Zabbix and a Local LLM: Designing the Architecture for Smart Alerts

This is the third article in the series on integrating Zabbix with a local LLM in a home lab. With the goals set and the model chosen, it is time for the most boring and most important step: designing the architecture.

Why HLD is a human job

High-Level Design is not a place for full automation by a neural network. An LLM can generate options and suggest approaches, but architectural decisions require a human understanding of context. You have to account for the specifics of your lab, real memory and CPU limits, the quirks of your existing Zabbix stack, and requirements for alert responsiveness.

The key HLD question is how the system will work as a whole. Which components exist, how do they communicate, along which paths does data flow from a Zabbix alert to the LLM, and what result comes back? A human answers these questions, because they require experience and knowledge of your domain.

Where the neural network saves time

There are, however, quite specific parts where an LLM is genuinely useful and saves hours of work:

• Generate a list of possible components (API server, task queue, cache, logging)
• Identify potential bottlenecks and critical points of failure
• Suggest standard error-handling patterns and retry logic
• Sketch example REST API endpoints for the integration
• Help choose between asynchronous and synchronous processing

An important point: LLM output is not a finished solution. It is a starting point for your own thinking. The human refines it, filters it through their own requirements and adapts it to reality.

From theory to details

Once the High-Level Design is clear, Low-Level Design follows. This is where the specifics come in: exactly which API endpoints, which data structures in memory, which alert-processing algorithms, and in what order functions are called. At this level a human can lean on the LLM more heavily: ask it to generate starter code, check branching logic, and hunt for potential bugs.

It is in this part that the author examines how a local LLM fits into Zabbix alert processing, what limitations that imposes, and how to work around them. It turns out that even a simple integration requires thinking through how to cache results, how to manage the model's context, and how to guarantee that the system does not get overloaded under a heavy flow of alerts.

A practical approach

The material grew to enormous size as it was written, so it had to be split into four parts instead of the planned two. The most interesting part is still ahead: the final one, covering what actually came out of integrating all the pieces. The author promises to show the finished code, the test results, and the problems that had to be solved in practice.

What this means

The series shows that integrating AI into monitoring systems is a perfectly feasible task even for a hobby project. You do not have to rely on OpenAI's cloud services or ready-made enterprise solutions. A local LLM gives full control over data and processes, but it demands a serious architectural approach and an understanding of where the human and their experience are still irreplaceable.