Having trouble with regex and parsing logfiles

[Dr. Strangelove]

Hey all:

I am having trouble using regex successfully with log files and I am looking for some help.I have tried checking my regex at regex101, but even when I get working formulas in regex101 they don't seem to work in zabbix. If I leave all of the options at defaults in the 'items' configuration the log files show up in the 'latest data' window, so I know that the zabbix agent is collecting the log files off of my remote server successfully. The problem I have is with the regex. I read that the zabbix agent wants only Posix regex, so I used the posix regex test from Dan's Tools and it sort of worked. Enough of the back story, here is the log I am searching:

snapshot 6b3be518 saved
duration: 0:00

[0:00] 100.00% 1.417 GiB / 1.417 GiB 12 / 12 items 0 errors ETA 0:00
scanned 1 directories, 11 files in 0:00
[0:00] 1 directories, 11 files, 1.417 GiB
scan [/sql_backup]
Tor2 MariaDB Backup Report for 2020-09-06_13:59:43 using parent snapshot 6df3d22e

I want to capture the report title:Tor2 MariaDB Backup Report so I used this regex: \bTor2 [\.[:space:]]MariaDB[\.[:space:]]Backup[\.[:space:]]Report.*\b This string works in zabbix but it only captures: Tor2 MariaDB Backup Report for 2020-09-06_13:59:43 using parent snapshot 6df3d22e
But I need to see if the backup was successful so I used this regex: ((.*\n){7}) to capture the whole log report. When I concatenate the two strings like so: (((.*\n){7})\bTor2 [\.[:space:]]MariaDB[\.[:space:]]Backup[\.[:space:]]Report.*\b) The posix tester returns the entire log and zabbix accepts it as an argument but it produces NO results. I am at a loss what to do next and any help is gratefully appreciated.

Rick

[Hamardaban]

zabbix processes logs for compliance with the regex line by line! this is why your methods of combining strings don't work.

[Dr. Strangelove]

Ok. Can I get around this limitation somehow? Otherwise, it kind of makes Zabbix ineffective for log analysis.

[dimir]

If you have the control over the thingie that writes those logs the simplest is to change it to write what you want in single line. Otherwise, I guess you would need to create your own parser of the logs that would do that and write to a separate file for Zabbix to read.

[Hamardaban]

Of course you can - by rewriting the log processing module. :- ) joke!
If you can, influence the source of logs to write them in a single line or in a different format.
Or try processing lines of code with utilities that convert text to the form you need and calling them via UserParameter.
Or use tools specifically designed for this purpose, rather than a universal monitoring tool, for advanced log processing.

[Dr. Strangelove]

Thanks for the thoughts. I am looking at this post which has given me some new possibilities.

[dimir]

You can also see if this one helps: https://support.zabbix.com/browse/ZBXNEXT-968
And don't forget to give it a vote. :-)