POSIX extended regular expressions are supported in Zabbix.
There are two ways of using regular expressions in Zabbix:
You may manually enter a regular expression in supported places. Note that the expression may not start with @ because that symbol is used in Zabbix for referencing global regular expressions.
There is an advanced editor for creating and testing complex regular expressions in Zabbix frontend.
Once a regular expression has been created this way, it can be used in several places in the frontend by referring to its name, prefixed with @, for example, @mycustomregexp.
To create a global regular expression:
The Expressions tab allows to set the regular expression name and add subexpressions.
|Name||Set the regular expression name. Any Unicode characters are allowed.|
|Expressions||Click on Add in the Expressions block to add a new subexpression.|
|Expression type||Select expression type:
Character string included - match the substring
Any character string included - match any substring from a comma-delimited list
Character string not included - match any string except the substring
Result is TRUE - match the regular expression
Result is FALSE - do not match the regular expression
|Expression||Enter substring/regular expression.|
Since Zabbix 2.4.0, a forward slash (/) in the expression is treated literally, rather than a delimiter. This way it is possible to save expressions containing a slash, whereas previously it would produce an error.
Use of the following regular expression in LLD to discover databases not taking into consideration a database with a specific name:
Chosen Expression type: “Result is FALSE”. Doesn't match name, containing string “TESTDATABASE”.
A custom regular expression may consist of multiple subexpressions, and it can be tested in the Test tab by providing a test string.
Results show the status of each subexpression and total custom expression status.
Total custom expression status is defined as Combined result. If several sub expressions are defined Zabbix uses AND logical operator to calculate Combined result. It means that if at least one Result is False Combined result has also False status.
|File systems for discovery||Matches “btrfs” or “ext2” or “ext3” or “ext4” or “jfs” or “reiser” or “ xfs” or “ffs” or “ufs” or “jfs” or “jfs2” or “vxfs” or “hfs” or “refs” or “ntfs” or “fat32” or “zfs”|
|Network interfaces for discovery||Matches strings starting with “Software Loopback Interface”|
|Matches strings that optionally start with “In”, then have “L” or “l”, then “oop”, then “B” or “b”, then “ack”, which can be optionally followed by any number of digits, dots or underscores|
|Matches strings staring with “NULL” optionally followed by any number of digits or dots|
|Matches strings starting with “Lo” or “lo” and optionally followed by any number of digits or dots|
|Matches “System” or “system”|
|Matches strings staring with “Nu” optionally followed by any number of digits or dots|
|Storage devices for SNMP discovery||Matches “Physical memory” or “Virtual memory” or “Memory buffers” or “Cached memory” or “Swap space”|
|Windows service names for discovery||Matches “MMCSS” or “gupdate” or “SysmonLog” or strings like “clr_optimization_v2.0.50727_32” and “clr_optimization_v4.0.30319_32” where instead of dots you can put any character except newline.|
|Windows service startup states for discovery||Matches “automatic” or “automatic delayed”.|