Zabbix is a great monitoring system but only when you actually get alerted to issues. There is no “Test” button so you have to trigger an event. The good news is (despite what you’ve read in other posts) there is an easy and consistent way to test alerts.
The idea is to find an easy-to-trigger event such as a change to the “/etc/passwd” file which should be rare (because password changes occur in the “/etc/shadow” file and not the passwd file) and see if it’s noticed and if an alert is sent.
I chose the “/etc/passwd” change event because it’s easy to do: Just change a users name in the “comments” field, for example. But the default check frequency of that event is 1 hour. In this article we change the frequency to 5 minutes to make it quicker to test. We don’t want to be waiting up to an hour for every test.
Finally, once we know the event is being triggered, we need to check deeper for ‘why’ we’re not seeing an alert.
Change the frequency of the “/etc/passwd” event check.
- Log into Zabbix as an administrator.
- Go to Configure, Templates.
- Locate the template “Template OS Linux”.
- Go to Triggers.
- Go to the (green link) “Template OS Linux:vfs.file.cksum[/etc/passwd]”.
- Change the “Update Interval” from “1h” to “5m”.
- Click the “Update” button at the bottom of the form.
At this stage we will know if the event is triggered within 5 minutes of the change being made.
Make a change to the “/etc/passwd” file to trigger an event.
- Make a change to the “/etc/passwd” file. Tip: change a comment field.
- Save your change and exit the file.
Check for evidence of an alert.
This is where your system administration skills come into play. If you’re troubleshooting email alerts, focus on the mail server logs such as “/var/log/maillog”. If you’re troubleshooting a custom script, focus on the “alertscripts” directory which is specified in the “/etc/zabbix/zabbix_server.conf” directory on a CentOS/Redhat server.
