Help Preprocessing: value substitution with regular expression

[Gege]

I need to monitor the uptime of some objects (serial interfaces, PVCs) of a telecommunications equipment (multimedia router). There is a private snmp object that returns different strings for the status of these interfaces: when the interface is up, it returns DATA, and when it returns any other string (DOWN, IDLE, OFF, TEST, CALL) the interface is not transmitting and can be considered down.

I would like to set up an item that would graph the up (value 1) or down (value 0) state of the interface, in the same way as the ping simple check. I expected that this could be done by value mapping, but it does not seem to be available for text index.

So, I am trying to use the new preprocessing feature of new 3.4.1 zabbix version, with regular expression. I can get the DATA to 1 conversion using Regular expression pattern DATA and output 1,then Hexa to Numeric conversion, but I do not understand how to get the 0 value when the regular expression result is false.

I am new to regular expressions. I have tried to use regular expression numbered grouping (Pattern: (DATA)|(OFF|CALL|IDLE|TEST) ), but I do not understand how I could substitute 1 to \1 and 0 to \2 and get the result in the output for the group whose result is true. I thought that regular expression could easily make this type of substitutions. Would someone have an example of the way this can be done in Zabbix?

[Gege]

solution to the problem:

Not being a PCRE geek, I spent some time googling and did not find a way to do it in a single expression, but succeeded in 2 expressions:

First step
Pattern: (?(?=DATA)(DATA)|(IDLE|OFF|CALL|PAUSE))
-> value : \11xxx0
Second step
Pattern : \b.{4}(.)
-> value : \1

Explanation:
Since we need to retrieve the target value in the original string, we need to add the target value in the string using a first (preliminary) string before we make the extraction. The first step adds 1xxx0 to the result of group1, which is DATA or nothing, so that resulting value is DATA1xxx0 or 1xxx0. The 5th character of this result is the target value that we are expecting. The second step extracts the 5th character which is our target value.

A third step is used to convert the 0 or 1 target value from Hexadecimal to Numeric, and our item can now be displayed as an uptime graph.

For more complex cases, there is an excellent tutorial at http://www.rexegg.com/regex-trick-co...placement.html that can be used, provided translated strings are added to the original string through a similar first preliminary step.

If someone has an idea to have it in a single step, that would also be interesting.

[Gege]

trick for string substitution in Regex

Not being a PCRE geek, I spent some time googling and did not find a way to do it in a single expression, but succeeded in 2 expressions:

First step:
Pattern: (?(?=DATA)(DATA)|(IDLE|OFF|CALL|PAUSE))
-> value : \11xxx0

Second step:
Pattern : \b.{4}(.)
-> value : \1

Explanation:
Since we need to retrieve the target value in the original string, we need to add the target value in the string using a first (preliminary) string before we make the extraction. The first step adds 1xxx0 to the result of group1, which is DATA or nothing, resulting in DATA1xxx0 or 1xxx0. The 5th character is the result that we are expecting. The second step extracts the 5th character which is our target value.

A third step is used to convert the 0 or 1 target value from Hexadecimal to Numeric, and our item can now be displayed as an uptime graph.

For more complex cases, there is an excellent tutorial at http://www.rexegg.com/regex-trick-co...placement.html that should be applicable, provided translated strings are unconditionnally added to the original string through a similar first preliminary step

If someone has a more straightforward solution, that would be interesting.

[finalbeta]

Hey, thanks for posting this method. I've implemented it for something similar I received though snmp. I searched and failed to work it out before.

I really think they should add a match or replace option to the pre-processing. For now, this is a nice hack though!

Thanks again.

[Josema]

Hi Gege
I've tried to apply your trick but something is not going right. In my situation I have four states

in-service/idle
in-service/active
out-of-sevice/NE
OOS/FE

I want to check if the channel is idle -> get 1, otherwise get 0

first regex :
pattern: (?(?=in-service\/idle)(in-service\/idle)|(in-service\/active|out-of-service/NE|OOS/FE))
value: \11xxxxxxxxxxxxxx0

thus I get a string according the state.
in-service/idle1xxxxxxxxxxxxxx0
1xxxxxxxxxxxxxx0

this works fine.

I want to see char 16th

Pattern : \b.{15}(.)
-> value : \1

but I get a "Not Supported" with the description "Item preprocessing step #2 failed: cannot perform regular expression match on value "in-service/idle1xxxxxxxxxxxxxx0" of type "string": pattern does not match".

Any idea what I'm doing wrong

thanks

[Gege]

Hi Josema,

As I said, I am far from being an expert in regular expresions, so I used the simulator on https://regex101.com to test your expressions. Apparently the problem is at the first step. There are at least 2 backslashes missing before the 2 last slashes Even when putting them, the expression is still not good: the match is fragmented in 3 separate strings 'in_service', '/' and 'idle' (see attached). There is certainly a possibility to restore the initial 'in-service/idle' string for the match, but I do not know it.

Kind regards

[Gege]

Hi Josema,

I returned on the site for testing again your solution and found that your expression (with the \ corrections worked fine. The answer I got yesterday was probably due to a mistake from me.

So, your solution should be:

regex1 : (?(?=in-service\/idle)(in-service\/idle)|(in-service\/active|out-of-service\/NE|OOS\/FE))
Substitution1: \11xxxxxxxxxxxxxx0
Regex2 : \b.{15}(.)
Substitution2: \1
Regex3 : \b(.).*
Substitution3: \1

note: the regex3 is necessary if you want to have only 0 or 1 as possible results without the "xxxxxxxxxxxxxx0" trail.

I hope this solves this issue.

kind regards

[Josema]

Gege
it's strange, it fails in second regex. Although in regex simulator it works fine, when I configure it in Zabbix it doesn´t work.
First regex works fine, I've it checked with the "Last data received"
Best regards

[Gege]

Hi Josema,

This is very weird, as it works fine in my system. I am running Zabbix 3.4 on Ubuntu 16.04. Perhaps there is a bug in your version of Zabbix. Did you define your item type of information as numeric(unsigned)? This might be necessary.

Below please find the displays of item/preprocessing configuration and of latest data:






just to show it's working.

Kind regards,


Gege