Cannot filter / exclude on network interface name IFNAME using a regexp

[hh_ph]

My goal is to be able to filter so that I only see alerts on the important network ports on all my Cisco switches, eg trunk ports, or WAP ports.
Each switch could have different ports that I want.

My test is using my desk ports 41 and 42. Trying to block one and show the other.
I have tried multiple ways to filter on the network port name in the Template Net Cisco IOS SNMPv2 | Template Module Interfaces SNMPv2, and it just doesn’t seem to work. I have reviewed the forums, and this idea of filtering on ports comes up a lot, but the only answer that is confirmed to work is to manually disable each of the unwanted alerts. I don’t like it as an answer, but I also don’t want to keep chasing red herrings.



I have tried filtering using the MACRO on the Template Module Interfaces SNMPv2, and I’ve also tried it using “Filter” on the Discovery Rule in the Template Module Interfaces SNMPv2. I’ve tried variants on the regexp, all of which I’ve confirmed match the name of the port Gi1/0/42 and/or iso.3.6.1.2.1.31.1.1.1.1.10142 and/or GigabitEthernet 1/0/42 (just in case that’s the name of what is coming through)

Regexps I've tried:
(^.*42).*$
(^.*1\/0\/42).*$
to match on port Gi1/0/42

This is the only forum post that indicates that it should work
Can you help me out with a simple regular expression / macro?
But replicating that doesn't help me.
An snmpwalk gave me these results for the ports in question:
iso.3.6.1.2.1.31.1.1.1.1.10141 = STRING: "Gi1/0/41"
iso.3.6.1.2.1.31.1.1.1.1.10142 = STRING: "Gi1/0/42"


Example forum posts leading nowhere
Can’t exclude interface (fw) from Network interface discovery
Exclude interface from “network Interfaces Discovery” trigger prototype
Exclude Admin Shut Down Interface Trigger
howto exclude Interface: Link down notifications <- this is the only one with an answer, and it’s the manual exclusion

Example of test



Every time I have run a test I have performed "unlink and clear" before testing again. I do that on the host before testing.

Is there any other cache clearing required, to be sure that it's not retaining any information?

Using version 5

Can anyone who has successfully got this to work, please share screenshots?

[Kate357]

Then in the Administration, General, Regular Expression you create one called Someexpression (use a better name) and in there list the ones you do not want as ... Once you are sure you are getting what you want, and excluding what you do not, ... C {#IFNAME} matches @Networktellpopeyes for discovery.

[hh_ph]

Wow.. finding "Regular Expressions" was non-intuitive. That drop-down in the menu... where no other panel has one...

[hh_ph]

And what I discovered, is that I was working in Templates, when I am having more success applying a MACRO to the individual host. This may suit me better as each of our switches have different ports requiring monitoring.
And then once it's setup, go to Monitoring, Latest Data and the host to see what is being pulled. If the wrong information is there, then go to Configuration, Host, Discovery Rule and then check all Discovery Rules and "Execute Now" (or it's sometimes "Check Now")



And the Discovery/Filtering can take a while. That's the main thing that was missing from all the other posts. I'll update when I have a better idea of how long to wait.

[lmf-mx]

I've not seen changes to the global expressions list produce any results, either. I found the same default value in the template as in the OP screenshot. I had to edit the value there. to propagate to other linked templates that link back to effectively make it global.

Is there some way to get that template to use the Regular Expressions global settings as hh_ph points to at https://www.zabbix.com/forum/zabbix-...30#post413830?