Log item - PCRE works on RegExr.com but not in zabbix admin regex test / item

[k_andersen]

Hello


Being fairly new to both regex and zabbix, i've run into trouble with the zabbix log file item.

I have a regex which finds a line where my program starts and also returns the previous line.
Its used to monitor if the program was shut down properly before being started again.

I've verified that the regex (global) finds both lines that i am looking for on regexr.com
e.g. in the sample log data below:

01/10-18 00:10:23:885 TankMeasureCom v4.9.1 shut down...
01/10-18 00:13:19:622 TankMeasureCom v4.9.1 started...

and

01/10-18 00:14:12:639 blabladdd
01/10-18 00:14:13:639 TankMeasureCom v4.9.1 started...

However I can't get zabbix RegEx test (under admin/regex) to work.
Neither (of course) the actual log item in zabbix, posted below for reference.


Type: Zabbix agent active
Key:

log[c:\progra~1\ok3\drift\logfiles\TankMeasureComLog.txt,"(.*)\n.*TankMeasureCom.v[0-9].[0-9].[0-9].started.*",,,,\1,]

Type of info: Log


If there is a kind soul out there that would lend me some assistance I'd be most grateful.


My RegEx:

(.*)\n.*TankMeasureCom.v[0-9].[0-9].[0-9].started.*

Sample log data:

01/10-18 00:09:34:760 blablalba
01/10-18 00:10:22:745 blablalba
01/10-18 00:10:23:885 TankMeasureCom v4.9.1 shut down...
01/10-18 00:13:19:622 TankMeasureCom v4.9.1 started...
01/10-18 00:13:19:825 blablalba
01/10-18 00:13:19:841 blablalba
01/10-18 00:13:19:841 blablalba
01/10-18 00:14:12:639 blabladdd
01/10-18 00:14:13:639 TankMeasureCom v4.9.1 started...
01/10-18 00:14:19:936 blabla
01/10-18 00:14:19:951 blabla

Online example:
https://regexr.com/42alr


Edit #1 - I'm using zabbix 4.0
Edit #2 - Replaced example data with real life data after Chew.Young correctly pointed that out.
Edit #3 - Updated regexr example with new name

Cheers Kurt

[Mike2K]

Does zabbix read all the log lines properly if you omit the regex ?

[k_andersen]

Yes it does

[chew.young]

first of all, you log key did not match your sample log data (TankMeasureCom VS MyProgram). And how the trigger is defined?

[k_andersen]

Chew, I made a mistake in trying to generalize the example data and forgot to rename TankMeasureCom in the example RegEx above.

However the real life data is with the name TankMeasureCom, and still persists as originally described.

[chew.young]

How is trigger defined?

[k_andersen]

There is no trigger. I just made the log item so i would capture the data. I would define the trigger afterwards.

Is this the wrong approach ?

Edit: My problem i still that i don't get any data into zabbix server - should i provide agent log details ?