Zabbix Log Monitoring - Trigger Configuration - Action (Alert) Configuration

[arunkchow]

I created a template with an Item for Zabbix-Agent to monitor /var/log/secure for string Failed password, update every 1s and keep the historical data of only 1hr.



Then I configured the Trigger type Information.



We have standard Helpdesk alerting Action which sends Notifications for the rest of the Templates, Items, Triggers and I didn't want to include the one I created in it.



I created a separate Action one and included all Templates I created for login failure alerting.



Here's the screenshot.



Now my problem is I am getting tons of alert e-mails like this. Even though there's no login failure.

LDAP Login Monitoring (DSP-Jenkins-01:log[/var/log/secure,Failed password]): *UNKNOWN*

And when I try to log in with incorrect password to test it, it doesn't send alert for that instance though. Dashboard has tons of these fake alerts.

I just want Zabbix to send just one alert when it finds that Failed Password in the /var/log/secure and that's it.

I need to fix this one.

Also I don't understand why Zabbix keeps sending alert for a template even after configuring Template <> Template Name!

Please help!!

Regards,
Arun

[arunkchow]

Also.. Please let me know if there's anything wrong with above set up.

[Avinasha]

Hi Arun,

Not sure whether you were able to get this fixed. I would use .regexp(Failed Password) instead of .str(failed password)

Regards,
Avinasha