Returned values from system.run script? Can they be referenced in Operations?

[jmrice]

Another update ... still not working.

The Operations message:

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY}.last()} days !!
Issuer: {{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh {EVENT.NAME}.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

evaluated the message as:

SSL Certificate expires in 0 days !!
Issuer: {zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh SSL Certificate Expired! - mydomain.com.regsub("^.*- (.*?)(?: \()", "\1") 443].last()}

The expression "{{HOST.HOST}:{ITEM.KEY}.last()}" returned the appropriate value of "0".
The expression "{{HOST.HOST}" returned "zabbix.mydomain.com" appropriately enough.
And even the "{EVENT.NAME}" was expanded to "SSL Certificate Expired! - mydomain.com".

But, the rest of the expression was treated as literal text. The regsub() portion was not interpreted at all.

I have seen several other posts with similar issues, but no answers.

https://www.zabbix.com/forum/zabbix-...cro-event-name (Nov 2018)
https://www.zabbix.com/forum/zabbix-...-for-tag-value (Mar 2019)
https://www.zabbix.com/forum/zabbix-...sage-templates
https://www.zabbix.com/documentation...acro_functions

The last one says {ITEM.LASTVALUE} is supported.

I am beginning to believe that {EVENT.NAME}.regsub is NOT supported, and that there really is no way for me to achieve what I want to do.

Does anyone have any examples or other suggestions?

[Hamardaban]

You apply the «regsub» function to a macro for which it is not supported. Don't waste your own and others ' time - read the documentation.

https://www.zabbix.com/documentation...ro_functions?s[]=regsub

Supported for {ITEM.VALUE} / {ITEM.LASTVALUE} / Low-level discovery macros(except in low-level discovery rule filter)

[jmrice]

Thank you for your suggestion.

[jmrice]

Sorry to waste your time, but I still need an answer to this.

How do I reference an Item last value from within a Triggered event from a different Item?

I created a TAG in the Trigger named domain with value mydomain.com

I put this in the Operations message:

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY}.last()} days !!
Issuer: {{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh {EVENT.TAGS.domain} 443].last()}

But I am only receiving:

SSL Certificate expires in 0 days !!
Issuer: *UNKNOWN*

I found this in the docs:

https://www.zabbix.com/documentation/current/manual/config/event_correlation/trigger

Actual tags and tag values only become visible when a trigger fires.
If the regular expression used is invalid, it is silently replaced with an *UNKNOWN* string.

Is there something wrong with the Issuer expression?

Thank you!

[jmrice]

Is there a way to debug the expression as it is being evaluated?

[tim.mooney]

Is there a way to debug the expression as it is being evaluated?

You can increase the logging on the zabbix_server to be extremely verbose, but for that to be of any benefit you probably need to be able to at least partially understand the source code, because you'll need to reference the code to see where certain things are happening.

[tim.mooney]

Sorry to waste your time, but I still need an answer to this.

How do I reference an Item last value from within a Triggered event from a different Item?

Hamardaban and splitek answered a question similar to this a few months ago: https://www.zabbix.com/forum/zabbix-...multiple-items . In addition to that, there are other similar threads on these forums (finding the best one that most closely matches your scenario can be the difficult part, I agree).

The thing you probably need to understand about the technique they used is that auto-populated macros like {ITEM.VALUE1}, {ITEM.VALUE2}, etc. only get populated when you reference items in a trigger. You don't need to mess with regsub() at all in your message template if your trigger expression also uses your separate item that is collecting the issuer (note: you're doing that as two completely separate items. You probably want to take a look at the documentation for Dependent items )

The macro example 5 that splitek references from the documentation will hopefully show you how you can adjust your trigger so that it also includes the item for the issuer, and then you can reference that {ITEM.VALUE#} in your message.

[jmrice]

Thank you, Tim. Very helpful. Yes, I am using two separate items. I am using system.run to execute two scripts. One returns the number of days remaining before a certificate expires, the other returns the certificate Issuer.
I have triggers that check the number for <90, <60, <30, etc. and expired.

I was told that I cannot run two system.run commands in the same item. I suppose I could rewrite the script to return both values, maybe using dependent items and preprocessing to extract each value.
But the techniques described in your post seems to be two different approaches. Dependent Items vs. a combination trigger expression... I would still need to figure out how to reference the values in the operations message.

At least I have a couple ideas to do some trial and error.

[tim.mooney]

I was told that I cannot run two system.run commands in the same item.

That's correct, but the point is that for the method that was discussed in the forum post I quoted, you don't need to. They are two separate items.

I suppose I could rewrite the script to return both values, maybe using dependent items and preprocessing to extract each value.

