新建一个模板：Linux_ssh_temp

新建监控项：

登录失败监控项：

ssh_login_error：log[/var/log/auth.log,"(Accepted|Failed) password",,,skip,]

#/var/log/auth.log为linux ssh 日志路径，需要确保zabbix用户有该文件的读取权限；

登录成功监控项：

ssh_login_pass：log[/var/log/auth.log,"Accepted password",,,skip,]

新建触发器：

SSH登录失败：{Linux_ssh_temp:log[/var/log/auth.log,"(Accepted|Failed) password",,,skip,].nodata(60)}=0 and
{Linux_ssh_temp:log[/var/log/auth.log,"(Accepted|Failed) password",,,skip,].str(Failed)}=1

SSH登录成功：{Linux_ssh_temp:log[/var/log/auth.log,"Accepted password",,,skip,].nodata(60)}=0 and
{Linux_ssh_temp:log[/var/log/auth.log,"Accepted password",,,skip,].str(Accepted)}=1

zabbix agent端：

/etc/zabbix/zabbix_agentd.conf

Hostname=web-server-01  # 与 Web 界面中的监控主机名一致
Server=192.168.1.100    # Zabbix Server 的 IP
ServerActive=192.168.1.100  # 主动模式下的 Server IP

/var/log/auth.log赋予zabbix读取权限并保持agent10050端口可以访问：sudo usermod -aG adm zabbix