"SSH service down" - although I can SSH on to hosts

[coda_matt]

I added the "SSH Service" template to all of my hosts (my mistake: should have tested) and it immediately flagged an error on every host:

SSH service is down on host.domain.com

I can SSH on to the hosts, so I don't think the problem is with the server. Can anyone suggest what I should look at or change?

Zabbix Server: 6.2.2
Agent: zabbix-agent2: 6.2.4

[coda_matt]

Turns out that the trigger was the opposite of what it should have been:

Was:

max(/SSH Service/net.tcp.service[ssh],#3)=0

Should be:

max(/SSH Service/net.tcp.service[ssh],#3)=1​

It was a fresh install, I haven't touched any of the triggers.

[cyber]

This template? https://git.zabbix.com/projects/ZBX/...pp/ssh_service

no.. it should not be "....=1"...

net.tcp.service[service,<ip>,<port>]
Checks if service is running and accepting TCP connections.	0 - service is down 1 - service is running	service - either of: ssh, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet (see details) ip - IP address (default is 127.0.0.1) port - port number (by default standard service port number is used)	Example: => net.tcp.service[ftp,,45] → can be used to test the availability of FTP server on TCP port 45. Note that these checks may result in additional messages in system daemon logfiles (SMTP and SSH sessions being logged usually). Checking of encrypted protocols (like IMAP on port 993 or POP on port 995) is currently not supported. As a workaround, please use net.tcp.port for checks like these. Checking of LDAP and HTTPS on Windows is only supported by Zabbix agent 2. Note that the telnet check looks for a login prompt (':' at the end). See also known issues of checking HTTPS service. https and telnet services are supported since Zabbix 2.0.

So if your checks return 0-s, it does not detect service running... as template does not specify IP or port and relies on defaults of 127.0.0.1 and 22 then this might also differ from your setup... maybe your sshd is not configured to listen on localhost? Or works on different port, which is not very unusual...