You could, and I think that would be an enhancement and it would be useful if you're using this method to monitor dozens or hundreds of certs, but you don't need to. I mentioned dependent items only because I guessed that you might not be aware of them and because it can be an efficiency improvement and because it's a very good match for what you're doing. You don't need to use dependent items for the example that Hamardaban and splitek highlighted, it's just that in your particular case, using dependent items might make sense.

But the techniques described in your post seems to be two different approaches. Dependent Items vs. a combination trigger expression... I would still need to figure out how to reference the values in the operations message.

You're correct that using a dependent item is unrelated to having a single trigger reference multiple items.

The main point you should focus on is the trigger expression. An as far as figuring out how to reference the values, re-read the forum thread I linked to and especially the example #5 that splitek mentioned. It covers what you need to do.

[jmrice]

Example 5 checks the same value on two different hosts. The expression makes sense. In my case, the host is the same, and the values are different.
I am trying the expression:
{zabbix.mydomain.com:system.run[/usr/local/bin/checkssl.sh mydomain.com 443].last()}<=30 and
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()}

Not sure what is going to happen with this, since I am not testing for a result, but I am hoping that it will return the "issuer".

Here is my previous message (which wasn't working):

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY}.last()} days !!
Issuer: {{HOST.HOST}:system.run[/usr/local/bin/checkissuer.sh {EVENT.TAGS.domain} 443].last()}

Would I change it to something like this?

SSL Certificate expires in {{HOST.HOST}:{ITEM.KEY1}.last()} days !!
Issuer: {{HOST.HOST}:{ITEM.KEY2}.last()}

[tim.mooney]

{zabbix.mydomain.com:system.run[/usr/local/bin/checkssl.sh mydomain.com 443].last()}<=30 and
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()}

Not sure what is going to happen with this, since I am not testing for a result, but I am hoping that it will return the "issuer".

My guess is that won't work. Definitely try it, but if it doesn't work, does using something like this work:

{zabbix.mydomain.com:system.run[/usr/local/bin/checkssl.sh mydomain.com 443].last()}<=30
and
  (
        {zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} <> ""
  or
       {zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} = ""
 )

?

So what's that doing? The stuff after the "and" should always result in a Boolean true value, either because the issuer isn't a blank string or because the issuer is a blank string. The only reason the checkissuer item is included (twice, in the expression I have) is so that you can reference its value in the message. You want the "issuer" part of the logic to always be true, so that the whole expression becomes true when the first part (the <= 30 ) is true. If you're 100% certain your checkissuer.sh will never fail and return an empty string, then you don't need the 2nd part of the expression inside the parens, but I would probably keep it just to make certain there's never a problem because checkissuer couldn't find the issuer.

As far as the message, your message may work ( my guess is it will ), but it might be more obvious to other people looking at it (or you looking at it in 6 months or a year) if you use {ITEM.VALUE1} and {ITEM.VALUE2}, rather than {ITEM.KEY1}.last() and {ITEM.KEY2}.last() -- though there are cases where that syntax is better, I don't know if it's needed here.

My first try would probably be something like:

SSL Certificate from {ITEM.VALUE2} on {HOST.HOST} expires in {ITEM.VALUE1} days !

[jmrice]

Excellent! This is scarily beginning to make sense. Thank you!

[jmrice]

Hate to be a pest, but when I placed this inside the trigger expression:

{zabbix.mydomain.com:system.run[/usr/local/bin/checkssl.sh mydomain.com 443].last()}<=30 and
(
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} <> "" or
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} = ""
)

I got:

Details Cannot update trigger

Incorrect trigger expression.
Check expression part starting from " "" or {zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} = ""
)".

My guess is something to do with a string comparison, although it did say that with operators <> and =

String operand is still cast to numeric if:

• another operand is numeric
• operator other than = or <> is used on an operand

(If the cast fails - numeric operand is cast to a string operand and both operands get compared as strings.)

Someone recommended using the itemKey.strlen()}>0 function.
I'm hoping I just have a typo.

[tim.mooney]

{zabbix.mydomain.com:system.run[/usr/local/bin/checkssl.sh mydomain.com 443].last()}<=30 and
(
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} <> "" or
{zabbix.mydomain.com:system.run[/usr/local/bin/checkissuer.sh mydomain.com 443].last()} = ""
)

Try build an equivalent expression using the GUIs expression constructor. I can't actually test the expression I typed in, so I clearly have an error somewhere.

[jmrice]

It appears that the expression constructor is not allowing a string "" in the Result field with either <> or = operator. It is expecting numeric. There must be a way to check for null string in an expression.