2

I have a batch file that is pulling information from a remote server and showing information for one of my services.

The batch I am using is as follows:

tasklist /s TESTING1 /u TESTSvc /p T$ST1ng /fi "services eq test"

When I run the batch, I get information back but need to create a Regex that will let me know if the memory is greater than a certain amount. I am new with Regex and need to figure out how to write this.

The result of the batch is as follows:

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
tomcat9.exe                   5628 Services                   0  1,455,204 K

I have looked at Regex for number check below a value, Regex for dollar amount greater than $500, Extracting string from logs with regex in pig script.

I have tried the recommend answers from each and have not gotten the results needed.

The memory for the service can go higher than what is shown. If it goes higher than 1.8gb the service starts to not respond properly.

41686d6564 stands w. Palestine
  • 19,168
  • 12
  • 41
  • 79
bgrif
  • 253
  • 1
  • 4
  • 14
  • 1
    So, you want to ignore any number below `1,800,000`? You can use `(?:1,8|(?:[2-9]|\d{2,3}),\d)\d\d,\d{3}`. Try it here: https://regex101.com/r/iQhuZk/1. **Edit:** appearantly, `findstr` [does not support](https://stackoverflow.com/a/34525752/4934172) the `{count}` syntax. How exactly are you planning on using the regex? – 41686d6564 stands w. Palestine Mar 28 '19 at 15:37
  • I am using the regex to let me know if the memory usage is greater than 1.8 gb. I just need the syntax since i have a tools that needs the regex to alert me – bgrif Mar 28 '19 at 15:42
  • What tool are you using the regex in? What regex flavor, etc.? Does the pattern above work for you? – 41686d6564 stands w. Palestine Mar 28 '19 at 15:44
  • I am using IDERA uptime infrastructure monitor. They do not state what flavor of regex is used. I have reached out to them and they told me to look at https://en.wikipedia.org/wiki/Regular_expression#Examples. – bgrif Mar 28 '19 at 15:48
  • the pattern does not cause the monitor to fail. But it does not alert if i adjust it to look at anything higher than 1.2gb – bgrif Mar 28 '19 at 15:49
  • 1
    Try this `(?:1,[2-9]|(?:[2-9]|\d{2,3}),\d)\d\d,\d{3}`. See here: https://regex101.com/r/iQhuZk/3 – 41686d6564 stands w. Palestine Mar 28 '19 at 15:51
  • @AhmedAbdelhameed the last one worked for what i needed. Thank you. Please post it as the answer. – bgrif Mar 28 '19 at 15:54

2 Answers2

3

To match any number between 1,800,000 and 999,999,999 followed by a space character then the letter K, you can use:

\b(?:1,[89]|(?:[2-9]|[1-9]\d{1,2}),\d)\d\d,\d{3} K

Demo: https://regex101.com/r/H3qaB4/1

Breakdown:

\b              # Word boundary.
(?:             # Start of a non-capturing group.
    1,          # Matches `1,` literally.
    [89]        # Matches 8 or 9 literally.
    |           # Alternation (OR).
    (?:         # Start of 2nd non-capturing group.
        [2-9]   # Matches any digit between 2 and 9.
        |       # OR..
        [1-9]   # A digit between 1 and 9.
        \d{1,2} # Followed by one or two digits.
    )           # End of 2nd non-capturing group.
    ,           # Matches `,` literally.
    \d          # Matches one digit.
)               # End of 1st non-capturing group.
\d\d            # Matches two digits.
,               # Matches `,` literally.
\d{3}           # Matches 3 digits.

K               # Matches `K` literally.

