside agent 2 on each monitored host
- Create least-privilege database monitoring accounts and load the matching Zabbix templates with tuned item intervals
- Test problem triggers against controlled conditions such as connection loss and replication lag before go-live
How we hand over
- Document the plugin list, agent configuration, credentials handling, template versions and trigger logic for each database
- Walk your operations team through alert routing, item review and how to add a new database instance
- Deliver the runbook for plugin updates and template changes, with a record of what was tested
How we support
- Offer ongoing support and upgrades for agent 2 plugins and Zabbix templates as a retainer
- Review plugin and database version changes against your Zabbix release line before you upgrade
- Extend monitoring to new instances or engines under a written change to the original scope

