Monitor Linux Logs

[knarfling]

I have seen several posts about the Windows Event Logs, but very little in regards to Linux/Unix Logs. What I am trying to do is monitor the /var/log/secure and get an email if someone tries to log in using ssh and fails.

The item setup page on 1.1.2 has data type of log, but I am not sure how to set up the key. Usually I get Not Supported and no information, so I think I am missing something. Do I need to have a custom user perameter in zabbix_agentd.conf, or should I be able to do it with the standard configuration?

[James Wells]

Greetings,

Yes, you can use standard Zabbix agent, however, you have to use Zabbix Agent (Active) as your item type. Next, you need to configure the date format for the item to match what your log file uses.

[knarfling]

date format

Thank you for your reply.

After searching, I found this thread that talks about the date format. However, my logs list the month as a three letter abbreviation, and it seems that the function does not recognize letters in the date format.

Is this something that can be changed, or do I need to find a way to change syslog to show the date in numeric format only?

[James Wells]

Is this something that can be changed, or do I need to find a way to change syslog to show the date in numeric format only?

At present, no, though I will probably create a patch in the future to support it. I suspect the reason this is limited to numeric only time stamps is due to internationalization. It would be fairly expensive to support the 3 letter month abbreviation for each language set.

[marchday2004]

How to configure key

Greetings,

Yes, you can use standard Zabbix agent, however, you have to use Zabbix Agent (Active) as your item type. Next, you need to configure the date format for the item to match what your log file uses.

Which 'Key' item should I select? Thanks.