[#ZBX-15318] Invalid regular expression in snmptrap[] Item

Comment by un1x0d [ 2018 Dec 14 ]

On 3.4 version this snmptrap work without errors.

Comment by Arturs Lontons [ 2018 Dec 19 ]

Hello and thank you for reporting this issue.
In order to confirm it from my side, could you please provide an example of the trap that causes this item to display the "Invalid regular expression" message.

Comment by Markus Zehnder [ 2018 Dec 19 ]

i have the same problem after upgrade from 3.4 to 4.0.2 but not with all items.

Discovery rule is the same key:

snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.{#SNMPINDEX}\D"]

Comment by Aigars Kadikis [ 2018 Dec 20 ]

Hello un1x0d , markz ,

Did you upgrade the underlying operating system as well or only binaries regarding Zabbix?

It may sound not very related, but.. Are you delivering traps for item keys through zabbix_trap_receiver.pl.

Are you using the very latest version which is supposed to work together with 4.0?

Please extract the source , navigate to misc/snmptrap/ and install the current zabbix_trap_receiver.pl.

Regards,

Comment by Markus Zehnder [ 2018 Dec 20 ]

Operating system is the same (Debian Jessie), only Zabbix where upgraded. Traps are delivered via zabbix_trap_receiver.pl (from version 4.0.2) and are working.

17:41:02 2018/12/20 ZBXTRAP 192.168.2.121
PDU INFO:
  version                        3
  messageid                      314
  requestid                      314
  errorindex                     0
  transactionid                  2
  securityName                   someuser
  contextName
  notificationtype               INFORM
  receivedfrom                   UDP: [192.168.2.121]:161->[192.168.0.153]:162
  securityEngineID               0x...
  contextEngineID                0x...
  securitymodel                  3
  securitylevel                  2
  errorstatus                    0
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (137403590) 15 days, 21:40:35.90
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: IF-MIB::linkDown
  IF-MIB::ifIndex.2              type=2  value=INTEGER: 2
  IF-MIB::ifAdminStatus.2        type=2  value=INTEGER: 2
  IF-MIB::ifOperStatus.2         type=2  value=INTEGER: 2
  SNMPv2-SMI::enterprises.11863  type=4  value=STRING: "Port2 linkDown"
17:42:22 2018/12/20 ZBXTRAP 192.168.2.121
PDU INFO:
  version                        3
  messageid                      315
  requestid                      315
  transactionid                  3
  errorindex                     0
  contextName
  receivedfrom                   UDP: [192.168.2.121]:161->[192.168.0.153]:162
  securityName                   someuser
  notificationtype               INFORM
  securityEngineID               0x...
  contextEngineID                0x...
  securitymodel                  3
  securitylevel                  2
  errorstatus                    0
VARBINDS:
  DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (137417628) 15 days, 21:42:56.28
  SNMPv2-MIB::snmpTrapOID.0      type=6  value=OID: IF-MIB::linkUp
  IF-MIB::ifIndex.2              type=2  value=INTEGER: 2
  IF-MIB::ifAdminStatus.2        type=2  value=INTEGER: 1
  IF-MIB::ifOperStatus.2         type=2  value=INTEGER: 1
  SNMPv2-SMI::enterprises.11863  type=4  value=STRING: "Port2 linkUp"

After trap is received the status in Zabbix changes from "Not supported" (Invalid regular expression...) to "Enabled" (see Picture).

in previous version 3.4 status was always shown as "Enabled" or "Disabled" but never "Not supported" (Invalid regular expression...). Visual bug?

Comment by Aigars Kadikis [ 2018 Dec 21 ]

markz ,

Do all "red" items have "Invalid regular expression"? Please attach the screen while the error is on screen.

What is the version of PCRE library?

apt list --installed|grep pcre
yum list installed|grep pcre

What is the frequency of network interface discovery?

Would you mind to attach the template (in XML format) to the issue?

un1x0d

1) What do you mean by

But this snmptrap is working !!!

You mean there is an error on the item, but under the latest data page, the information is still coming?

2) Please attach some sample trap from the latest data page.

Regards,

Comment by Markus Zehnder [ 2018 Dec 21 ]

yes, all "red" items have "Invalid regular expression"

What is the version of PCRE library?

apt list --installed|grep pcre

libpcre3/oldstable,now 2:8.35-3.3+deb8u4 amd64 [installed]

What is the frequency of network interface discovery?
interface discover interval is set to 1h

zbx_export_templates_SNMP_Interfaces.xml

Comment by Aigars Kadikis [ 2018 Dec 27 ]

Hello, markz.

Thank you for the template. After sending trap manually I was able to finally see "Invalid regular expression" message. The following RegEx was used:

snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.{#SNMPINDEX}\D"]

The trap by itself never was delivered to the fallback item either. Redesigning a different RegEx did solve the issue.

