[ZBX-15178] If "output template" references captured groups which do not exist in regexp then item value can be unpredictable Created: 2018 Nov 16  Updated: 2024 Apr 10  Resolved: 2018 Dec 11

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G), Server (S)
Affects Version/s: 4.0.1
Fix Version/s: 4.0.3rc1, 4.2.0alpha2, 4.2 (plan)

Type: Problem report Priority: Minor
Reporter: Andris Mednis Assignee: Alex Kalimulin
Resolution: Fixed Votes: 0
Labels: log, logmonitoring, logrt, preprocessing
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

GNU/Linux


Issue Links:
Causes
caused by ZBX-13730 High CPU / Faliure to Match REGEX Closed
Team: Team A
Sprint: Sprint 46, Nov 2018, Sprint 47, Dec 2018
Story Points: 3

 Description   

Steps to reproduce:
1. Create item with 9 captured groups in regexp and all 10 possible groups in "output template":

 log[/home/zabbix/test.log,(ABC)(DEF)(GHI)(JKL)(MNO)(PQR)(STU)(VWX)(YZ),,,,g1:\1 g2:\2 g3:\3 g4:\4 g5:\5 g6:\6 g7:\7 g8:\8 g9:\9 g0:\0]

2. Append to logfile a string: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Result is correct:

g1:ABC g2:DEF g3:GHI g4:JKL g5:MNO g6:PQR g7:STU g8:VWX g9:YZ g0:ABCDEFGHIJKLMNOPQRSTUVWXYZ

3. Reduce number of captured groups in regexp to 3, but leave all 10 groups in "output template" (do not restart agent):

log[/home/zabbix/test.log,(ABC)(DEF)(GHI),,,,g1:\1 g2:\2 g3:\3 g4:\4 g5:\5 g6:\6 g7:\7 g8:\8 g9:\9 g0:\0]

4. Append to logfile a string: ABCDEFGHIJKLMNOPQRSTUVWXYZ
Result is incorrect:

g1:ABC g2:DEF g3:GHI g4:JKL g5:MNO g6:PQR g7:STU g8:VWX g9:YZ g0:ABCDEFGHI

Not-captured groups happen to contain their old values, although documentation https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/zabbix_agent#supported_item_keys says that not-captured group is "an empty string if the N exceeds the number of captured groups".

This bug is not limited to log[] and logrt[] items. Similar results can be demonstrated with item preprocessing if output template references capture groups which do not exist in the regexp.



 Comments   
Comment by Andris Mednis [ 2018 Nov 16 ]

(1) [D] https://www.zabbix.com/documentation/current/manual/config/items/itemtypes/zabbix_agent#supported_item_keys says about log[] and logrt[] items "output" parameter:

The \0 escape sequence is replaced with the matched text ...

I understood it wrong - that \0 is replaced with the whole matched string.

Maybe we can say it more precise, e.g.:

The \0 escape sequence is replaced with the matched part of text (from the first character where match begins until the character where match ends)  ...

martins-v Thanks, RESOLVED in the supported versions.

andris Reviewed. CLOSED

Comment by Glebs Ivanovskis [ 2018 Nov 18 ]

from the first character where match begins until the character where match ends

Technically speaking, match does not start and end with a character, because match can be zero length (e.g. lookaround patterns, word boundary patterns, etc.).

Comment by Alex Kalimulin [ 2018 Nov 27 ]

Fixed in:

  • pre-4.0.3rc1 r87296
  • pre-4.2.0alpha2 r87305
Generated at Tue Apr 23 13:37:50 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.