system.run grep command not working

[PatrickR-STI]

I have been running a grep command to retrieve data from one of our logs but it appears to have stopped working and I can't figure out why. Meanwhile, I have another command that appears to be working as expected.

The command that's not working: system.run[sudo grep 'block_auth_' /var/log/mail.info]
The command that isn't working: system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

I'm getting the error "Not supported by Zabbix Agent" when trying to run the first command.

Any assistance would be appreciated.

[vladimir_lv]

Have you tried an item for log file monitoring? Maybe it would be a better option for you in this case + trigger.
If you are using system.run, so each command should be allowed in the agent configuration file:

EnableRemoteCommands=1
AllowKey=system.run[sudo grep 'block_auth_' /var/log/mail.info]
AllowKey=system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

[PatrickR-STI]

Have you tried an item for log file monitoring? Maybe it would be a better option for you in this case + trigger.
If you are using system.run, so each command should be allowed in the agent configuration file:

EnableRemoteCommands=1
AllowKey=system.run[sudo grep 'block_auth_' /var/log/mail.info]
AllowKey=system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

I'm not trying to create a trigger event. This is more of a way for us to be able to track these events over a longer period of time.
I can try allowing the commands.
What I don't understand is why one command is being allowed to run while the other is reported as not supported.

[dimir]

How exactly are you running those items?

The "command that's not working" and "command that isn't working" have the same meaning to me.

If both items have Type of information set to Character or Text they both should either work or not work (in case of permissions issue) unless you have typos in the way you specified AllowKey in agent configuration file and the Key in item configuration.

Other than that, as vladimir_lv said, you should be using log file monitoring feature that is built-in Zabbix. All you need to take care of in this case is allow zabbix user to read /var/log/mail.info file.

If you still want to use system.run I'd advise to use wildcard in agent configuration file:

AllowKey=system.run[sudo grep * /var/log/mail.info]

[PatrickR-STI]

How exactly are you running those items?

The "command that's not working" and "command that isn't working" have the same meaning to me.

If both items have Type of information set to Character or Text they both should either work or not work (in case of permissions issue) unless you have typos in the way you specified AllowKey in agent configuration file and the Key in item configuration.

Other than that, as vladimir_lv said, you should be using log file monitoring feature that is built-in Zabbix. All you need to take care of in this case is allow zabbix user to read /var/log/mail.info file.

If you still want to use system.run I'd advise to use wildcard in agent configuration file:

AllowKey=system.run[sudo grep * /var/log/mail.info]

I should have wrote:

The command that's not working: system.run[sudo grep 'block_auth_' /var/log/mail.info]
The command that IS working: system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

I don't understand why one command works while the other presents the error Not Supported by Agent.

[dimir]

As I mentioned before, you probably have a typo either in zabbix agent configuration file parameter AllowKey or in the Key of item configuration in frontend. They must match absolutely. E. g.
agent configuration:

AllowKey=system.run[sudo grep 'block_auth_' /var/log/mail.info]
AllowKey=system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

frontend, item Keys:

system.run[sudo grep 'block_auth_' /var/log/mail.info]
system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

Zabbix agent will try to match those character by character.

[PatrickR-STI]

As I mentioned before, you probably have a typo either in zabbix agent configuration file parameter AllowKey or in the Key of item configuration in frontend. They must match absolutely. E. g.
agent configuration:

AllowKey=system.run[sudo grep 'block_auth_' /var/log/mail.info]
AllowKey=system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

frontend, item Keys:

system.run[sudo grep 'block_auth_' /var/log/mail.info]
system.run[sudo grep 'prevent_local_forgery' /var/log/mail.info]

Zabbix agent will try to match those character by character.

The agent config only has EnableRemoteCommands=1. There are no additional lines included. When I add the lines suggested I receive the error Zabbix 111 connection refused.

[dimir]

Both items have Type of information set to Character or Text?

[PatrickR-STI]

Both items have Type of information set to Character or Text?

Both items are set to Log but I get the error on the second item set to either Character or Text as well.