Please, try:

snmptrap["IF-MIB::(linkDown|linkUp)(.|\n)*ifIndex.{#SNMPINDEX}"]

Regards,

Comment by Aigars Kadikis [ 2019 Jan 23 ]

# Take zabbix server 3.4 or 4.0 on the top of CentOS 7

# install snmptrapd
yum install -y net-snmp-utils net-snmp-perl net-snmp nmap

# Install allowed community names
cat <<'EOF'> /etc/snmp/snmptrapd.conf
authCommunity execute Earth
perl do "/usr/bin/zabbix_trap_receiver.pl";
EOF

# install perl trap parser
curl https://raw.githubusercontent.com/zabbix/zabbix/trunk/misc/snmptrap/zabbix_trap_receiver.pl > /usr/bin/zabbix_trap_receiver.pl
chmod +x /usr/bin/zabbix_trap_receiver.pl

systemctl enable snmptrapd
systemctl start snmptrapd
systemctl status snmptrapd

# send test trap
snmptrap -v 1 -c Earth 127.0.0.1 'IF-MIB::linkDown' '0.0.0.0' 6 33 '55' .1.3.6.1.6.3.1.1.5.3 s "wlan1"

# observe if the "wlan1" content is there
cat /tmp/zabbix_traps.tmp

# empty the file
> /tmp/zabbix_traps.tmp

# make sure the trap receiver is enabled in zabbix_server
grep SNMPTrapperFile= /etc/zabbix/zabbix_server.conf
grep StartSNMPTrapper= /etc/zabbix/zabbix_server.conf

# restart zabbix server
systemctl restart zabbix-server

# see if there is not errors inside
cat /var/log/zabbix/zabbix_server.log

open host "Zabbix server"
add new SNMP interface
add template generate snmp trap items from manual discovery.xml

# reload configuration cache
zabbix_server -R config_cache_reload

# send a fake discovery to create some interfaces
zabbix_sender -z 127.0.0.1 -s "Zabbix server" -k net.if.discovery.manual -o '{"data":[{"{#SNMPINDEX}":"1","{#SNMPVALUE}":"1","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"ether1-gateway","{#IFDESCR}":"ether1-gateway","{#IFTYPE}":"6"},{"{#SNMPINDEX}":"2","{#SNMPVALUE}":"1","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"ether2-master-local","{#IFDESCR}":"ether2-master-local","{#IFTYPE}":"6"},{"{#SNMPINDEX}":"3","{#SNMPVALUE}":"2","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"ether3-slave-local","{#IFDESCR}":"ether3-slave-local","{#IFTYPE}":"6"},{"{#SNMPINDEX}":"4","{#SNMPVALUE}":"2","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"ether4-slave-local","{#IFDESCR}":"ether4-slave-local","{#IFTYPE}":"6"},{"{#SNMPINDEX}":"5","{#SNMPVALUE}":"2","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"ether5-slave-local","{#IFDESCR}":"ether5-slave-local","{#IFTYPE}":"6"},{"{#SNMPINDEX}":"6","{#SNMPVALUE}":"2","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"wlan1","{#IFDESCR}":"wlan1","{#IFTYPE}":"71"},{"{#SNMPINDEX}":"7","{#SNMPVALUE}":"1","{#IFADMINSTATUS}":"1","{#IFALIAS}":"","{#IFNAME}":"bridge-local","{#IFDESCR}":"bridge-local","{#IFTYPE}":"209"}]}'
# see if output reports 'processed: 1;'

# reload configuration cache
zabbix_server -R config_cache_reload

# open latest data page, set application "trap regex", select "Show items without data", select show details.

# send trap
snmptrap -v 1 -c Earth 127.0.0.1 'IF-MIB::linkDown' '0.0.0.0' 6 33 '55' .1.3.6.1.6.3.1.1.5.3 s "wlan1"

# reload the page

on 3.4 the fallback item captures the trap. It should be like that:

on 4.0 the falback item captures the trap as well but in same time the other items go in an unsupported state:

Comment by Vladislavs Sokurenko [ 2019 Jan 23 ]

Thanks allot for detailed steps, I get following error in the log file:
PCRE_ERROR_MATCHLIMIT

4088:20190123:164623.325 regexp_exec() failed with error -8
  4088:20190123:164624.223 regexp_exec() failed with error -8
  4088:20190123:164625.098 regexp_exec() failed with error -8
  4088:20190123:164626.027 regexp_exec() failed with error -8
  4088:20190123:164626.945 regexp_exec() failed with error -8
  4082:20190123:164627.293 item "Zabbix server:snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.6\D"]" became not supported: Invalid regular expression "IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.6\D".
  4082:20190123:164627.299 item "Zabbix server:snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.4\D"]" became not supported: Invalid regular expression "IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.4\D".
  4082:20190123:164627.300 item "Zabbix server:snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.3\D"]" became not supported: Invalid regular expression "IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.3\D".
  4082:20190123:164627.300 item "Zabbix server:snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.2\D"]" became not supported: Invalid regular expression "IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.2\D".
  4082:20190123:164627.300 item "Zabbix server:snmptrap["IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.1\D"]" became not supported: Invalid regular expression "IF-MIB::(linkDown|linkUp)(?:(?:.|[[:space:]])*?)ifIndex.1\D".

Issue begins after ~~ZBX-13730~~

Comment by Andris Zeila [ 2019 Jan 30 ]

Actually in 3.4.12 the described regular expression match also ends with error (REG_ESPACE, failed to get memory), but Zabbix simply treated it as non match. Now Zabbix correctly gives regular expression execution error instead of false non match result.

Comment by Vladislavs Sokurenko [ 2019 Jan 30 ]

Won’t fix ?

wiper: Yes, nothing we can fix. The main concern was why it was working before, but as it turns out - it was not.

[ZBX-15318] Invalid regular expression in snmptrap[] Item Created: 2018 Dec 14 Updated: 2024 Apr 10 Resolved: 2019 Jan 31
Status:	Closed
Project:	ZABBIX BUGS AND ISSUES
Component/s:	Proxy (P), Server (S)
Affects Version/s:	4.0.2
Fix Version/s:	4.2 (plan)

[ZBX-15318] Invalid regular expression in snmptrap[] Item Created: 2018 Dec 14 Updated: 2024 Apr 10 Resolved: 2019 Jan 31