Zabbix Documentation 4.0

2.23.04.04.2 (current)In development:4.4 (devel)Unsupported:1.82.02.43.23.4

User Tools

Site Tools


manual:regular_expressions

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
manual:regular_expressions [2017/05/19 06:39]
martins-v POSIX -> PCRE
manual:regular_expressions [2019/05/31 13:24] (current)
martins-v adding 'apfs' to filesystem filter
Line 14: Line 14:
 You may manually enter a regular expression in supported places. Note that the expression may not start with @ because that symbol is used in Zabbix for referencing global regular expressions. You may manually enter a regular expression in supported places. Note that the expression may not start with @ because that symbol is used in Zabbix for referencing global regular expressions.
  
 +<note warning>​It'​s possible to run out of stack when using regular expressions. See the [[http://​pcre.org/​original/​doc/​html/​pcrestack.html|pcrestack man page]] for more information.</​note>​
 +
 +Note that in multi-line matching, the ''​^''​ and ''​$''​ anchors match at the beginning/​end of each line respectively,​ instead of the beginning/​end of the entire string.
 === Global regular expressions === === Global regular expressions ===
  
Line 29: Line 32:
  
 {{manual:​regular_expressions:​regexp_expr.png?​600|}} {{manual:​regular_expressions:​regexp_expr.png?​600|}}
 +
 +All mandatory input fields are marked with a red asterisk. ​
  
 ^Parameter ​ ^^Description^ ^Parameter ​ ^^Description^
 |//Name// ||Set the regular expression name. Any Unicode characters are allowed. ​ | |//Name// ||Set the regular expression name. Any Unicode characters are allowed. ​ |
 |//​Expressions// ​ ||Click on //Add// in the Expressions block to add a new subexpression. ​ | |//​Expressions// ​ ||Click on //Add// in the Expressions block to add a new subexpression. ​ |
-^   ​|//​Expression type// ​ |Select expression type:\\ **Character string included** - match the substring\\ **Any character string included** - match any substring from a comma-delimited list\\ **Character string not included** - match any string except the substring\\ **Result is TRUE** - match the regular expression\\ **Result is FALSE** - do not match the regular expression ​ |+^   ​|//​Expression type// ​ |Select expression type:\\ **Character string included** - match the substring\\ **Any character string included** - match any substring from a delimited list. The delimited list includes a comma (,), a dot (.) or a forward slash (/). \\ **Character string not included** - match any string except the substring\\ **Result is TRUE** - match the regular expression\\ **Result is FALSE** - do not match the regular expression ​ |
 ^:::​|//​Expression// ​ |Enter substring/​regular expression. ​ | ^:::​|//​Expression// ​ |Enter substring/​regular expression. ​ |
 +|//​Delimiter//​ ||A comma (,), a dot (.) or a forward slash (/) to separate text strings in a regular expression. This parameter is active only when "//Any character string included//"​ expression type is selected. ​   |
 +|//Case sensitive// ||A checkbox to specify whether a regular expression is sensitive to capitalization of letters. ​ |
  
 Since Zabbix 2.4.0, a forward slash (/) in the expression is treated literally, rather than a delimiter. This way it is possible to save expressions containing a slash, whereas previously it would produce an error. Since Zabbix 2.4.0, a forward slash (/) in the expression is treated literally, rather than a delimiter. This way it is possible to save expressions containing a slash, whereas previously it would produce an error.
  
