Iptables monitoring and triggers

[rbelsch]

I am attempting to monitor changes to IPTables on a host. I have created the following Item:

vfs.file.cksum[/etc/iptables/rules.v4] (this does show in my graphs any change that happens to IPTables on the test host.

But the Trigger isn't working which I have defined as:

(last(/sbc-testing-2/vfs.file.cksum[/etc/iptables/rules.v4],#1)<>last(/sbc-testing-2/vfs.file.cksum[/etc/iptables/rules.v4],#2))>0

I have been digging into the forums and have been unable to find a solution to this.

The other Question I have which also unable to find a solution to:

We would like to be able to display what change was done on IPTables on the Trigger output if possible or another Trigger to display the change.

[cyber]

that is strange triger expression... a<>b>0 ?? there is a change() function for that

change (/host/key)
The amount of difference between the previous and latest value.		Supported value types: float, int, str, text, log For strings returns: 0 - values are equal 1 - values differ Example: => change(/host/key)>10 Numeric difference will be calculated, as seen with these incoming example values ('previous' and 'latest' value = difference): '1' and '5' = +4 '3' and '1' = -2 '0' and '-2.5' = -2.5 See also: abs for comparison

To display a change, you need at first capture the change... That would probably require completely different checking...