Our sshd configuration involves a strict combination of 'ListenAddress' and tcpwrappers. As a result, the default expression for SSH server will always be a false positive. Can someone help me understand the existing expression and make a suggestion of something that might work better.
I understand this is opening a port and also doing what is noted here:
But what is happening here:
The following post had some useful comments but I'm weary of suggesting we change our sshd configuration to accommodate this zabbix check.
Code:
{<hostname>:net.tcp.service[ssh,,22].count(#3,0,"eq")}=3
But what is happening here:
Code:
count(#3,0,"eq")}=3
