hmm, that might not be easy to trigger on, though - there isn't really any substring extraction and subsequent matching in triggers

trigger based on regexp is not problem, for example i can check "if version regexp 2014[a-i] then alarm" or "if version regexp 201[0-3][a-z] then alarm"

Looks like "dpkg --get-selections" is used for check installed packages:
/src/libs/zbxsysinfo/linux/software.c

static ZBX_PACKAGE_MANAGER package_managers[] =
/* NAME TEST_CMD LIST_CMD PARSER */
{

,

,

,

,

};

my suggest is to use "dpkg-query --show " because respoanse include version of package

RHEL/OL/CENTOS

1. rpm -qa tzdata
   tzdata-2014h-1.el6.noarch

DEBIAN/UBUNTU

1. dpkg --get-selections tzdata
   tzdata install

my suggestion:

1. dpkg-query --show tzdata
   tzdata 2014h-0ubuntu0.12.04

in this case UBUNTU response will be more similar to RHEL/OL/CENTOS

any news?

dpkg --get-selections
change to
dpkg-query --show

and some small modification of dpkg_parser

as result you can see [package]-[version] in response. right now only [package] returned from ubuntu. all other OSes return [package]-[version]

or just implement system.sw.packageversion[package] that return version of package

it can be used for lot of things.

for example -
today linux vulnerability - GHOST

i just want to catch all hosts that have this weakness by checking package version

Is there a possibility of using an alternative function on Debian based systems until this is fixed...? I have templates which cannot collect package versions due to this bu/issue.

Presently, I've had to enable a lot of external scripts in order to make this work. My preference for Zabbix over Nagios is partially due to not having to run a lot of external scripts to get functionality such as this.

Happy to provide templates and logs if needed.

For rpm-based distrо - return the package version:

[rpm] GeoIP-1.5.0-11.el7.x86_64, NetworkManager-1.4.0-17.el7_3.x86_64...

For debian-based Linux does not return the package version:

[dpkg] acl, acpi, acpi-support-base, acpid, adduser...

It would be cool to be able to specify the format of the returned package list. Or just have versions of deb-packages, for example in this format:

dpkg-query -W -f='${Package} ${Version} ${Architecture}'

Required functionality could also be achieved by user parameter and CSV to JSON preprocessing step.

UserParameter=system.sw.packages.get,echo 'Package,Version,Architecture' ; dpkg-query -W -f='${Package},${Version},${Architecture}\n'

C Agent ready for code review in development branch.

New item key system.sw.packages.get[<regexp>,<manager>] available on GNU/Linux systems. It returns JSON in format:

[
    {
        "name": "util-linux-core",
        "manager": "rpm",
        "version": "2.37.4-3.el9",
        "size": 1296335,
        "arch": "x86_64",
        "buildtime": {
            "timestamp" : 1653552239,
            "value" : "Sep 20 01:39:40 2021 UTC"
        },
        "installtime": {
            "timestamp" : 1660780885,
            "value" : "Aug 18 00:01:25 2022 UTC"
        }
    },
    [...]
] 

Go agent part implemented in development branch (PR)

Fixed in

• 6.4.0rc1 d3909389ffc

New agent and agent2 metric system.sw.packages.get[<regex>, <manager>] (both parameters optional) can be used to monitor details of the installed packages.

After this change current template Template Module Linux generic by Zabbix agent will be modified:

1. Change item system.sw.packages to system.sw.packages.get .
2. Add new trigger that fires when number of installed packages change.

For those that want to try the feature until it's documented, the output is in JSON format, containing array of objects, each object describing a package. E. g.

[
    {
        "name": "util-linux-core",
        "manager": "rpm",
        "version": "2.37.4-3.el9",
        "size": 1296335,
        "arch": "x86_64",
        "buildtime": {
            "timestamp" : 1653552239,
            "value" : "Sep 20 01:39:40 2021 UTC"
        },
        "installtime": {
            "timestamp" : 1660780885,
            "value" : "Aug 18 00:01:25 2022 UTC"
        }
    },
    {
        "name": "xfonts-base",
        "manager": "dpkg",
        "version": "1:1.0.5",
        "arch": "all",
        "size": 7337984,
        "buildtime": {
            "timestamp": 0,
            "value": ""
        },
        "installtime": {
            "timestamp": 0,
            "value": ""
        }
    }
]

If build time or install time is not available, their timestamp is 0 and the value (human-readable representation of the datetime) is empty string. Size is in bytes.

Updated documentation:

• What's new in 6.4.0
• Template changes
• Zabbix agent items
• Zabbix agent 2 plugins