Every vendor is shipping 'an OpenAI wrapper' these days; I would rather do it locally, for free, and steer it with my monitoring. This guide is the AI lane of the home monitoring series: local LLMs that explain your alerts, write your handover summaries, appear on your dashboards, and - the best part - get monitored all by themselves.
Everything below runs on GPT4All or Ollama, no API keys, no clouds, no per-token bills. Just a laptop with a decent CPU.
Why hook up AI to your monitoring at all?
Alerts are easy to generate and hard to interpret at 3am. An LLM that has the alert text in front of it can summarize, suggest likely causes, and translate machine noise into sentences humans and on-call people actually read. Part 61 was my five-minute proof of concept: a GPT4All script, a Zabbix script with macros, and I could ask any alert to explain itself, suggest bash commands, or describe it like a pirate.
Start simple: an 'explain this alert' button
Install GPT4All with pip install gpt4all, use the wizardlm-13b model, add argument handling so it accepts a question, and create a Zabbix script that runs it (python3 ... --question "{EVENT.NAME} ..."). The magic is that Zabbix macros like {EVENT.NAME} and {EVENT.AGE} fill in the real alert context at click time. On my MacBook Pro M1 answers come back in 10-15 seconds, which is perfectly fine for an occasional 'what is happening?' click on an alert list item.
The AI alert journalist
Part 62 scales the idea from one alert to the whole incident queue. A script pairs the official zabbix_utils Zabbix API client with GPT4All: it fetches all tripped, monitored triggers (marked as unacknowledged where relevant) and raises max_tokens to 1000 so the model can write real copy. Ask it to 'explain the active alerts like a teenager' and you get an emoji-rich debrief of every problem, with the useful part that triggers, hosts and downtime are all there. This is the core ingredient for automated reporting.
From reporting to a dashboard widget
Part 66 turns the journalist loose on a schedule: a cron job runs it hourly with a handover prompt, the output lands in a text file Zabbix reads as an item (preprocessing with Discard unchanged deduplicates stories), and a Plain text widget shows it. Grafana picks the same item up with the Zabbix datasource and renders it with the Dynamic Text panel, or via the Infinity datasource if you talk straight to the Zabbix API. Result: the next on-call person starts their shift with a written handover, generated while they slept.
Watch local LLM performance inside Zabbix
If you serve models to the family with Ollama, you want to know how fast they actually run. Part 120 explains that ollama run --verbose prints token counts, prompt and eval rates, and total durations to stderr; a shell snippet captures that to a file and ships it with zabbix_sender, and dependent items with regex preprocessing parse the numbers. A dedicated llmstatistics host keeps an eye on every model you break.
LLMs and the command line are friends
Part 110 is the lowest-effort route of all: pipe zabbix-cli output directly into an Ollama model. One line - zabbix-cli show_alarms | ollama run deepseek-r1:8b 'analyze these alerts' - and your reasoning little monster produces a structured incident review. It is the ideal tool for 'why did this happen' after-the-fact analysis without touching the UI.
Even AI needs monitoring
My favourite loop: use Zabbix to monitor the AI you added to Zabbix. Part 107 gave Zabbix computer vision, and part 128 measured how reliably the vision model describes our CCTV: snapshots once a minute, an Ollama llava description stored to a file, Zabbix checking for Person/Bird/Dog keywords in the text, and hourly counts of what the model claims to see. At night the hallucination rate is spectacular; after sunrise the results get sane. If your AI feeds any decision, you want that measurement. Add the observable stack around it - Ollama stats on the llmstatistics host, and alerts for AI infrastructure, from model endpoints to web checks to the whole AI-as-a-service tracking.
More wild ideas
The pattern generalizes beautifully: Zabbix API history.push streams the currently playing song to a trapper item (part 93), an iPhone camera measures distance (part 123), and natural-language web tests let an agent do your Selenium checks. If you took the LLM out of a single step, every one of these is just data arriving at Zabbix - and Zabbix loves data.
Frequently asked questions
Do I need an OpenAI API key for this?
No, and that is the point. Everything in this guide runs on local models: GPT4All (pip install gpt4all) or Ollama. No API keys, no clouds, no token billing, and your alerts never leave your network.
Which LLM should I use?
For testing start with GPT4All's wizardlm-13b, which is what the alert-explanations posts use. For command-line reasoning and one-liners, try an Ollama model like deepseek-r1:8b, and for vision use Ollama's llava. Any local model that takes a prompt works with Zabbix though, so pick by speed and taste.
Can I run local LLMs on a Raspberry Pi?
Yes but slowly. My setup runs the models on a MacBook Pro M1 while the Raspberry Pi 4 hosts Zabbix, and answers take 10-15 seconds. For a home alert assistant that is plenty; for a fast autocomplete, do it elsewhere.
How do I build the AI alert journalist myself?
Combine the official zabbix_utils API client (fetch monitored triggers with expandDescription, mark the unacknowledged ones) with the GPT4All chat script from part 61, raise max_tokens to 1000, and pass a style prompt with the alert text. The pair of prompts in part 66 turns the same script into an hourly handover report.
How does the AI get data out of Zabbix?
Several ways, all shown in the linked posts: the Zabbix API via zabbix_utils, zabbix-cli piped to an LLM, text files written by cron and read by Zabbix agent items, and pushes back in with zabbix_sender or history.push. Choose whichever matches how the model is running.
Does the blog have a proper AI-focused series?
Yes - my generative-AI experiments have a dedicated home, and the parts linked in this guide (61-66, 107, 110, 120, 128 and more) together form the evergreen AI in observability series you can follow from start to finish.
First published as part of the home monitoring guide series on whatsuphome.fi. The detailed, screenshot-laden versions of every step live in the blog posts linked above.
Add new comment