-<note important>​A custom regular expression name in Zabbix may contain commas, spaces, etc. In those cases where that may lead to misinterpretation when referencing (for example, a comma in the parameter of an item key) the whole reference may be put in quotes like this: //@My custom regexp for purpose1, purpose2//.\\ Regular expression names must not be quoted in other locations (for example, in LLD rule properties).</​note>​+<note important>​A custom regular expression name in Zabbix may contain commas, spaces, etc. In those cases where that may lead to misinterpretation when referencing (for example, a comma in the parameter of an item key) the whole reference may be put in quotes like this: //%%"%%@My custom regexp for purpose1, purpose2%%"%%//.\\ Regular expression names must not be quoted in other locations (for example, in LLD rule properties).</​note>​ 
 + 
 +=== Example === 
 + 
 +Use of the following regular expression in LLD to discover databases not taking into consideration a database with a specific name:   
 + 
 +  ^TESTDATABASE$ 
 + 
 +{{:​manual:​regular_expressions:​regexp_expr_2.png}} 
 + 
 +Chosen //​Expression type//: %%"​Result is FALSE"​%%. Doesn'​t match name, containing string "//​TESTDATABASE//"​. 
 + 
 +=== Example with an inline regex modifier === 
 + 
 +Use of the following regular expression including an inline modifier (?i) to match the characters "​error":​ 
 + 
 +  (?i)error 
 + 
 +{{:​manual:​regular_expressions:​regexp_expr_3a.png}} ​  
 + 
 +Chosen //​Expression type//: %%"​Result is TRUE"​%%. Characters "​error"​ are matched.  
 + 
 +=== Another example with an inline regex modifier === 
 + 
 +Use of the following regular expression including multiple inline modifiers to match the characters after a specific line: 
 +  (?<​=match (?​i)everything(?​-i) after this line\n)(?​sx).*#​ we add s modifier to allow . match newline characters 
 + 
 +{{:​manual:​regular_expressions:​regexp_expr_4_new.png}} 
 + 
 +Chosen Expression type: %%"​Result is TRUE"​%%. Characters after a specific line are matched.  
 + 
 +<note important>​ **g** modifier can't be specified in line. The list of available modifiers can be found in [[https://​www.pcre.org/​original/​doc/​html/​pcresyntax.html#​SEC16|pcresyntax man page]]. For more information about PCRE syntax please refer to [[https://​www.pcre.org/​original/​doc/​html/​pcrepattern.html|PCRE HTML documentation]]. ​ </​note>​ 
 + 
 +=== More complex example ===
  
 A custom regular expression may consist of multiple subexpressions,​ and it can be tested in the **Test** tab by providing a test string. A custom regular expression may consist of multiple subexpressions,​ and it can be tested in the **Test** tab by providing a test string.
Line 45: Line 85:
  
 Results show the status of each subexpression and total custom expression status. ​ Results show the status of each subexpression and total custom expression status. ​
 +
 +Total custom expression status is defined as //Combined result//. If several sub expressions are defined Zabbix uses AND logical operator to calculate //Combined result//. It means that if at least one Result is False //Combined result// has also False status. ​
 +
 +=== Explanation of global regular expressions ===
 +
 +^Global regexp^Expression^Description^
 +|//File systems for discovery// ​ |''​^(btrfs|ext2|ext3|ext4|jfs|reiser|xfs|ffs|ufs|jfs|jfs2|vxfs|hfs|refs|apfs|ntfs|fat32|zfs)$'' ​ |Matches "​btrfs"​ or "​ext2"​ or "​ext3"​ or "​ext4"​ or "​jfs"​ or "​reiser"​ or " xfs" or "​ffs"​ or "​ufs"​ or "​jfs"​ or "​jfs2"​ or "​vxfs"​ or "​hfs"​ or "​refs"​ or "​apfs"​ or "​ntfs"​ or "​fat32"​ or "​zfs" ​ |
 +|//Network interfaces for discovery// ​ |''​^Software Loopback Interface'' ​ |Matches strings starting with "​Software Loopback Interface" ​ |
 +|  |''​^lo$'' ​ |Matches "​lo" ​ |
 +|  |''​^(In)?​[Ll]oop[Bb]ack[0-9._]*$'' ​ |Matches strings that optionally start with "​In",​ then have "​L"​ or "​l",​ then "​oop",​ then "​B"​ or "​b",​ then "​ack",​ which can be optionally followed by any number of digits, dots or underscores ​ |
 +|  |''​^NULL[0-9.]*$'' ​ |Matches strings staring with "​NULL"​ optionally followed by any number of digits or dots  |
 +|  |''​^[Ll]o[0-9.]*$'' ​ |Matches strings starting with "​Lo"​ or "​lo"​ and optionally followed by any number of digits or dots  |
 +|  |''​^[Ss]ystem$'' ​ |Matches "​System"​ or "​system" ​ |
 +|  |''​^Nu[0-9.]*$'' ​ |Matches strings staring with "​Nu"​ optionally followed by any number of digits or dots  |
 +|//Storage devices for SNMP discovery// ​ |''​^(Physical memory|Virtual memory|Memory buffers|Cached memory|Swap space)$'' ​ |Matches "​Physical memory"​ or "​Virtual memory"​ or "​Memory buffers"​ or "​Cached memory"​ or "Swap space" ​ |
 +|//Windows service names for discovery// ​ |''​^(MMCSS|gupdate|SysmonLog|clr_optimization_v2.0.50727_32|clr_optimization_v4.0.30319_32)$'' ​ |Matches "​MMCSS"​ or "​gupdate"​ or "​SysmonLog"​ or strings like "​clr_optimization_v2.0.50727_32"​ and "​clr_optimization_v4.0.30319_32"​ where instead of dots you can put any character except newline. ​ |
 +|//Windows service startup states for discovery// ​ |''​^(automatic|automatic delayed)$'' ​ |Matches "​automatic"​ or "​automatic delayed"​. ​ |
 +
  
