SSH Service monitoring giving false negative (non-standard port)

[cnolan]

I've been trying to troubleshoot this for hours but running out of ideas.

In a nutshell: net.tcp.service[ssh,,2020] is always returning 0. The service is running on port 2020 and using zabbix_get or zabbix_agent manually on the host both return 1 for the same command.

Anyone any ideas?

Everything works fine on all but 2 of my hosts and it is driving me nuts.

The long story:

I am using the following item to monitor SSH and then setting the user macro {$SSH_PORT} globally as 22 and at host level depending on the server:

net.tcp.service[ssh,,{$SSH_PORT}]

The trigger is the standard trigger from the shipped template:

{Template App SSH Service:net.tcp.service[ssh,,{$SSH_PORT}].max(#3)}=0

I have confirmed the {$SSH_PORT} macro is working correctly as I can see this set correctly (port 2020) in latest data details:

net.tcp.service[ssh,,2020]

I can even run zabbix_get command as follows and this returns 1 as expected:

# zabbix_get -s 127.0.0.1 -k "net.tcp.service[ssh,,2020]" --tls-connect=psk --tls-psk-identity="PSK ID 1" --tls-psk-file=/etc/zabbix/zabbix_agentd.psk
1

And manually running zabbix_agentd with the same command:

# sudo -u zabbix /usr/sbin/zabbix_agentd -t net.tcp.service[ssh,,2020]
net.tcp.service[ssh,,2020]                    [u|1]

Zabix 3.2 on both Agent and Server.

Edit: This happens across 2 hosts on CentOS 6 and CentOS 7 with a CentOS 7 server. SELinux is disabled on clients. SSH is bound to 0.0.0.0:2020

[cnolan]

Turns out this was because the item included in the "Template App SSH Service" was a "Simple Check" and therefore run remotely rather than on the host which meant it was hitting the firewall. I have changed it to an "Agent" item and it all works as expected!

Many thanks to volter on the IRC channel for immediately spotting my mistake!