Zabbix Documentation 3.4

3.04.05.0 (current)| In development:5.2 (devel)| Unsupported:1.82.02.22.43.23.44.24.4Guidelines

User Tools

Site Tools


manual:regular_expressions

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

manual:regular_expressions [2019/05/31 13:23]
manual:regular_expressions [2019/04/25 07:48] (current)
martins-v it's possible to run out of stack when using regular expressions
Line 1: Line 1:
 +====== 12. Regular expressions ======
 +
 +=== Overview ===
 +
 +[[https://​en.wikipedia.org/​wiki/​Perl_Compatible_Regular_Expressions|Perl Compatible Regular Expressions]] (PCRE) are supported in Zabbix.
 +
 +There are two ways of using regular expressions in Zabbix:
 +
 +  * manually entering a regular expression
 +  * using a global regular expression created in Zabbix
 +
 +=== Regular expressions ===
 +
 +You may manually enter a regular expression in supported places. Note that the expression may not start with @ because that symbol is used in Zabbix for referencing global regular expressions.
 +
 +<note warning>​It'​s possible to run out of stack when using regular expressions. See the [[http://​pcre.org/​original/​doc/​html/​pcrestack.html|pcrestack man page]] for more information.</​note>​
 +
 +=== Global regular expressions ===
 +
 +There is an advanced editor for creating and testing complex regular expressions in Zabbix frontend.
 +
 +Once a regular expression has been created this way, it can be used in several places in the frontend by referring to its name, prefixed with @, for example, //​@mycustomregexp//​.
 +
 +To create a global regular expression:
 +
 +  * Go to: //​Administration -> General//
 +  * Select //Regular expressions//​ from the dropdown
 +  * Click on //New regular expression//​
 +
 +The **Expressions** tab allows to set the regular expression name and add subexpressions. ​
 +
 +{{manual:​regular_expressions:​regexp_expr.png?​600|}}
 +
 +^Parameter ​ ^^Description^
 +|//Name// ||Set the regular expression name. Any Unicode characters are allowed. ​ |
 +|//​Expressions// ​ ||Click on //Add// in the Expressions block to add a new subexpression. ​ |
 +^   ​|//​Expression type// ​ |Select expression type:\\ **Character string included** - match the substring\\ **Any character string included** - match any substring from a delimited list. The delimited list includes a comma (,), a dot (.) or a forward slash (/).\\ **Character string not included** - match any string except the substring\\ **Result is TRUE** - match the regular expression\\ **Result is FALSE** - do not match the regular expression ​ |
 +^:::​|//​Expression// ​ |Enter substring/​regular expression. ​ |
 +|//​Delimiter//​ ||A comma (,), a dot (.) or a forward slash (/) to separate text strings in a regular expression. This parameter is active only when "//Any character string included//"​ expression type is selected. ​   |
 +|//Case sensitive// ||A checkbox to specify whether a regular expression is sensitive to capitalization of letters. ​ |
 +
 +Since Zabbix 2.4.0, a forward slash (/) in the expression is treated literally, rather than a delimiter. This way it is possible to save expressions containing a slash, whereas previously it would produce an error.
 +
 +<note important>​A custom regular expression name in Zabbix may contain commas, spaces, etc. In those cases where that may lead to misinterpretation when referencing (for example, a comma in the parameter of an item key) the whole reference may be put in quotes like this: //”@My custom regexp for purpose1, purpose2”//​.\\ Regular expression names must not be quoted in other locations (for example, in LLD rule properties).</​note>​
 +
 +=== Example ===
 +
 +Use of the following regular expression in LLD to discover databases not taking into consideration a database with a specific name:  ​
 +
 +  ^TESTDATABASE$
 +
 +{{:​manual:​regular_expressions:​regexp_expr_2.png}}
 +
 +Chosen //​Expression type//: %%"​Result is FALSE"​%%. Doesn'​t match name, containing string "//​TESTDATABASE//"​.
 +
 +=== Example with an inline regex modifier ===
 +
 +Use of the following regular expression including an inline modifier (?i) to match the characters "​error":​
 +
 +  (?i)error
 +
 +{{:​manual:​regular_expressions:​regexp_expr_3a.png}}  ​
 +
 +Chosen //​Expression type//: %%"​Result is TRUE"​%%. Characters "​error"​ are matched. ​
 +
 +=== Another example with an inline regex modifier ===
 +
 +Use of the following regular expression including multiple inline modifiers to match the characters after a specific line:
 +  (?<​=match (?​i)everything(?​-i) after this line\n)(?​sx).*#​ we add s modifier to allow . match newline characters
 +
 +{{:​manual:​regular_expressions:​regexp_expr_4_new.png}}
 +
 +Chosen Expression type: %%"​Result is TRUE"​%%. Characters after a specific line are matched. ​
 +