 === Regular expression support by location === === Regular expression support by location ===
  
-^Location^^Regexp support^Global ​regexp support^Comments^ +^Location^^Regular expression^Global ​regular expression^Comments^ 
-| ||||| + ||||| 
-^Macro functions^^^^^ +|**[[:manual/config/items/itemtypes/zabbix_agent|Agent items]]**|^  ^^^ 
-|   ​^regsub() |Yes|No ​|**pattern** parameter| +^   ​|eventlog[] ​         |Yes|Yes|''​regexp''​''​severity''​''​source''​''​eventid'' ​parameters| 
-|:::​^iregsub()|:::​|:::​|:::​| +|:::|log[]               ​|:::​|:::​|''​regexp'' ​parameter| 
-| ||||| +|:::|log.count[] ​        ​|:::​|:::​|:::​| 
-^Trigger functions^^^^^ +|:::|logrt[] ​            ​|:::​|Yes/​No|''​regexp'' ​parameter supports both, ''​file_regexp'' ​parameter supports non-global expressions only| 
-|   ​^count() ​    ​|Yes|Yes|**pattern** parameter if **operator** parameter is //regexp// or //iregexp//| +|:::|logrt.count[] ​      ​|:::​|:::​|:::​| 
-|:::​^logeventid()|:::​|:::​|**pattern** parameter| +|:::|proc.cpu.util[] ​    ​|:::​|No |''​cmdline'' ​parameter| 
-|:::^iregexp() ​  ​|:::​|:::​|:::​| +|:::|proc.mem[] ​         |:::​|:::​|:::​| 
-|:::^regexp() ​   |:::​|:::​|:::​| +|:::|proc.num[] ​         |:::​|:::​|:::​| 
-| ||||| +|:::|sensor[] ​           |:::|:::|''​device'' ​and ''​sensor'' ​parameters on Linux 2.4| 
-^Low-level discovery^^^^^ +|:::|system.hw.macaddr[] |:::|:::|''​interface'' ​parameter| 
-| ||Yes|Yes|//​Filter//​ field| +|:::|system.sw.packages[]|:::​|:::​|''​package'' ​parameter| 
-| ||||| +|:::|vfs.dir.count[] ​    ​|:::​|:::​|''​regex_incl''​ and ''​regex_excl''​ parameters| 
-^Web monitoring^^^^^ +|:::|vfs.dir.size[] ​     |:::|:::|''​regex_incl'' ​and ''​regex_excl'' ​parameters| 
-  ||Yes|No |//​Variables//​ with a **regex:** prefix\\ //Required string// field| +|:::|vfs.file.regexp[] ​  ​|:::​|:::​|''​regexp'' ​parameter| 
-| ||||| +|:::|vfs.file.regmatch[] |:::​|:::​|:::​| 
-^Zabbix agent items^^^^^ +|:::|web.page.regexp[] ​  ​|:::​|:::​|:::​| 
-|   ^eventlog[] ​         |Yes|Yes|**regexp****severity****source****eventid** parameters| +|**[[:​manual/​config/​items/​itemtypes/​snmptrap|SNMP traps]]**| ^^^ 
