Not work (Zabbix 4.0) about zabbix-fail2ban-discovery- HOT 13 CLOSED

Hi,

can you send me your agent configuration please?

Tom

from zabbix-fail2ban-discovery-.

@hermanekt

zabbix_agentd.log

this is .conf

from zabbix-fail2ban-discovery-.

Can you send me output from this commands?
fail2ban-client status '$1' | grep 'Currently banned:' | grep -E -o '[0-9]+'

You need change #JAIL with your jail. My list for example:
{"data":[{"{#JAIL}":"dovecot"}, {"{#JAIL}":"postfix-sasl"}, {"{#JAIL}":"pure-ftpd"}, {"{#JAIL}":"sshd"}]}

fail2ban-client status | grep 'Jail list:' | sed -e 's/^.*:\W\+//' -e 's/\(\(\w\|-\)\+\)/{"{#JAIL}":"\1"}/g' -e 's/.*/{"data":[\0]}/'

Run this from zabbix server or proxy and change localhost with host ip
zabbix_get -s 127.0.0.1 -p 10050 -k "fail2ban.discovery"

Tom

from zabbix-fail2ban-discovery-.

If you want i can help you with teamviewer session. Just send me email with credentials.

from zabbix-fail2ban-discovery-.

On Zabbix 3.0, everything works without problems.

from zabbix-fail2ban-discovery-.

I have zabbix 4.0 and 4.2 and both work fine. Restart you zabbix_agentd after change? What give you commands zabbix_get is important.

from zabbix-fail2ban-discovery-.

Maybe you have different OS version. What is your OS version?

from zabbix-fail2ban-discovery-.

Of course did restart.
None of the custom templates work.
Server: ubuntu 18.04
Agent: debian 9

I still can not understand why zabbix_get does not work

from zabbix-fail2ban-discovery-.

I think problem is in fail2ban. Can you send me output from this command?
root@hosting1:~# dpkg -l | grep fail2ban

root@hosting1:~# fail2ban-client status

BTW my versions:
root@hosting1:~# cat /etc/debian_version
9.8

root@hosting1:~# dpkg -l | grep zabbix
ii percona-zabbix-templates 1.1.8-1.stretch all Percona Monitoring Plugins for Zabbix
ii zabbix-agent 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - agent
ii zabbix-frontend-php 1:4.2.0~beta1-1+stretch all Zabbix network monitoring solution - PHP front-end
ii zabbix-get 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - get
ii zabbix-java-gateway 1:4.2.0~beta1-1+stretch all Zabbix network monitoring solution - java-gateway
ii zabbix-release 4.1-1+stretch all Zabbix official repository configuration
ii zabbix-server-mysql 1:4.2.0~beta1-1+stretch amd64 Zabbix network monitoring solution - server (MySQL)

root@hosting1:~# dpkg -l | grep fail2ban
ii fail2ban 0.9.6-2 all ban hosts that cause multiple authentication errors

from zabbix-fail2ban-discovery-.

ii  fail2ban                             0.9.6-2                        all          ban hosts that cause multiple authentication errors

Status
|- Number of jail:      1
`- Jail list:   sshd

This does not seem to be a fail2ban problem, for it is not the only template that does not work.
See: krom/zabbix_template_md#6

from zabbix-fail2ban-discovery-.

No this is not this problem i look in your config file:

Server=192.168.1.155 (from this server only accept connection)

Zabbix agent can be called only from this IP not from localhost(127.0.0.1)

If you need test this, you can use 2 ways 1)call zabbix get from Zabbix Server**:
zabbix_get -s REMOTE_IP_OF_ZABBIX_AGENT -p 10050 -k "fail2ban.discovery"
2)Change this line in remote host zabbix_agentd.log**

Server=192.168.1.155,127.0.0.1
OR
Server=192.168.1.155,127.0.0.1,**ALL_IPs_of_monitored_host**

and run this:
zabbix_get -s 127.0.0.1 -p 10050 -k "fail2ban.discovery"

Zabbix agent listen on all interface(this is ok):
# ListenIP=0.0.0.0

I know this is strange, but this is normal if you run zabbix_get from different host like Zabbix server.(Server=192.168.1.155) This is something like connect string to zabbix server and ACL.

from zabbix-fail2ban-discovery-.

Hi @CheckB,

any news? Can it close this issue?

from zabbix-fail2ban-discovery-.

Im closing issue this look like miss configuration.

from zabbix-fail2ban-discovery-.