How to trigger on more then 2 lines of text

[Ivo Palli]

I've got a Zabbix trapper item where I send a few lines of text to every now and then.

I want a trigger on it, that if the message I send has more then 2 lines of text in it, it should trigger.

So far I've got

count(/my_server/my_key,#1,"regexp","\n")>2

but that doesn't seem to work.

Anybody have an idea?

[ISiroshtan]

Hi there.

Main error you do: using count function.

Count function will not return you number of matches in single item value! It returns number of item values in said timeframe(or specified number of values) that match said criteria. So in your case you evaluate only last value (hence #1), so you can get only 0 if regexp does not match or 1 if regexp did match. There is no way it will return 2 or higher for you.

You approach should be using regexp that would detect 3 lines or more. You can use something like the following:

{server:item[key].iregexp("^.*(\n.*){2}")}=1

I did not thoroughly tested this regexp, but I expect it to work.

UPDATE

Missed the point that you use not 5.0 but newer version with changed trigger function syntax. I guess you can or event should use count but under different logic:

count(/my_server/my_key,#1,"regexp","^.*(\n.*){2}")=1

[cyber]

ISiroshtan you are using older trigger expression format... Topic starter uses newer. Lets not mix them..
There is no regexp or iregexp functions any more in 5.4.

The use of count is justified in here.. He is trying to count \n-s in last value... Maybe it shoud be ">1" as you don't necessarily have \n in the end of 3rd line, but you have it in the end of 1st and 2nd.. So finding 2 should trigger.

other option might be using find with specific regexp.
find (/my_server/my_key,,regexp ,"^.*(\n.*){2}")=1 (also not tested, as I have no 5.4 at hand..:P )

[ISiroshtan]

Yeah, realized it bit too late. Kindly asking for forgiveness!

Don't have Zabbix with new syntax under my care yet, so my brain ALWAYS uses old syntax when dealing with any Zabbix related problems

Also, even with new syntax Count function still defined as:

Number of values within the defined evaluation period.

So how is it gonna return 2 or more if we evaluate only 1 value? Even if it has two or more \n in single value, it will still return 1 at best, no?

[cyber]

yea... too many things at once screws up ... should use proper regex (as you suggested), then you can use count there... it will return 1 if match is found and 0 if not... Similar to find...

[Ivo Palli]

count(/my_server/my_key,#1,"regexp","^.*(\n.*){2}")=1

Hi ISiroshtan,

Thanks for your solution. I can confirm that this works!

In truth, I was a little confused by the first solution. I didn't realize that trigger syntax had changed recently (I'm new to Zabbix) but now it works.