Regular expression syntax

[bkowalewski]

I'm trying to get the regular expression to work in a log monitoring item. It works fine for a simple pattern - ERROR: . I want to make it work for a regular expression that has alternate patterns - ERROR:|Error: .

I have tried: ERROR:|Error: and ERROR:\|Error: . Both options don't work; passes the syntax check, but gets errors in the server log when running.

Is there a specification for the regular expression to be used here?

[Alexei]

What is your full item key?

[bkowalewski]

Here's one that may be working, no error messages:

log[/var/adm/messages,E....\:]

Here's the one that give errors:

log[/var/adm/messages,ERROR:\|Error:]

Where would there be a link to a doc that describes the syntax that should work? Does it only accept basic regular expressions, or extended regular expressions? Seems like the trigger accepts extended expressions and the item only accepts basic expressions.

Also, is there a performance hit or other problems if I put multiple items looking at a single log? I think I need to get a more sophisticated expression into the item, since it looks like I won't be able to filter the logs at the trigger. On the trigger, I am doing the "nodata" thing to get the trigger to reset when there are no bad log messages.