-|:::^log[]               ​|:::​|:::​|**regexp** parameter| +^ |snmptrap[] ​ |Yes|Yes|''​regexp'' ​parameter| 
-|:::^log.count[] ​        ​|:::​|:::​|:::​| +|**[[:​manual/​config/​items/​item#​item_value_preprocessing|Item value preprocessing]]** ​||Yes|No|''​pattern''​ parameter
-|:::^logrt[] ​            ​|:::​|Yes/​No|**regexp** parameter supports both, **file_regexp** parameter supports non-global expressions only| +|**[[:​manual/​appendix/​triggers/​functions|Trigger functions]]**| ^^^ 
-|:::^logrt.count[] ​      ​|:::​|:::​|:::​| +  |count() ​    ​|Yes|Yes|''​pattern''​ parameter if ''​operator''​ parameter is //regexp// or //​iregexp//​| 
-|:::^proc.cpu.util[] ​    ​|:::​|No |**cmdline** parameter| +|:::​|logeventid()|:::​|:::​|''​pattern''​ parameter| 
-|:::^proc.mem[] ​         |:::​|:::​|:::​| +|:::​|logsource() |:::​|:::​|:::​| 
-|:::^proc.num[] ​         |:::​|:::​|:::​| +|:::​|iregexp() ​  ​|:::​|:::​|:::​| 
-|:::^sensor[] ​           |:::|:::|**device** and **sensor** parameters on Linux 2.4| +|:::​|regexp() ​   |:::​|:::​|:::​| 
-|:::^system.hw.macaddr[] |:::|:::|**interface** parameter| +|**[[:​manual/​discovery/​low_level_discovery#​discovery_rule_filter|Low-level discovery]]** ​||Yes|Yes|//​Filter// field| 
-|:::^system.sw.packages[]|:::​|:::​|**package** parameter| +|**[[:​manual/​web_monitoring#​configuring_a_web_scenario|Web monitoring]]** ​  ||Yes|No |//​Variables//​ with a **regex:** prefix\\ //Required string// field| 
-|:::^vfs.dir.size[] ​     |:::|:::|**regex_incl** and **regex_excl** parameters| +|**[[:​manual/​config/​macros/​macro_functions|Macro functions]]**|^ ​ ^^^ 
-|:::^vfs.file.regexp[] ​  ​|:::​|:::​|**regexp** parameter| +^   ​|regsub() |Yes|No |''​pattern''​ parameter| 
-|:::^vfs.file.regmatch[] |:::​|:::​|:::​| +|:::​|iregsub()|:::​|:::​|:::​| 
-|:::^web.page.regexp[] ​  ​|:::​|:::​|:::​| +|**[[:​manual/​web_interface/​frontend_sections/​administration/​general#​icon_mapping|Icon mapping]]** ||Yes|Yes|//​Expression//​ field| 
-| ||||| + 
-^SNMP traps^^^^^ +
-^snmptrap[]|Yes|Yes|**regexp** parameter| +
-| ||||| +
-^Icon mapping^^^^^ +
-| ||Yes|Yes|//​Expression// field| +
-| |||||+