How to monitor files being the same across 2 hosts, with template?

[Gammuts]

Hi all,

I have some servers on which the configuration is basically the same. For example: configuration for named/bind on both DNS servers, configuration for a 2FA authproxy on both servers.

Since I'm human, I tend to only change the master/primary and forget to update slave/secondary. I don't want to wait until monthly/yearly/periodic testing the disaster situation; I'd like to monitor for my mistakes.

Done so far:
* Wrote a discovery that will give me the filenames to monitor. Example of the JSON: {"data":[{"{#FILENAME}": "/etc/named.conf"}]}
* Wrote an item prototype to monitor the file checksum. Basically: vfs.file.cksum[{#FILENAME}]

Stuck on:
* How to write a trigger prototype that compares the item prototype to the same file, say, /etc/named.conf on a different machine.

Tried the following trigger prototypes already:
{TemplateMonitorFilesOutOfSync:vfs.file.cksum[{#FILENAME}].last()} <> {servernameofns2:vfs.file.cksum[{#FILENAME}].last()}
---> "Incorrect trigger prototype expression. Trigger prototype expression elements should not belong to a template and a host simultaneously."

And to add insult to injury: I would like the ns2 to be configurable with either a macro or a proto macro, as to reuse the template.

Any tips to reach my goal? Either by fixing my trigger prototype or by suggesting a viable alternative? I reckon fixing my trigger prototype can't be done, because the error message is quite clear.

My Zabbix environment: 4.0

[Semiadmin]

Hi, Gammuts.
I'd create 2 aggregate check prototypes, something like grpmin["host group", vfs.file.cksum[{#FILENAME}],last] and grpmax["host group", vfs.file.cksum[{#FILENAME}],last] and the trigger prototype like grpmin["host group", vfs.file.cksum[{#FILENAME}],last].last() <> grpmax["host group", vfs.file.cksum[{#FILENAME}],last].last()

[Gammuts]

Thanks Semiadmin. You made my day.

Aggregate function are completely new to me, but you basically gave me a 100% solution. Trigger are already firing.