Zabbix and Local LLM Integration: How to Design an Architecture for Smart Alerts

This is the third article in a series about integrating Zabbix with a local LLM in a home lab. After defining requirements and selecting a model, it's time for the most tedious yet important task—architecture design.

Why HLD is Human's Work

High-Level Design is not a place for complete automation by neural networks. Although LLMs can generate options and suggest approaches, architectural decisions require human understanding of context. You need to account for your lab's specifics, real memory and processor constraints, peculiarities of your existing Zabbix stack, and alert responsiveness requirements. The key HLD question: how will the system work as a whole? What components exist, how do they communicate, what are the data paths from a Zabbix alert to the LLM, and what result comes back? Humans answer these questions because it requires experience and knowledge of your domain.

Where Neural Networks Save Time

There are concrete areas where LLMs are genuinely useful and save hours of work:

• Generate a list of possible components (API server, task queue, cache, logging)
• Identify potential bottlenecks and critical failure points
• Suggest standard error handling patterns and retry logic
• Sketch examples of REST API endpoints for integration
• Help choose between asynchronous and synchronous processing

Importantly: LLM results are not a finished solution. They're a starting point for your thinking. Humans refine, filter through their requirements, and adapt to reality.

From Theory to Details

When the High-Level Design is clear, comes the Low-Level Design. Here we get into specifics: exact API endpoints, in-memory data structures, alert processing algorithms, function call order. At this level, humans can rely more on LLMs—ask them to generate initial code, verify branching logic, hunt for potential bugs. This is where the author explores how a local LLM integrates into Zabbix alert processing, what constraints this imposes, and how to work around them. It turns out that even simple integration requires careful planning for caching results, managing LLM context, and ensuring the system doesn't get overloaded by heavy alert traffic.

Practical Approach

The material grew to enormous proportions while writing, requiring division into four parts instead of the planned two. Ahead lies the most interesting final part—showing what actually came out of integrating all the pieces. The author promises to share the finished code, test results, and the practical problems that had to be solved.

What This Means

The series demonstrates that integrating AI into monitoring systems is entirely achievable even for a hobby project. There's no need to rely on OpenAI's cloud services or ready-made enterprise solutions. A local LLM provides complete control over data and processes, but requires a serious architectural approach and understanding of where humans and their experience remain irreplaceable.