2

I am using Zabbix monitoring system. I need to monitor a log file on a windows server for error messages. The first line just shows ERR and the next 2 lines then have the time stamp and details of the error. I need to bring all 3 lines into Zabbix. Zabbix uses perl regex for this.

Below is the regex I have been playing with. It can find ERR in the log or it can copy the additional lines but not both. I think what I need is an if then do statement and can not figure out how to write that.

\Q[ERR]\E(?:\r\n?|\n)(.*?)(?:\r\n?|\n)(.*?){2}(.+)

\Q[ERR]\E  -finds ERR in the log file
(?:\r\n?|\n)(.*?)(?:\r\n?|\n)(.*?){2}(.+)

-copies the next 2 lines when I put them together it does not work

Log file: 2023-03-15 18:14:31.149 -04:00 [ERR] Exception Time: 3/15/2023 6:14:31 PM Exception Message: Could not find file '\XXXXX01\Files\51372\Working.xml'.

Please help. I been bashing my head against the wall for a week now.

micah
  • 838
  • 7
  • 21
ahess
  • 21
  • 1

1 Answers1

1

If you want to match all 3 lines without capture groups, where the first line contains [ERR]

.*\[ERR]\h*(?:\R.*){2}

Regex demo

Or matching all following lines that contain Exception

.*\[ERR]\h*(?:\R.*\bException\b.*){2}

Regex demo

The fourth bird
  • 154,723
  • 16
  • 55
  • 70