str and regexp function - 'complex' parameters

[LEM]

Hi all,

I'm fighting with str and regexp function to use them with 'complex' parameters. By complex, I mean 'composed by more than one word' (a-z, A-Z, 0-9)...

In fact, following the Monitoring Log files tutorial (zabbix website), monitoring of log files works like a charm: any new entri is 'captured and sendback' to zabbix_server. Cool.

Using a simple trigger, based ont str() or regexp() functions (RTFM), event triggering base on a simple world, say 'error', like in the following trigger expression, works like a charm too:

{host:log[/my/logfile].str(error)}>0

Using regexp with the same parameter ('error'), like in the following trigger expression give the same good result:

{host:log[/my/logfile].regexp(error)}>0

Well, fine, may works for lots of jobs, but... I now need to check for more complex expression on my logfiles: not only one world, but a complete string, like, for example "my name is Bond". Using the php frontend, I cannot use str() nor regexp() with this string: frontend complaining:

 Expression [{host:log[/my/logfile].regexp(my name is Bond)}] does not match to [server:key.func(param)]

So I decided to:

• let's rock with a single world (regexp(my)),
• SQL update 'by hand' the parameter value (update functions set parameter="my name is Bond" where functionid="XXXX")

Just to see if it could works... and... it just seems to work: trigger expression is updated (you can check in the trigger list for the host), and is correctly evaluated by zabbix_server as the trigger is going ON/OFF if some James is announcing itself in the logfile...

So, I suspect a bug in the php frontend with str() and regexp() manipulation in the trigger edition form. I tried to have a look, but I'm not a php-litterate boy, so... Can somebody more experimented than I can check for this bug?

[LEM]

(...)I suspect a bug in the php frontend with str() and regexp() manipulation in the trigger edition form. I tried to have a look, but I'm not a php-litterate boy, so... Can somebody more experimented than I can check for this bug?

Well, thx to cameronsto patch, I found a way be hable to use the web GUI: the 'bug' is in includes/config.inc.php, on the eregi used by function validate_simple_expression($expression). I modified the cameronsto proposal by this one, to make the php GUI deal with spaces in the parameters fields:

if (eregi('^\{([0-9a-zA-Z\_\.-]+)\:([]\[0-9a-zA-Z\_\*\/\.\,\:\(\) -]+)\.([a-z]{3,11})\(([#0-9a-zA-Z\_\/\.\,[:space:]]+)\)\}$', $expression, $arr))

Even if it's help me using the php GUI, I'm not sure this is the good way to resolve this 'bug' (limitation in fact). Somebody has got a better proposal?

[sspyrison]

regexp function

I'm currently testing 1.4.1 on Solaris 10. It appears to handle spaces in the string value, and properly inserts them into the database.

What I have not been able to get working yet is searching for strings that include things like parenthesis. For example:

logger "TESTING CPU"

properly generates an event with the trigger:

zabbix:log[/var/adm/messages].regexp(TESTING CPU)>0

That being said, with the trigger like this:

zabbix:log[/var/adm/messages].regexp(TESTING (CPU))>0

and testing it like this:

logger "TESTING (CPU)"

it does not generate an event. I suspect it might work if escaped in the manner that zabbix is expecting it to be escaped, but I'm still looking at that. I've tried a backslash and enclosing the whole string in quotes, but no luck so far.

[sspyrison]

I'm currently testing 1.4.1 on Solaris 10. It appears to handle spaces in the string value, and properly inserts them into the database.

What I have not been able to get working yet is searching for strings that include things like parenthesis

To update myself, I got this working with a regexp trigger like this:

zabbix:log[/var/adm/messages].regexp(TESTING [(]CPU[)])>0

No quotes, no escapes. With a tool like grep using basic regular expressions, the pattern would work either way... as "TESTING (CPU)" or "TESTING [(]CPU[)]"

Anyway, hope this helps anyone else out there trying to get zabbix to monitor logs in real-time. On a side note, real-time log monitoring does seem to be working well in 1.4.1, but may not quite be up to the load of a central syslog server. For example, if I fired off 10 syslog messages at 1 second intervals, each with slightly different text that matched the above pattern, only 2 or 3 were picked up. I have my log[] item configured at 1 second intervals per the documentation recommendation, so perhaps I'll tweak that and see if behavior changes.

Point being: a central syslog server might be processing 100's of messages (or more) per second. If zabbix were to monitor the log file for patterns, which would be very useful of course, then it would need to scan them all and not drop any.

[bashman]

You can try this:

UserParameter=<your_key>,grep "error" /your/path/to/your/log > /dev/null 2>&1; echo $?

Note that when the trigger fires you have to rotate your log manually.

I hope this can help.

[MD. ABBAS ALI]

Zabbix Trigger Function regexp() not working

I'm currently testing 1.4.1 on Solaris 10. It appears to handle spaces in the string value, and properly inserts them into the database.

What I have not been able to get working yet is searching for strings that include things like parenthesis. For example:

logger "TESTING CPU"

properly generates an event with the trigger:

zabbix:log[/var/adm/messages].regexp(TESTING CPU)>0

.

===================
I have a logrt() ITEM as "logrt["{$LOG_PATH}/PLM_Integartion_Status.xml","PDMS data to COMOS",,100]" which is collecting data properly.

ITEM Collected Data:
================
<Cell Name="PDMS data to COMOS">EquipmentID not found from XML
<Cell Name="PDMS data to COMOS">No reply from PDMS
<Cell Name="PDMS data to COMOS">OK -XML Generated
================

I have configured 3 Triggers on that logrt() ITEM.

1. {HOST:ITEM[].regexp(not found from XML)}>0
2. {HOST:ITEM[].str("PDMS")}>0
3. {HOST:ITEM[].str("XML")}>0
Trigger no 2 & 3 are working fine.

Trigger no 1 is not generating any Alert. when I modified the trigger 1 as
1. {HOST:ITEM[].regexp(Generated)}>0
Then its working. But I need to generate Alert for "regexp(EquipmentID not found from XML)"
How can I do this any help ?

I'm using Zabbix-server version=3.4.3 & Agent version=3.4.3
===================