regexp with parenthesis

[wuhaohust]

I am running zabbix 7.0.5 on SUSE15, I want to create a trigger for snmptrap which contains "Network Time Protocol(NTP) is not configured" , trap received by zabbix is like below:
2025-01-12T21:20:42+0800 PDU INFO:
notificationtype TRAP
securityEngineID 0x80001370017f0000016ebd0bed
securityName xxxxxx
transactionid 1668
errorindex 0
receivedfrom UDP: [xxxxxx]:161->[xxxxx]:162
messageid 107453
securitylevel 3
errorstatus 0
contextEngineID 0x80001370017f0000016ebd0bed
contextName
requestid 1450683266
version 3
securitymodel 3
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (1894589500) 219 days, 6:44:55.00
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.11.2.36.1.0.5
SNMPv2-SMI::enterprises.11.2.36.1.1.5.1.1.1.1 type=2 value=INTEGER: 1
SNMPv2-SMI::enterprises.11.2.36.1.1.5.1.1.4.1 type=6 value=OID: SNMPv2-SMI::enterprises.11.10.3.1.3.27
SNMPv2-SMI::enterprises.11.2.36.1.1.5.1.1.2.1 type=4 value=STRING: "HPE StoreOnce 3660 SGH418F5P8"
SNMPv2-SMI::enterprises.11.2.36.1.1.5.1.1.5.1 type=4 value=STRING: "https://172.25.1.32"
SNMPv2-SMI::enterprises.11.2.36.1.1.5.1.1.6.1 type=4 value=STRING: "HPE StoreOnce 3660 SGH418F5P8"
SNMPv2-SMI::enterprises.11.2.36.1.0.10 type=4 value=STRING: "E033C000013"
SNMPv2-SMI::enterprises.11.2.36.1.0.11 type=4 value=STRING: "Network Time Protocol(NTP) is not configured. This might cause issues with features like Active Directory, LDAP or Two-Factor Authentication. "

• find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol(NTP) is not configured")=1 --- this one doesn't work
• find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\(NTP\) is not configured")=1 --- tried to escape the parenthesis, but failed with error message : Invalid parameter "/1/expression": incorrect expression starting from "find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\(NTP\) is not configured")=1".
• find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol.* is not configured")=1 ---- working
• find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol")=1 ---- if simply use "Network Time Protocol" to match , working

Can someone guide me how can match "Network Time Protocol(NTP) is not configured" in zabbix ?

[Hamardaban]

find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\\(NTP\\) is not configured")=1

worked for me... v7.2 Zabbix

[wuhaohust]

works for V7.0.5

[kyus]

Hey!

Have you tried using the operator "like" instead of "regexp"?

From the docs:

like (default for string, text, log) - matches if contains the string given in pattern (case-sensitive)

https://www.zabbix.com/documentation/7.0/en/manual/appendix/functions/history#find

[wuhaohust]

Hi jyus,

Thanks for your comment. "like" operator works, but I will want to know how can we escape parenthesis with regexp , do you have any idea or experience ?

[kyus]

Well, i did use regex in Zabbix, but never with the find function, i will link some docs with info about regex and escaping characters, hope it helps!

https://www.zabbix.com/documentation/7.0/en/manual/regular_expressions

https://www.zabbix.com/documentation/7.0/en/manual/appendix/escaping

[cyber]

find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\(NTP\) is not configured")=1

worked just fine for me... v6 Zabbix

[wuhaohust]

hmm, this expression is invalid in my env 7.0.5

[Hamardaban]

find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\\(NTP\\) is not configured")=1

worked for me... v7.2 Zabbix

[wuhaohust]

works for V7.0.5

[kyus]

find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\(NTP\) is not configured")=1

Only worked in v6 for me.

find(/snmp trap template/snmptrap.fallback,,"regexp","Network Time Protocol\\(NTP\\) is not configured")=1

Worked in v6, v7 and v7.2...