Need help to create a Regex

[Inglebard]

Hi,

I try to create a regex to match data, it works properly with "https://regex101.com/" but not in zabbix. I want to match line with word "vzdump" and without work "OK".

Any idea how to fix this ?

Here is the data I want to check :

00000BEB:304F6633:5E6752DC:vncshell::root@pam: 1 5E6752F8 OK
00000AC9:304F4EB8:5E6752A0:vncshell::root@pam: 1 5E6752B3 OK
00000920:304F311E:5E675254:vncshell::root@pam: 1 5E675295 OK
00005393:30306F71:5E670398:aptupdate::root@pam: 1 5E67039C OK
00007D63:3027D888:5E66ED9A:vzdump::root@pam: 1 5E6751E8 interrupted by signal
00006667:2FFEFFF0:5E66850A:vncproxy:101:root@pam: 1 5E668530 OK
000065FF:2FFEF405:5E6684EB:qmshutdown:101:root@pam: 1 5E668527 VM quit/powerdown failed - got timeout
000065D9:2FFEF0E8:5E6684E3:vncproxy:101:root@pam: 1 5E668509 OK
0000593A:2FFDAA4B:5E66819F:vncproxy:101:root@pam: 1 5E6684E2 OK
00004BAD:2FFC4715:5E667E12:vncproxy:101:root@pam: 1 5E66819F OK
000011D1:2FCFF413:5E660C99:vncproxy:100:root@pam: 1 5E660CC5 OK
000020C3:2FAB6605:5E65AF05:aptupdate::root@pam: 1 5E65AF09 OK
00005567:2FA4024D:5E659C1A:vzdump::root@pam: 1 5E65C64A got unexpected control message:  
00004339:2F226F81:5E645065:aptupdate::root@pam: 1 5E645069 OK
00002CCC:2F202C65:5E644A9A:vzdump::root@pam: 1 5E660C89 got unexpected control message:  
00004461:2EBBD4F9:5E6349BA:vzdump:100:root@pam: 1 5E636703 OK
0000650A:2EA5BDE4:5E63112D:aptupdate::root@pam: 1 5E631132 OK
000008A8:2E9C5637:5E62F91A:vzdump::root@pam: 1 5E631790 OK
0000655B:2E188061:5E61A79A:vzdump::root@pam: 1 5E61C5C6 OK
00006145:2E184AB2:5E61A711:aptupdate::root@pam: 1 5E61A715 OK
00004958:2D95EBF1:5E605951:aptupdate::root@pam: 1 5E605956 OK
00003CF7:2D94AA5B:5E60561A:vzdump::root@pam: 1 5E60740F OK
00007997:2D1AC836:5E5F1E14:aptupdate::root@pam: 1 5E5F1E19 OK
00001828:2D10D46C:5E5F049A:vzdump::root@pam: 1 5E5F228A OK
00001154:2C8FE59A:5E5DBA89:aptupdate::root@pam: 1 5E5DBA8D OK

Here is my zabbix trigger :

{Template_Proxmox_Backup_Status:vfs.file.contents["/var/log/pve/tasks/active"].iregexp(".*vzdump(?!.*OK).*")}=1

[Frogg]

It works on regexp 101 cause it use the option m (mulilines)

If i understand well the documentation :
sec ou #num (optionnel) - période d’évaluation en secondes ou dans les dernières valeurs collectées (précédée d’un signe dièse). Dans ce cas, plusieurs valeurs peuvent être traitées.

By default it take the last line ? so you have to set #10 for the 10 last line ?

It is just theorical, i hope it help

[Inglebard]

So how can I do in in zabbix ?

[Hamardaban]

Use log monitoring log.count. Create a data element that collects the number of occurrences of the desired substring and a trigger if this value is greater than zero.

https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/log_items

[Inglebard]

Hi,

Thanks Hamardaban , I will try your solution.