Regex in Zabbix

[ArtemK]

Hello everyone,

I'm using regexp function in my trigger and can't understand behavior of regular expressions in zabbix. Wiki clearly says, that Zabbix supports POSIX extended regexps, but can I use character class names like in perl?

I've created regexp:

^sent:\s\d+;\sskipped:\s\d+;\stotal:\s\d+$

And Result is TRUE, so I guess regexp working on test string. However, it doesn't work in trigger with regexp function

Ok, I've used POSIX character classes:

^sent:[[:space:]][[:digit:]]+;[[:space:]]skipped:[[:space:]][[:digit:]]+;[[:space:]]total:[[:space:]][[:digit:]]+$

Result also is TRUE and now trigger working correctly.

So, if I can't use char class names like in perl, why I didn't get any warning, when created first regex? Is it a bug or a feature?

Thanks!

[jaba]

I think you hit on bug:

https://support.zabbix.com/browse/ZBX-3924

[ArtemK]

Okay, forgot to search in bugtracker. Thanks!

[eriedl]

I'm trying to match two words in a SNMP trap item. However, I can't seem to get the regex right so that the server matches it. I tried various regex testers and my expression (232.136035000)((.|\n)*)(Controller 1) seems to match the following trap successfully, but the item in Zabbix can't.
I assume this has to do with the aforementioned bug, but my question is how would I have to format my regex to make it work with an item of type snmptrap[<regex>].

String to be matched:

08:19:52 2013/07/17 ZBXTRAP 1.1.1.1
PDU INFO:
  notificationtype               TRAP
  version                        1
  receivedfrom                   UDP: [1.1.1.1]:55264->[2.2.2.2]
  errorstatus                    0
  messageid                      0
  community                      Public
  transactionid                  102
  errorindex                     0
  requestid                      3936
VARBINDS:
  SNMPv2-SMI::mib-2.1.3.0        type=67 value=Timeticks: (1261628038) 146 days, 0:31:20.38
  SNMPv2-SMI::snmpModules.1.1.4.1.0 type=6  value=OID: SNMPv2-SMI::enterprises.232.136035000
  SNMPv2-SMI::enterprises.232.136.1.1.4 type=4  value=STRING: "mgmtmod"
  SNMPv2-SMI::enterprises.232.136.1.3.1.2.1.12 type=4  value=STRING: "blub: 17-Jul-2013/08:18:38"
  SNMPv2-SMI::enterprises.232.136.1.1.7.1.3 type=2  value=INTEGER: 35000
  SNMPv2-SMI::enterprises.232.136.1.1.7.1.6 type=4  value=STRING: "A Heart Beat Event is generated for one of the controller"
  SNMPv2-SMI::enterprises.232.136.1.3.4.2.1.4 type=2  value=INTEGER: 0
  SNMPv2-SMI::enterprises.232.136.1.3.4.2.1.2 type=4  value=STRING: "Controller 1"

[ArtemK]

Hi, probably \n is not supported, i.e. it should be smth like this

(232.136035000)((.|[[:space:]])*)(Controller[[:space:]]1)

But I'm not sure...

[eriedl]

thank you! that worked. I had to additionally enclose the statement with double quote so that it accepts square brackets in the key parameter, but your regex is correct: snmptrap["(232.136035000)((.|[[:space:]])*)(Controller[[:space:]]1)"]


Thanks again.