Returned values from system.run script? Can they be referenced in Operations?

[jmrice]

I have Items and Triggers that check SSL Certificates for the number of days remaining before they expire. 90d, 60d, 30d, etc.
They send email and slack messages to sysadmins. But I also want to include the Issuer from the Certificate.
I have created another script that returns that value, and I can create Items for each one.

Within the Operations default message, there are macros that expand to form the message, such as: {{HOST.HOST}:{ITEM.KEY}.last()}
My question is, where does the return value from my new script save its value, and can I reference it in the message?

Wouldn't it just be another {ITEM.KEY}.last() but from a different item? Can I create a user macro to place the return value into?

[jmrice]

Second question, can I run more than one system.run command in the same item?

[isaqueprofeta]

I have Items and Triggers that check SSL Certificates for the number of days remaining before they expire. 90d, 60d, 30d, etc.
They send email and slack messages to sysadmins. But I also want to include the Issuer from the Certificate.
I have created another script that returns that value, and I can create Items for each one.

Within the Operations default message, there are macros that expand to form the message, such as: {{HOST.HOST}:{ITEM.KEY}.last()}
My question is, where does the return value from my new script save its value, and can I reference it in the message?

Wouldn't it just be another {ITEM.KEY}.last() but from a different item? Can I create a user macro to place the return value into?

Example 2 seems to be what you want: https://www.zabbix.com/documentation...eration/macros you're going to try something like:

{{HOST.HOST}:my_second_itemkey.last()}

inside the message.

Second question, can I run more than one system.run command in the same item?

No.

[jmrice]

As an example ...

The Item I created is named: Check SSL Issuer - mydomain.com
Type: Zabbix agent
Key: system.run[/usr/local/bin/checkissuer.sh mydomain.com 443]
Type of information: Character

Under Monitoring -> Latest Data, it appears as:
Name: Check SSL Issuer - mydomain.com
Last value: COMODO CA Limited

There are no triggers for this Item. It simply returns the Issuer name.
How can I reference this from within an Operations message that is
triggered from an SSL Expiration warning? (A different Item).

What would be the macro I would use to reference the Last value, or can I?

[isaqueprofeta]

{{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()}

[jmrice]

This is getting closer. I have multiple Items, and multiple triggers. But the Operation Message is global. How would I be able to specify each unique domain within the message?

For example, one such {EVENT.NAME} is SSL Certificate Expiration Warning - mydomain.com (60d)
Another might be: SSL Certificate Expiration Warning - myotherdomain.com (30d)

Can I parse the {EVENT.NAME} using regsub() somehow?

Another idea might be to use event tags, as in Name: domain Value: myotherdomain.com

Then reference it as {EVENT.TAG.domain} ? Or am I missing the whole concept here?

[jmrice]

What I want is something like this:
{{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh {domain} 443].last()}

If that makes sense?

[isaqueprofeta]

This is getting closer. I have multiple Items, and multiple triggers. But the Operation Message is global. How would I be able to specify each unique domain within the message?

For example, one such {EVENT.NAME} is SSL Certificate Expiration Warning - mydomain.com (60d)
Another might be: SSL Certificate Expiration Warning - myotherdomain.com (30d)

Can I parse the {EVENT.NAME} using regsub() somehow?

Another idea might be to use event tags, as in Name: domain Value: myotherdomain.com

Then reference it as {EVENT.TAG.domain} ? Or am I missing the whole concept here?

In that way, I'd try to use {EVENT.TAGS.<tag name>} or in your case {EVENT.TAGS.domain}

[jmrice]

Thank you, sir. I was hoping for a global solution, that I could enter once, rather than having to add a tag to literally hundreds of individual triggers. But that will work.

[jmrice]

Does Zabbix support Extended Regular Expressions? I've been trying to test the use of regsub(), but can't get anything to match.
Not sure what to put into the regular expressions test screen. I've tried using the test page at https://regex101.com/

^.*- (.*?)(?: \() Is what I want, using capture groups and such, but translating that to Zabbix syntax is a bit elusive.

I'm hoping for something like:

Issuer: {system.run[/usr/local/bin/checkissuer.sh {EVENT.NAME}.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

[isaqueprofeta]

Does Zabbix support Extended Regular Expressions? I've been trying to test the use of regsub(), but can't get anything to match.
Not sure what to put into the regular expressions test screen. I've tried using the test page at https://regex101.com/

^.*- (.*?)(?: \() Is what I want, using capture groups and such, but translating that to Zabbix syntax is a bit elusive.

I'm hoping for something like:

Issuer: {system.run[/usr/local/bin/checkissuer.sh {EVENT.NAME}.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

Be sure to use PECR (PHP) type of regex, and you can try inside zabbix using Admin->Geral->Regular Expressions

[jmrice]

Not sure I follow. What would I put in the Admin -> General -> Regular Expressions Expression Type and Expression? And it needs a delimeter. (?)
My test string is "SSL Certificate Expiration Warning - myotherdomain.com (60d)

I want the characters after the "- " and before the " (" so, just myotherdomain.com

I can get that to work on https://regex101.com/ using PCRE (PHP) Match, but not sure how to test on Zabbix.

[isaqueprofeta]

Not sure I follow. What would I put in the Admin -> General -> Regular Expressions Expression Type and Expression? And it needs a delimeter. (?)
My test string is "SSL Certificate Expiration Warning - myotherdomain.com (60d)

I want the characters after the "- " and before the " (" so, just myotherdomain.com

I can get that to work on https://regex101.com/ using PCRE (PHP) Match, but not sure how to test on Zabbix.

Create a new empty one and use the tab "test", source: https://www.zabbix.com/documentation...sions#examples

[jmrice]

Been there, done that. Was just hoping to "see" the matched characters, and not just a Result of TRUE.
I just put the expression in the Operations message. I should get a trigger tomorrow morning for a 30 day expiration warning.

[jmrice]

For those who are curious, I received the notification this morning:

SSL Certificate expires in 30 days !!
Issuer: {system.run[/usr/local/bin/checkissuer.sh SSL Certificate Expiration Warning - mydomain.com (30d).regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

Here is the Operations message:

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY}.last()} days !!
Issuer: {system.run[/usr/local/bin/checkissuer.sh {EVENT.NAME}.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

So, it interpreted the {EVENT.NAME} but treated the rest of the line as literal text.

I'm changing the Operations message expression to:

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY}.last()} days !!
Issuer: {{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh {EVENT.NAME}.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

In the hope that the {HOST.HOST} part is necessary in order to locate and retrieve the actual data value.
I will know tomorrow ...