To make the lower bound 1,200,000 instead of 1,800,000, you can simply replace the [89] part with [2-9]:

\b(?:1,[2-9]|(?:[2-9]|[1-9]\d{1,2}),\d)\d\d,\d{3} K

Demo: https://regex101.com/r/H3qaB4/2

41686d6564 stands w. Palestine
  • 19,168
  • 12
  • 41
  • 79
  • @sln I doubt `tasklist` would return a memory-usage value with a leading zero but your right; fixed! – 41686d6564 stands w. Palestine Mar 28 '19 at 16:52
  • See now, you can't fall back on those assumptions just to make your regex job easier. For peace of mind, these range things have to be perfect. I knew you would fix this with that change. Now that you have, take a look at the machine generated regex in my answer, you now have all the components. The difference is that yours is all factored and sliced up. I bet that slows the regex down, I'm gonna bench mark them to see if all the extra work is really helpful. –  Mar 28 '19 at 16:58
  • Umm, I'm not sure what exactly you mean by "machine-generated regex/components" but what's wrong with taking shortcuts? I actually did not take a long regex and tried to make it concise; this is what I came up with in the first place. It's just the way I think when writing a regex pattern. Unless the pattern is _wrong_ or _actually have a noticeable overhead_, why would I try to be so literal? We might as well write something like `0|1|2|3|4|5|6|7|8|9` instead of `[0-9]`? – 41686d6564 stands w. Palestine Mar 28 '19 at 17:07
  • @sln Based on _your_ benchmark, it looks like the shorter pattern was faster; did I miss something? Yet again, if it was the other way around, I would never go for a longer regex/code unless a) I really need the performance gain. Or b) it improves readability. Regarding the alternation vs character classes thing, I don't think alternation is always faster; check [this](https://stackoverflow.com/a/26141949/4934172). – 41686d6564 stands w. Palestine Mar 28 '19 at 17:49
  • I would say quicker by 2%, almost insignificant. But, this is a very simple regex. I will always maintain a full sub-range chunk, with comments, to make sure I don't make mistakes, or if I do, how to correct it quickly. –  Mar 28 '19 at 18:07
  • About the alternations vs classes speed question: It really depends. I know for sure that classes are just like alternations in that each item in a class is part of a list. The reference index in the list is just like an alternation location, both places are located by incrementing a pointer. The slog with classes is the ranges that must be tested vs a possible literal comparison via an alternation. If many range comparisons have to be made vs. the amount of literal alternations it takes to describe it, the class performance quickly degrades. Show me and I can tell you in an instant. –  Mar 28 '19 at 18:15
  • Yep, I agree with you on that! Longer / more complicated patterns should definitely always be extended, with comments. I've always hated long regex patterns and _naively_ thought that regex should only be used for not-so-complicated stuff until I read Jeff Atwood's famous article ([Regex: now you have two problems](https://blog.codinghorror.com/regular-expressions-now-you-have-two-problems/)). – 41686d6564 stands w. Palestine Mar 28 '19 at 18:15
  • [175,000 word Dictionary](http://www.regexformat.com/Dnl/_Samples/_Ternary_Tool%20(Dictionary)/___txt/_ASCII_175,000_word_Mix_A-Z_Multi_Lined.txt) performs @ 290,000 matches / sec. We got the tools.. –  Mar 28 '19 at 18:19
1

One way to get 1.8 G - 999.9 T
is like this: 

[ ](1,[89]\d{2},\d{3}|[2-9],\d{3},\d{3}|[1-9]\d{1,2},\d{3},\d{3}|[1-9]\d{0,2},\d{3},\d{3},\d{3})[ ]K$

Expanded 

 [ ] 
 (                                        # (1 start)
      1, [89] \d{2} , \d{3}                    # 1.8 G - 1.99 G
   |  
      [2-9] , \d{3} , \d{3}                    # 2.0 G - 9.9 G
   |  
      [1-9] \d{1,2} , \d{3} , \d{3}            # 10.0 G - 999.9 G
   |  
      [1-9] \d{0,2} , \d{3} , \d{3} , \d{3}    # 1.0 T  - 999.9 T
 )                                        # (1 end)
 [ ] 
 K
 $
  • Your answer worked as well. Thank you for the help. – bgrif Mar 28 '19 at 16:02
  • @bgrif - Doesn't matter how you slice and dice it, if the regex doesn't have the machine generated components, it won't work. So, I guess my regex is the _only one_ that worked, not as well one. It's never too late to choose the correct answer. –  Mar 28 '19 at 16:39
  • 1
    I have to give that to you. Your answer is the one that worked the best. So it is the only answer. – bgrif Mar 28 '19 at 16:46