SSH running on a different port

[Florius]

Hi.

Is someone able to help me out? I'm running SSH on a different port, sao I have a second item, of which the key is "net.tcp.service[ssh,,1341]".
My trigger is "{Template App SSH Service:net.tcp.service[ssh].max(#3)}=0 or {Template App SSH Service:net.tcp.service[ssh,,1341].max(#3)}=0" but still Zabbix says that SSH is down?

Does anyone see something wrong with this? Thank you!

[dimir]

What does "Monitoring -> Latest data" show about the latest values of those items?

[Florius]

Hi Dimir. Thanks for taking the time to reply. It seems that 'that' is correct: https://ibb.co/d9oYWy

[dimir]

So the 22 port check is failing correctly or it is running but agent says it's not?

[Florius]

No Zabbix is running on port 1341. So it correctly says that SSH on port 1341 is up.
But still it triggers stating it fails with the OR...

[dimir]

Your trigger expression says: alert if 3 subsequent FAILs on port 22 OR 3 subsequent FAILs on port 1341. To me it works correctly, since first part of the expression is true.

[Florius]

Ah okay. I think I get it... How would I make sure it triggers on either one of the 2?

I have several hundreds of hosts with different SSH ports, so a specific trigger per host would be impossible...

[dimir]

1. Currently it already triggers on failure of any of the 2.
2. Have a host/template macro where you define the port, e. g.:
   • "Template App SSH Service" has:
     • 2 items:
       • net.tcp.service[ssh,,{$SSH_PORT1}]
       • net.tcp.service[ssh,,{$SSH_PORT2}]
     • a trigger with expression:
       • {Template App SSH Service:net.tcp.service[ssh,,{$SSH_PORT1}].max(#3)}=0 or {Template App SSH Service:net.tcp.service[ssh,,{$SSH_PORT2}].max(#3)}=0
   • When you link "Template App SSH Service" to a host add 2 host macros:
     • {$SSH_PORT1}=22
     • {$SSH_PORT2}=1341

[Florius]

Well that works just fine. Now I don't get why mine doesn't work, as it is the same?
Except you have variables defined for the SSH ports?

EDIT: Well the alert works, as I just stopped SSH daemon, but now it won't recover?

[dimir]

How often is the check made? Check latest data to see if the items get correct values.

[Florius]

Latest data is correct, about every 5 minutes... https://ibb.co/nvZKjJ See attached screenshot.
'0' is the check on port 22. '1' is on port 1341.

[dimir]

The alert will recover when it will be '1' on port 22.