0

I currently monitor a page that prints the following health check

<status>
<link type="text/css" id="dark-mode" rel="stylesheet" href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<cache>ok</cache>
<databaseMaster>error</databaseMaster>
<databaseSlave>error</databaseSlave>
<redis>ok</redis>
<files>ok</files>
</status>

I do it by using the following trigger (this one works)

{host:web.page.regexp[{$HOST_IP},health/check,,[error|warning],,].str(error)}=1

However when trying to go into the detail parsing each individual line response (i.e. database master, in line 5, it can show 3 values, ok, error, and warning, the expression i'm trying to get running goes (this doesn't work)

{host:web.page.regexp[{$HOST_IP},health/check,,[<databaseMaster>error|<databaseMaster>warning],,].str(error)}=1

However despite the syntax and that i can't find anything wrong with it, for the greater than and lower than symbols are not metacharacters, somehow i suspect my regex expression is wrong but i'm not sure how to translate it to pcre so I can match the characters that I want to trigger the alert

Im also wondering if zabbix have a feature that would be better suited for this?

GoatZero
  • 219
  • 2
  • 14

1 Answers1

1

[<databaseMaster>error|<databaseMaster>warning] - you're trying to match either <databaseMaster>error or <databaseMaster>warning, but you're actually matching one character from the list <d,a,t,b,s,e,M,r,>,o,|,w,n,i,g.

[Square brackets] in this case mean "match one character present in the list." Try a capture group instead, which will behave as you're expecting:

(<databaseMaster>error|<databaseMaster>warning)

Check this answer for more info on the difference between parenthesis and square brackets in a regex.

Nick Reed
  • 4,989
  • 4
  • 17
  • 37