log monitoring: alerts from very old values

[grenzlaeufer]

Hallo!

I have achieved to monitor failed login attempts on our servers with zabbix, but i have a serious problem: I regularly get alerts from old login attempts which are up to 3 months old! I hoped old alerts would vanish with the time, but even after a month I get several old values/alerts a day.
I am using Zabbix 1.8.3.

Item: Configuration:
Type: Zabbix agent (active)
Key: log[/var/log/messages,"Authentication failure"]
Update: interval: 10 sec
Status: active

Has anyone else experienced this problem?

[angelhc]

Hello,
As I can see on your item configuration:
log[/var/log/messages,"Authentication failure"] you're looking any "Authentication failure" on any line.
Try og[/var/log/messages,"Authentication failure",30] to search only the last 30 lines.
Hope this help

[grenzlaeufer]

Thank for the reply angelhc!

I´ve just configured it. If you don´t heare anything from me, than it works.