Not work (Zabbix 4.0)

[CheckB]

Hi. On a host with debian 9 in the detection rules: Unsupported item key. What could be the problem? p.s. zabbix 4.0

[hermanekt]

Hi,

can you send me your agent configuration please?

Tom

[CheckB]

@hermanekt

zabbix_agentd.log

this is .conf

[hermanekt]

Can you send me output from this commands? fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'

You need change #JAIL with your jail. My list for example: {"data":[{"{#JAIL}":"dovecot"}, {"{#JAIL}":"postfix-sasl"}, {"{#JAIL}":"pure-ftpd"}, {"{#JAIL}":"sshd"}]}

fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

Run this from zabbix server or proxy and change localhost with host ip zabbix_get -s 127.0.0.1 -p 10050 -k "fail2ban.discovery"

Tom

[hermanekt]

If you want i can help you with teamviewer session. Just send me email with credentials.

[CheckB]

On Zabbix 3.0, everything works without problems.

[hermanekt]

I have zabbix 4.0 and 4.2 and both work fine. Restart you zabbix_agentd after change? What give you commands zabbix_get is important.

[hermanekt]

Maybe you have different OS version. What is your OS version?

[CheckB]

Of course did restart. None of the custom templates work. Server: ubuntu 18.04 Agent: debian 9

I still can not understand why zabbix_get does not work

[hermanekt]

I think problem is in fail2ban. Can you send me output from this command? root@hosting1:~# dpkg -l | grep fail2ban

root@hosting1:~# fail2ban-client status

BTW my versions: root@hosting1:~# cat /etc/debian_version 9.8

root@hosting1:~# dpkg -l | grep zabbix ii percona-zabbix-templates 1.1.8-1.stretch all Percona Monitoring Plugins for Zabbix ii zabbix-agent 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - agent ii zabbix-frontend-php 1:4.2.0~beta1-1+stretch all Zabbix network monitoring solution - PHP front-end ii zabbix-get 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - get ii zabbix-java-gateway 1:4.2.0~beta1-1+stretch all Zabbix network monitoring solution - java-gateway ii zabbix-release 4.1-1+stretch all Zabbix official repository configuration ii zabbix-server-mysql 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - server (MySQL)

root@hosting1:~# dpkg -l | grep fail2ban ii fail2ban 0.9.6-2 all ban hosts that cause multiple authentication errors

[CheckB]

ii  fail2ban                             0.9.6-2                        all          ban hosts that cause multiple authentication errors

Status
|- Number of jail:      1
`- Jail list:   sshd

This does not seem to be a fail2ban problem, for it is not the only template that does not work. See: https://github.com/krom/zabbix_template_md/issues/6

[hermanekt]

No this is not this problem i look in your config file:

Server=192.168.1.155 (from this server only accept connection)

Zabbix agent can be called only from this IP not from localhost(127.0.0.1)

If you need test this, you can use 2 ways 1)call zabbix get from Zabbix Server**: zabbix_get -s REMOTE_IP_OF_ZABBIX_AGENT -p 10050 -k "fail2ban.discovery" 2)Change this line in remote host zabbix_agentd.log**

Server=192.168.1.155,127.0.0.1 OR Server=192.168.1.155,127.0.0.1,**ALL_IPs_of_monitored_host**

and run this: zabbix_get -s 127.0.0.1 -p 10050 -k "fail2ban.discovery"

Zabbix agent listen on all interface(this is ok): # ListenIP=0.0.0.0

I know this is strange, but this is normal if you run zabbix_get from different host like Zabbix server.(Server=192.168.1.155) This is something like connect string to zabbix server and ACL.

[hermanekt]

Hi @CheckB,

any news? Can it close this issue?

[hermanekt]

Im closing issue this look like miss configuration.