1

I have started using Zabbix and can see it is throwing alerts when things are changed such as /etc/passwd.

Goggling for 'zabbix alert on root login' is not bringing up any pointers - How would I go about having an alert on root login please?

  • Tough question.. The first thing which comes to my mind is using zabbix_sender in a login script. But not sure, if this can be circumvented. – StephenKing Jun 19 '15 at 6:41
  • Parsing system logs would be another option (iirc zabbix can do that), but I personally dislike this. – StephenKing Jun 19 '15 at 6:42
0

For debian-based systems you need to parse /var/log/auth.log file like so:

log.count[file,<regexp>,<encoding>,<maxproclines>,<mode>,<maxdelay>,<options>]

https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/zabbix_agent

so in essence:

log.count[/var/log/auth.log,*root*Accepted,,,skip]

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.