log: my regexp is good, but the item doesn't understand

[src386]

Hi everyone,

I want to catch those strings : Server configuration error and NOQUEUE on a log file.

Here is my item (set as Active Check) :

log[/var/log/mail.log,"(?=.*Server configuration error)(?=.*NOQUEUE).*",,,,]

According to regexp testers (such as regex101.com or regexr.com) this should work.

However, the item doesn't catches anything (nothing in Latest data). Example :

echo "Server configuration error NOQUEUE" >> /var/log/mail.log

The item is not in red, so it's probably not a syntax problem.

I admit this is getting me crazy...

[andris]

Regexp "(?=.*Server configuration error)(?=.*NOQUEUE).*" does not compile in Zabbix agent.
There is a bug https://support.zabbix.com/browse/ZBX-7602 that Zabbix does not report regexp compilation error (fixed in the next, 3.2 version).
"Zabbix daemons use POSIX EXTENDED, frontend - PCRE".
Try simpler regexp.

[src386]

Regexp "(?=.*Server configuration error)(?=.*NOQUEUE).*" does not compile in Zabbix agent.
There is a bug https://support.zabbix.com/browse/ZBX-7602 that Zabbix does not report regexp compilation error (fixed in the next, 3.2 version).
"Zabbix daemons use POSIX EXTENDED, frontend - PCRE".
Try simpler regexp.

Thanks.

I found a workarround.

My item :

log[/var/log/mail.log,Server configuration error,,,,]

My trigger :

{Template_Postfix:log[/var/log/mail.log,Server configuration error,,,,].regexp("NOQUEUE")}=1 and {Template_Postfix:log[/var/log/mail.log,Server configuration error,,,,].nodata(30)}=0

So basically I'm stacking two regexp, one in the item (preventing to grep the all log), another in the trigger. The nodata() is used for an auto OK state.