TCP port monitoring template not working

[mcflurry]

The template documentation says that macros {$TCP.PORT.MATCHES} and {$TCP.PORT.NOT_MATCHES} (regular expressions) can be used for filtering. So, for example, to match only port 22, you could use ^22$ in {$TCP.PORT.MATCHES}. Or, ^(22|443|3306)$ matches 22, 443 or 3306.

^ matches start of string, $ matches end of string. Parenthesis and pipe (|) can be used as "or" grouping.

If you enter just 22, it will match any string that contains 22, like 10220. Or, plain (22|443) will match 12200 and 30443.

Markku

I've been playing with macro {$TCP.PORT.MATCHES} and it always discover every listening port.

Tried this:
^(22|3306|5555)$
22
22, 3306
22 3306

[Markku]

I've been playing with macro {$TCP.PORT.MATCHES} and it always discover every listening port.

Again back to LLD basics (not specific to this template, and you didn't mention explicitly what you did/checked, so I'll ask):
- Did you wait for the discovery to happen (or trigger the discovery manually)?
- Did you delete the old (filtered) items manually? Based on your first screenshot the discovery keeps lost resources for 30 days. In the item list there will be exclamation marks for items that are not discovered anymore.

Markku

[mcflurry]

Again back to LLD basics (not specific to this template, and you didn't mention explicitly what you did/checked, so I'll ask):
- Did you wait for the discovery to happen (or trigger the discovery manually)?
- Did you delete the old (filtered) items manually? Based on your first screenshot the discovery keeps lost resources for 30 days. In the item list there will be exclamation marks for items that are not discovered anymore.

Markku

"Unlink and clear" template from host, added again, wait for discover (with default setting 24h).

It has discovered everything again, this shot is with macro {$TCP.PORT.MATCHES} at host level with value ^(22|3306|5555)$

[Markku]

Ok, oh well. As you saw from the beginning, the template is not very high quality (the contradicting information about using system.run/ss.tcp.listening/netstat/ss/whatever). So there is a problem in Filter: "Type of calculation" was set to "And/Or" which was in this case evaluated as "Or". Set it to "And", and the filtering starts working properly.



Markku

[mcflurry]

Ok, oh well. As you saw from the beginning, the template is not very high quality (the contradicting information about using system.run/ss.tcp.listening/netstat/ss/whatever). So there is a problem in Filter: "Type of calculation" was set to "And/Or" which was in this case evaluated as "Or". Set it to "And", and the filtering starts working properly.



Markku

You made my day.

[Shivarangu]

Try to import new same template and check