regexp in log[]

[dafus]

Hi,

Is there any lenght limit for regexp in log[]? I have some pattern like this
"POST /sso/login?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1” and it doesn't work. No match. If i use only POST as pattern i have too many matches. Any ides? Thank you for answers.

P.S.
Sorry for my English.

[dafus]

Anyone? Any ideas?

[Firm]

What regexp does not work?

[dafus]

I used "POST /sso/login?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1" as regexp.

[Firm]

Some characters, like ?, have special meanings in regexp. Specify what string/pattern you are trying to catch?

[dafus]

I have something like this in my log file:

xx.xxx.xx.xx - - [02/Jul/2015:15:22:49 +0200] "POST /sso/login?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1" 302 - 0/181459

I would like extract (for example) 0/181459 value, so I use "POST /sso/login?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1" as my regexp.

[Firm]

Try this (extracts last field in your example):

log[/var/log/nginx/access.log," ([0-9]+/[0-9]+)$",,,,\1]

[dafus]

Thank you Firm.

It could work, but i have in my log lines like 10.168.5.13 - - [30/Sep/2015:03:52:14 +0200] "GET /service/v1/users/[email protected] HTTP/1.1" 200 3333 0/17324 and many more. This is the reason why i have to use regexp.

[Firm]

Expression above matched all lines that ends with

<exactly one any digit>/<any digits - one or more>

P.S. If you are trying to keep your server logs in one place you may take a look on ELK stack.

[dafus]

Each line in my Apache log has 1 digit/6 digits at the end of line. This is request duration time in seconds/microseconds format. But i want monitor only lines wchich contain "POST /sso/login?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1" because those lines are logging to web lines. I would like to have alert from Zabbix when logging time exceeds 2 seconds. Is it possible?

[Firm]

Exactly this string? Or strings that have POST? Or strings that have "j_sp ring_cas_security_check"? Can you specify criteria?

[dafus]

Exactly this string This is my problem that string is so long

I made it in bash, and i use User_Parametr.

[Firm]

Does this work?

log[access.log,"POST /sso/login\?service=https%3A%2F%2Fwww.somewww.com%2Fj_sp ring_cas_security_check HTTP/1.1"]

[djp210]

It appears the Item cannot be any longer than 256 characters, including the regex itself.

log[/path/to/log,"(your regex here")]

All that must be 256 characters or less. At least that's the case in Zabbix 3.0.