With item pre-processing added to LLD workflow and new javascript pre-processing step, it’s possible to monitor a directory for its file changes.

The trick is to use javascript pre-preprocessing step to convert file list to LLD format. The file list can be obtained with system.run key (requires enabled EnableRemoteCommands parameter in agent configuration file) or by user parameter (the UserParameter parameters in agent configuration file).

Create a discovery rule based on system.run key:

system.run[find /etc/* -maxdepth 0 -type f]

Add javascript preprocessing step to convert the file list into Zabbix low level discovery data:

var lld = [];
var lines = value.split("\n");
var lines_num = lines.length;
for (i = 0; i < lines_num; i++)
  var row = {};
  row["{#FILE}"] = lines[i]
return JSON.stringify(lld);

The script takes file list and command output and converts it into JSON format:

    "{#FILE}": "<full path to file>"
    "{#FILE}": "<full path to file>"

Add item prototype to monitor checksums:


And finally, the trigger to generate events:

Notify of
Newest Most Voted
Inline Feedbacks
View all comments
3 years ago

This solution won’t be practically usable for directories that contain large number of files, because discovery rule won’t be able to retrieve the file list if RemoteCommand or UserParameter needs to retrieve more than 512KB of data (I’ve just hit this limitation):

“User parameters are commands executed by Zabbix agent. Up to 512KB of data can be returned.”

Source: https://www.zabbix.com/documentation/current/manual/config/items/userparameters

2 years ago

this was immensely helpful, thanks so much!

Would love your thoughts, please comment.x