 +<note important>​ **g** modifier can't be specified in line. The list of available modifiers can be found in [[https://​www.pcre.org/​original/​doc/​html/​pcresyntax.html#​SEC16|pcresyntax man page]]. For more information about PCRE syntax please refer to [[https://​www.pcre.org/​original/​doc/​html/​pcrepattern.html|PCRE HTML documentation]]. ​ </​note>​
 +
 +=== More complex example ===
 +
 +A custom regular expression may consist of multiple subexpressions,​ and it can be tested in the **Test** tab by providing a test string.
 +
 +{{manual:​regular_expressions:​regexp_test.png?​600|}}
 +
 +Results show the status of each subexpression and total custom expression status. ​
 +
 +Total custom expression status is defined as //Combined result//. If several sub expressions are defined Zabbix uses AND logical operator to calculate //Combined result//. It means that if at least one Result is False //Combined result// has also False status. ​
 +
 +
 +=== Explanation of global regular expressions ===
 +
 +^Global regexp^Expression^Description^
 +|//File systems for discovery// ​ |''​^(btrfs|ext2|ext3|ext4|jfs|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|refs|ntfs|fat32|zfs)$'' ​ |Matches "​btrfs"​ or "​ext2"​ or "​ext3"​ or "​ext4"​ or "​jfs"​ or "​reiser"​ or " xfs" or "​ffs"​ or "​ufs"​ or "​jfs"​ or "​jfs2"​ or "​vxfs"​ or "​hfs"​ or "​refs"​ or "​ntfs"​ or "​fat32"​ or "​zfs" ​ |
 +|//Network interfaces for discovery// ​ |''​^Software Loopback Interface'' ​ |Matches strings starting with "​Software Loopback Interface" ​ |
 +|  |''​^lo$'' ​ |Matches "​lo" ​ |
 +|  |''​^(In)?​[Ll]oop[Bb]ack[0-9._]*$'' ​ |Matches strings that optionally start with "​In",​ then have "​L"​ or "​l",​ then "​oop",​ then "​B"​ or "​b",​ then "​ack",​ which can be optionally followed by any number of digits, dots or underscores ​ |
 +|  |''​^NULL[0-9.]*$'' ​ |Matches strings staring with "​NULL"​ optionally followed by any number of digits or dots  |
 +|  |''​^[Ll]o[0-9.]*$'' ​ |Matches strings starting with "​Lo"​ or "​lo"​ and optionally followed by any number of digits or dots  |
 +|  |''​^[Ss]ystem$'' ​ |Matches "​System"​ or "​system" ​ |
 +|  |''​^Nu[0-9.]*$'' ​ |Matches strings staring with "​Nu"​ optionally followed by any number of digits or dots  |
 +|//Storage devices for SNMP discovery// ​ |''​^(Physical memory|Virtual memory|Memory buffers|Cached memory|Swap space)$'' ​ |Matches "​Physical memory"​ or "​Virtual memory"​ or "​Memory buffers"​ or "​Cached memory"​ or "Swap space" ​ |
 +|//Windows service names for discovery// ​ |''​^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32)$'' ​ |Matches "​MMCSS"​ or "​gupdate"​ or "​SysmonLog"​ or strings like "​clr_optimization_v2.0.50727_32"​ and "​clr_optimization_v4.0.30319_32"​ where instead of dots you can put any character except newline. ​ |
 +|//Windows service startup states for discovery// ​ |''​^(automatic|automatic delayed)$'' ​ |Matches "​automatic"​ or "​automatic delayed"​. ​ |
 +
 +=== Regular expression support by location ===
 +
 +^Location^^Regexp support^Global regexp support^Comments^
 +| |||||
 +^Macro functions^^^^^
 +|   ​^regsub() |Yes|No |**pattern** parameter|
 +|:::​^iregsub()|:::​|:::​|:::​|
 +| |||||
 +^Trigger functions^^^^^
 +|   ​^count() ​    ​|Yes|Yes|**pattern** parameter if **operator** parameter is //regexp// or //​iregexp//​|
 +|:::​^logeventid()|:::​|:::​|**pattern** parameter|
 +|:::​^iregexp() ​  ​|:::​|:::​|:::​|
 +|:::​^regexp() ​   |:::​|:::​|:::​|
 +| |||||
 +^Low-level discovery^^^^^
 +| ||Yes|Yes|//​Filter//​ field|
 +| |||||
 +^Web monitoring^^^^^
 +|   ​||Yes|No |//​Variables//​ with a **regex:** prefix\\ //Required string// field|
 +| |||||
 +^Zabbix agent items^^^^^
 +|   ​^eventlog[] ​         |Yes|Yes|**regexp**,​ **severity**,​ **source**, **eventid** parameters|
 +|:::​^log[] ​              ​|:::​|:::​|**regexp** parameter|
 +|:::​^log.count[] ​        ​|:::​|:::​|:::​|
 +|:::​^logrt[] ​            ​|:::​|Yes/​No|**regexp** parameter supports both, **file_regexp** parameter supports non-global expressions only|
 +|:::​^logrt.count[] ​      ​|:::​|:::​|:::​|
 +|:::​^proc.cpu.util[] ​    ​|:::​|No |**cmdline** parameter|
 +|:::​^proc.mem[] ​         |:::​|:::​|:::​|
 +|:::​^proc.num[] ​         |:::​|:::​|:::​|
 +|:::​^sensor[] ​           |:::​|:::​|**device** and **sensor** parameters on Linux 2.4|
 +|:::​^system.hw.macaddr[] |:::​|:::​|**interface** parameter|
 +|:::​^system.sw.packages[]|:::​|:::​|**package** parameter|
 +|:::​^vfs.dir.size[] ​     |:::​|:::​|**regex_incl** and **regex_excl** parameters|
 +|:::​^vfs.file.regexp[] ​  ​|:::​|:::​|**regexp** parameter|
 +|:::​^vfs.file.regmatch[] |:::​|:::​|:::​|
 +|:::​^web.page.regexp[] ​  ​|:::​|:::​|:::​|
 +| |||||
 +^SNMP traps^^^^^
 +| ^snmptrap[]|Yes|Yes|**regexp** parameter|
 +| |||||
 +^Icon mapping^^^^^
 +| ||Yes|Yes|//​Expression//​ field|
 +| |||||
 +^Item value preprocessing^^^^^
 +| ||Yes|No|**pattern** parameter|
 +| |||||