How can I get information about which user was added to the passwd file with Zabbix?

[YasinTa]

Hello Everyone,

Has anyone ever been able to retrieve information about which user is added to the /etc/passwd file on Linux systems with Zabbix? There is an alert mechanism in Zabbix that notifies when there is a change in the /etc/passwd file, but I want to know which user is added in this change. Has anyone tried or done this before? I would be very grateful if you could help. Thank you in advance for your support

Regards
Yasin

[cyber]

That trigger is based on file checksum difference IIRC, so it has no idea, what exactly has changed inside, just that it has changed...
For getting actual changes, you should somehow store previous version, so you could compare... But I do not recall any built-in function to do something like that in Zabbix... "simple change" preprocessing only works on numeric values...
Having a userparameter to execute a local script to get such changes would be an option... each check you can save a copy and next time you compare first, then save new copy...