Monitor IpTables Rules

[samarcos]

Hi,
I am trying to setup a way to monitor the number of active rules from iptables,
I created an item:

system.run[/home/zabbix/count-rules.sh]

and the count-rules.sh:

#!/bin/bash

# Use the iptables-save command to get a list of all rules and count the lines.
rule_count=$(iptables-save | grep -c "^\-A")

echo $rule_count

I was trying to setup a graph to display the rules loaded, if there was a change, then it means something was wrong.
but I am having permission issues.

is there a better way to monitor rules in IPtables, or to monitor changes to iptables?
I looked at the templates, but was unable to find any template for iptables.

[dimir]

This script is run by Zabbix, so supposedly by zabbix user, which probably is missing some capabilities. Here's the related post, I think: https://unix.stackexchange.com/quest...t-user-and-why

[samarcos]

Maybe there is a better way to monitor IPTables?

[BigSmooth]

I guess doing a checksum (md5sum) instead of line count would be more accurate. We can imagine one rule removed and one rule created between two checks would not be detected.