Issues with regex in vfs.file.regmatch item key
Greetings Everyone,
I have inherited a zabbix server with this template that is just a discovery rule with it's related prototypes,
the rule checks the vzdump log files and if vfs.file.regmatch returns 1 with this regex "Backup of VM [0-9]+ failed", zabbix sends a notification and it's all fine and dandy.
I would like to edit this template to add another item prototype that besides checking if the backups failed or not, also check if the vzdump backups are full proxmox virtual enviroment (pve) backups or incremental proxmox backup server (pbs) backups, the log file is the same, the only difference is that if the backups get stored on the pbs there is a line like this:
2024-12-09 08:57:27 INFO: creating Proxmox Backup Server archive 'vm/144/2024-12-09T07:57:25Z' which isnt there if the backups are made in the other manner.
So I just figured that I can clone the already existing item prototype just edit the regex expression and that would do the trick,
however I seem to have hit a wall because no matter what regex expression I put in the returned item is always 0 even when it should be 1.
Here is the yaml of the original template:
Here is a screenshot of the Item i cloned (I just cloned it on a single host instead of the template for testing purposes)
here is an example of the text the agent item key is working on:
And this is me testing the value with zabbix_get on the same file:
I have to admit that I am not too familiar with regex, however I tested different expressions and they all work both on regex101.com and the Zabbix built-in tester that is under:
Administration > General > Regular Expressions
Here is a screenshot of it:
Here is some other expression i tried:
The item is cloned, and besides the name the only thing I changed is the regex, that seems to work everywhere besides where I need it to work...
Any Ideas?
Also I have a few other doubts, how come I have to escape the quotes of the regex in the zabbix_get command but not the quotes of the path?
Also the template uses the macros {#VM_ID} and {#LOG_PATH}, but they are not defined anywhere in the template, are they inherited from somewhere else?
Is there a way to know where are they defined?
I have inherited a zabbix server with this template that is just a discovery rule with it's related prototypes,
the rule checks the vzdump log files and if vfs.file.regmatch returns 1 with this regex "Backup of VM [0-9]+ failed", zabbix sends a notification and it's all fine and dandy.
I would like to edit this template to add another item prototype that besides checking if the backups failed or not, also check if the vzdump backups are full proxmox virtual enviroment (pve) backups or incremental proxmox backup server (pbs) backups, the log file is the same, the only difference is that if the backups get stored on the pbs there is a line like this:
2024-12-09 08:57:27 INFO: creating Proxmox Backup Server archive 'vm/144/2024-12-09T07:57:25Z' which isnt there if the backups are made in the other manner.
So I just figured that I can clone the already existing item prototype just edit the regex expression and that would do the trick,
however I seem to have hit a wall because no matter what regex expression I put in the returned item is always 0 even when it should be 1.
Here is the yaml of the original template:
Code:
zabbix_export:
version: '7.0'
template_groups:
- uuid: a571c0d144b14fd4a87a9d9b2aa9fcd6
name: Templates/Applications
templates:
- uuid: e97395ccbac94084a36949aa2752cbf2
template: 'Template App VZDUMP'
name: 'Template App VZDUMP'
groups:
- name: Templates/Applications
discovery_rules:
- uuid: 0a153962c67a4b7ca9624dc64ec93ff1
name: 'VZDUMP logs'
key: 'vfs.dir.get["/var/log/vzdump/"]'
delay: 30m
lifetime: 30d
enabled_lifetime_type: DISABLE_NEVER
item_prototypes:
- uuid: 46f35886d2c94626b3e6ab2945955d56
name: 'VZDUMP Status of {#VM_ID}'
key: 'vfs.file.regmatch["{#LOG_PATH}","Backup of VM [0-9]+ failed"]'
delay: 30m
history: 90d
trigger_prototypes:
- uuid: 7095d74b30a94b179daf9e4071134e68
expression: 'last(/Template App VZDUMP/vfs.file.regmatch["{#LOG_PATH}","Backup of VM [0-9]+ failed"])=1'
name: 'Failed to perform backup on {#VM_ID}'
priority: DISASTER
tags:
- tag: scope
value: backup
here is an example of the text the agent item key is working on:
Code:
/var/log/vzdump/qemu-144.log 2024-12-09 08:57:25 INFO: Starting Backup of VM 144 (qemu) 2024-12-09 08:57:25 INFO: status = stopped 2024-12-09 08:57:25 INFO: backup mode: stop 2024-12-09 08:57:25 INFO: ionice priority: 7 2024-12-09 08:57:25 INFO: VM Name: test-ipxe 2024-12-09 08:57:25 INFO: include disk 'scsi0' 'raid10-hdd:vm-144-disk-3' 32G 2024-12-09 08:57:25 INFO: include disk 'efidisk0' 'raid10-hdd:vm-144-disk-2' 4M 2024-12-09 08:57:25 INFO: include disk 'tpmstate0' 'raid10-hdd:vm-144-disk-1' 4M 2024-12-09 08:57:27 INFO: creating Proxmox Backup Server archive 'vm/144/2024-12-09T07:57:25Z' 2024-12-09 08:57:27 INFO: starting kvm to execute backup task 2024-12-09 08:57:29 INFO: attaching TPM drive to QEMU for backup 2024-12-09 08:57:30 INFO: started backup task '65c48575-a759-474d-b7f8-7400e6093f9b' 2024-12-09 08:57:30 INFO: efidisk0: dirty-bitmap status: created new 2024-12-09 08:57:30 INFO: scsi0: dirty-bitmap status: created new 2024-12-09 08:57:30 INFO: tpmstate0-backup: dirty-bitmap status: created new 2024-12-09 08:57:32 ERROR: interrupted by signal 2024-12-09 08:57:32 INFO: aborting backup job 2024-12-09 08:57:32 INFO: stopping kvm after backup task 2024-12-09 08:57:32 ERROR: Backup of VM 144 failed - interrupted by signal
And this is me testing the value with zabbix_get on the same file:
Code:
root@zabbix:~# zabbix_get -s 172.16.3.30 -p 10050 -k "vfs.file.regmatch["/var/log/vzdump/qemu-144.log",\"Proxmox Backup Server(?s:.)*Backup of VM [0-9]+ failed\"]" 0 root@zabbix:~# zabbix_get -s 172.16.3.30 -p 10050 -k "vfs.file.regmatch["/var/log/vzdump/qemu-144.log",\"Backup of VM [0-9]+ failed\"]" 1
Administration > General > Regular Expressions
Here is a screenshot of it:
Here is some other expression i tried:
Code:
"Proxmox Backup Server(?s)(.*)Backup of VM [0-9]+ failed" "(?s)(.*Proxmox Backup Server.*)(Backup of VM [0-9]+ failed)"
Any Ideas?
Also I have a few other doubts, how come I have to escape the quotes of the regex in the zabbix_get command but not the quotes of the path?
Also the template uses the macros {#VM_ID} and {#LOG_PATH}, but they are not defined anywhere in the template, are they inherited from somewhere else?
Is there a way to know where are they defined?