ncc.zabbix_templates

Yohn Y. 2025-08-13 Parent:984772997051 Child:4b2d1fe8e0c2

39:c4e66ec88beb Go to Latest

ncc.zabbix_templates/Linux.common/zbx_export_templates.yaml

* Linux Common: Учитываем изменения в новой версии sshd при работе с логами

Download raw file
View source Diff to previous Annotate
History
1 zabbix_export:
2 version: '7.0'
3 template_groups:
4 - uuid: 22941f4e01294888a9bed3aae15f6ef9
5 name: Templates/AWNET
6 templates:
7 - uuid: d9ed1ecc0bc14cafb7fcbd309ad9a944
8 template: 'AWNET Linux Template'
9 name: 'AWNET Linux Template'
10 description: 'Версия: v0.r202508.1'
11 templates:
12 - name: OSI_v2
13 groups:
14 - name: Templates/AWNET
15 items:
16 - uuid: 85da57ac953f48c5a1e08f74fb2b65d5
17 name: 'Пакеты к обновлению'
18 key: aw.linux.apt.updatable
19 delay: 5m
20 history: 90d
21 value_type: TEXT
22 trends: '0'
23 preprocessing:
24 - type: JAVASCRIPT
25 parameters:
26 - |
27 var buf = value.split('\n');
28 var res = "";
29
30 var re_test = [
31 /^WARNING:/,
32 /^Вывод списка/,
33 /^Listing\.\.\./,
34 ];
35
36 var flag;
37 for (var i in buf) {
38 flag = true;
39 for (var j in re_test) {
40 if (re_test[j].test(buf[i])) {
41 flag = false
42 break;
43 }
44 }
45
46 if (flag && buf[i].length > 0) {
47 res += buf[i] + "\n";
48 }
49 }
50
51 return res
52 - type: DISCARD_UNCHANGED
53 parameters:
54 - ''
55 tags:
56 - tag: Module
57 value: 'Система пакетов'
58 triggers:
59 - uuid: 9a2fbf76b8f44d45b8a987c1997de212
60 expression: 'length(last(/AWNET Linux Template/aw.linux.apt.updatable))>2'
61 name: 'Появились обновления системы'
62 opdata: '{ITEM.VALUE}'
63 priority: WARNING
64 type: MULTIPLE
65 - uuid: 33c23ce59f3c49068057013b35ffb849
66 name: 'Ошибка в системном журнале'
67 key: 'aw.linux.journalctl[2]'
68 delay: 2m
69 history: 90d
70 value_type: TEXT
71 trends: '0'
72 preprocessing:
73 - type: JAVASCRIPT
74 parameters:
75 - |
76 var buf = value.split('\n');
77 var res = "";
78
79 var re_test = [
80 new RegExp('^ *$'),
81 new RegExp('^-- Journal begins'),
82 new RegExp('^-- No entries --'),
83 new RegExp('[0-9]{2} [0-9:]{8} [a-zA-Z0-9._-]* sudo\[[0-9]*\]: '),
84 new RegExp('CONFIG: restrict nopeer ignored'),
85 new RegExp('statistics directory /var/log/ntpsec/ does not exist or is unwriteable, error No such file or directory'),
86 new RegExp('error\: kex_exchange_identification\: Connection closed by remote host'),
87 new RegExp('error\: maximum authentication attempts exceeded for [^ ]* from [a-f0-9.:-]* port [0-9]+ ssh[0-9]*'),
88 new RegExp('error\: kex_exchange_identification\: client sent invalid protocol identifier "[^"]*"'),
89 new RegExp('error\: beginning MaxStartups throttling'),
90 new RegExp('error\: kex_exchange_identification\: read\: Connection reset by peer'),
91 new RegExp('fatal\: Timeout before authentication for [a-zA-Z.:0-9-]+ port [0-9]+'),
92 new RegExp('error\: kex_exchange_identification\: banner line contains invalid characters'),
93 new RegExp('error\: maximum authentication attempts exceeded for invalid user [a-zA-Z0-9_.-]+ from [0-9a-f:.]+ port [0-9]+ ssh[0-9]*'),
94 new RegExp('fatal\: userauth_pubkey\: parse request failed: incomplete message'),
95 new RegExp('sshd\[[0-9]*\]\: error\: Protocol major versions differ\: [0-9]+ vs\. [0-9]+'),
96 new RegExp('sshd\[[0-9]*\]\: fatal\: userauth_finish\: Broken pipe \\[preauth\\]'),
97 new RegExp('openvpn\[[0-9]*\]\: [0-9.:a-fA-F]* Connection reset, restarting \\[[0-9]\\]'),
98 new RegExp('/system\.journal\: Journal header limits reached or header out-of-date, rotating\.'),
99 new RegExp('sshd\[[0-9]+\]\: error\: kex protocol error\:'),
100 new RegExp('sshd\[[0-9]+\]\: error\: kex_protocol_error\:'),
101 new RegExp('sshd\[[0-9]+\]\: error\: kex_exchange_identification\: read: Connection timed out'),
102 new RegExp('sshd(-session)?\[[0-9]+\]\: fatal\: userauth_pubkey\: parse publickey packet\: incomplete message'),
103 new RegExp('sshd\[[0-9]+\]\: fatal\: userauth_finish\: send failure packet\: Connection reset by peer'),
104 ];
105
106 var MACROS = "{$AWLIN_LOG_NOT_MATCH}";
107 if (MACROS.length > 0 ) {
108 try {
109 _buf = new RegExp(MACROS)
110 re_test.push(_buf)
111
112 } catch (e) {
113 Zabbix.log(3, 'AWNET LIN :: LOG READER :: Error creating regexp from string "{$AWLIN_LOG_NOT_MATCH}": ' + e);
114 }
115 }
116
117 var flag;
118 for (var i in buf) {
119 flag = true;
120 for (var j in re_test) {
121 if (re_test[j].test(buf[i])) {
122 flag = false
123 break;
124 }
125 }
126
127 if (flag) {
128 res += buf[i] + "\n";
129 }
130 }
131
132 return res
133 - type: NOT_MATCHES_REGEX
134 parameters:
135 - '^ *$'
136 error_handler: DISCARD_VALUE
137 tags:
138 - tag: Module
139 value: 'Системный журнал'
140 triggers:
141 - uuid: e8001f72a356424ea8e83abfd2a83c63
142 expression: 'nodata(/AWNET Linux Template/aw.linux.journalctl[2],5m)=0'
143 name: 'Ошибки в системном журнале'
144 opdata: '{ITEM.VALUE}'
145 priority: WARNING
146 - uuid: a7879de7638a4333993b90f0db757619
147 name: 'Версия ОС'
148 key: aw.linux.version
149 history: 90d
150 value_type: TEXT
151 trends: '0'
152 preprocessing:
153 - type: DISCARD_UNCHANGED_HEARTBEAT
154 parameters:
155 - 1d
156 macros:
157 - macro: '{$AWLIN_LOG_NOT_MATCH}'
158 description: 'Регулярное выражение, по которому сообщения лога будут отбрасываться'