Using message from SNMP Trap for Trigger name

[Shahoff]

And thank you very much for your help!

[dbianchi]

Hi everyone,

I'm not an expert in regex expression, I have the same problem as Shahoff.

My regex is not working properly

{{ITEM.VALUE}.regsub("\.18\stype=4\s*value=STRING:\s\x22(.*)\x22", "Trap Received: \1")}

I need to extract

Presence of Primary Synchronism

from this trap value

08:59:57 2021/11/19 PDU INFO: messageid 0 transactionid 2 version 0 errorstatus 0 community public receivedfrom UDP: [192.168.0.220]:1034->[192.168.0.127]:162 requestid 0 notificationtype TRAP errorindex 0 VARBINDS: iso.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (58187) 0:09:41.87 iso.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: iso.3.6.1.4.1.37755.0.6 iso.3.6.1.4.1.37755.11.2 type=2 value=INTEGER: 1635580269 iso.3.6.1.4.1.37755.11.7 type=2 value=INTEGER: 2012028 iso.3.6.1.4.1.37755.11.8 type=2 value=INTEGER: 9437666 iso.3.6.1.4.1.37755.11.6 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.16 type=2 value=INTEGER: 5 iso.3.6.1.4.1.37755.11.15 type=2 value=INTEGER: 1 iso.3.6.1.4.1.37755.11.9 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.17 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.4 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.5 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.14 type=4 value=STRING: "N/A" iso.3.6.1.4.1.37755.11.18 type=4 value=STRING: "Presence of Primary Synchronism" iso.3.6.1.6.3.18.1.3.0 type=64 value=IpAddress: 192.168.0.220 iso.3.6.1.6.3.18.1.4.0 type=4 value=STRING: "public" iso.3.6.1.6.3.1.1.4.3.0 type=6 value=OID: iso.3.6.1.4.1.37755

But I receive the ITEM.VALUE + regsub("\.18\stype=4\s*v.........
Here's the output

08:59:57 2021/11/19 PDU INFO: messageid 0 transactionid 2 version 0 errorstatus 0 community public receivedfrom UDP: [192.168.0.220]:1034->[192.168.0.127]:162 requestid 0 notificationtype TRAP errorindex 0 VARBINDS: iso.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (58187) 0:09:41.87 iso.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: iso.3.6.1.4.1.37755.0.6 iso.3.6.1.4.1.37755.11.2 type=2 value=INTEGER: 1635580269 iso.3.6.1.4.1.37755.11.7 type=2 value=INTEGER: 2012028 iso.3.6.1.4.1.37755.11.8 type=2 value=INTEGER: 9437666 iso.3.6.1.4.1.37755.11.6 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.16 type=2 value=INTEGER: 5 iso.3.6.1.4.1.37755.11.15 type=2 value=INTEGER: 1 iso.3.6.1.4.1.37755.11.9 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.17 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.4 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.5 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.14 type=4 value=STRING: "N/A" iso.3.6.1.4.1.37755.11.18 type=4 value=STRING: "Presence of Primary Synchronism" iso.3.6.1.6.3.18.1.3.0 type=64 value=IpAddress: 192.168.0.220 iso.3.6.1.6.3.18.1.4.0 type=4 value=STRING: "public" iso.3.6.1.6.3.1.1.4.3.0 type=6 value=OID: iso.3.6.1.4.1.37755.regsub("\.18\stype=4\s*value=STRING:\s(.*))

Hope anyone can help me
Thanks in advance

[ISiroshtan]

As far as I can say by this thread, people struggled with quotes a lot. In which case it would be way easier to just take them into match group. But everybody does things as they like it so...

Please do try:

{{ITEM.VALUE}.regsub("\.18 type=4 value=STRING: (.*?) iso","Trap Received: \1")}

[dbianchi]

Hi,
thanks for your reply.

I tried

{{ITEM.VALUE}.regsub("\.18 type=4 value=STRING: (.*?) iso","Trap Received: \1")}

but Zabbix does not solve the regex

I still get the all ITEM.VALUE.regsub.....

11:38:28 2021/11/29 PDU INFO: receivedfrom UDP: [192.168.0.220]:1034->[192.168.0.127]:162 notificationtype TRAP errorindex 0 requestid 0 version 0 transactionid 4 messageid 0 errorstatus 0 community public VARBINDS: iso.3.6.1.2.1.1.3.0 type=67 value=Timeticks: (48774) 0:08:07.74 iso.3.6.1.6.3.1.1.4.1.0 type=6 value=OID: iso.3.6.1.4.1.37755.0.6 iso.3.6.1.4.1.37755.11.2 type=2 value=INTEGER: 1636453803 iso.3.6.1.4.1.37755.11.7 type=2 value=INTEGER: 2012028 iso.3.6.1.4.1.37755.11.8 type=2 value=INTEGER: 9437666 iso.3.6.1.4.1.37755.11.6 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.16 type=2 value=INTEGER: 5 iso.3.6.1.4.1.37755.11.15 type=2 value=INTEGER: 1 iso.3.6.1.4.1.37755.11.9 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.17 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.4 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.5 type=2 value=INTEGER: 0 iso.3.6.1.4.1.37755.11.14 type=4 value=STRING: "N/A" iso.3.6.1.4.1.37755.11.18 type=4 value=STRING: "Presence of Primary Synchronism" iso.3.6.1.6.3.18.1.3.0 type=64 value=IpAddress: 192.168.0.220 iso.3.6.1.6.3.18.1.4.0 type=4 value=STRING: "public" iso.3.6.1.6.3.1.1.4.3.0 type=6 value=OID: iso.3.6.1.4.1.37755.regsub("\.18\stype=4\s*value=STRING:\s(.*))

In attach you can find a screenshot of my trigger

Thanks a lot

[dbianchi]

As far as I can say by this thread, people struggled with quotes a lot. In which case it would be way easier to just take them into match group. But everybody does things as they like it so...

Please do try:

{{ITEM.VALUE}.regsub("\.18 type=4 value=STRING: (.*?) iso","Trap Received: \1")}

I checked better and found that I receive the

{TRIGGER.NAME}

is empty in the email

I was checking the [CODE][{ITEM.VALUE}/CODE] and the output is

{ITEM.VALUE}.regsub("\.18\stype=4\s*value=STRING:\s(.*))

Hope this can help to understand the problem

Thanks in advance