[ZBX-7602] Invalid pattern (regexp) in log[] and logrt[] items produces no error messages, behaves like never matching Created: 2014 Jan 02  Updated: 2018 Oct 12  Resolved: 2016 Aug 22

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: Agent (G)
Affects Version/s: 1.8.20rc1, 2.0.11rc1, 2.2.2rc1
Fix Version/s: 3.2.0alpha2

Type: Incident report Priority: Trivial
Reporter: Andris Mednis Assignee: Unassigned
Resolution: Fixed Votes: 1
Labels: regexps
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

GNU/Linux


Issue Links:
Duplicate
duplicates ZBXNEXT-2430 Option to define log monitoring on ag... Closed
is duplicated by ZBX-8410 Invalid regular expression in eventlo... Closed

 Description   

Create a one-line test log
$ cat /home/zabbix20/test_logs/test.log
error1

Create a new log[] item with invalid pattern "error.*\":
log[/home/zabbix20//test_logs/test.log,error.*\,,]

Agentd does not report anything to server as if there was no matching records in the log file. No errors about invalid regexp are logged.

Correct the invalid pattern to
log[/home/zabbix20//test_logs/test.log,error.*,,]

Now the record matches and is reported to server.



 Comments   
Comment by richlv [ 2014 Jan 02 ]

other item keys where we support regexps and that probably should be verified :

  • system.hw.macaddr
  • system.sw.packages
  • vfs.file.regexp
  • vfs.file.regmatch
  • web.page.regexp
  • snmptrap
Comment by Oleksii Zagorskyi [ 2014 Jan 03 ]

ZBX-5902 is related.
For example both issues could be fixed together.

Comment by Andris Mednis [ 2016 Apr 29 ]

This is being fixed as part of solution in ZBXNEXT-2430.

Comment by Alexander Vladishev [ 2016 Jul 27 ]

I close the issue as duplicate of ZBXNEXT-2430.

Comment by Alexander Vladishev [ 2016 Jul 27 ]

Processing of rRegular expressions in eventlog[] items should be fixed too.

Comment by Andris Mednis [ 2016 Jul 27 ]

Turns out ZBXNEXT-2430 fixed it for log and logrt[], but forgot about eventlog (see process_eventlog_check()). Makes sense to reopen and fix. Example how it is done is in zbx_read2().

Comment by Sergejs Paskevics [ 2016 Jul 29 ]

Fixed in development branch svn://svn.zabbix.com/branches/dev/ZBX-7602

Comment by Aleksandrs Saveljevs [ 2016 Aug 08 ]

(1) Stylistically, lines should be 120 characters at most (see https://www.zabbix.org/wiki/C_coding_guidelines).

s.paskevics RESOLVED in r61513

asaveljevs Some lines are still longer than 120 characters. REOPENED.

s.paskevics RESOLVED in r61569

asaveljevs CLOSED

Comment by Aleksandrs Saveljevs [ 2016 Aug 08 ]

(2) The old "if"s seem to have required all things to match, but the new code only requires one thing to match.

s.paskevics RESOLVED in r61513

asaveljevs There must be a shorter way of doing this. REOPENED.

s.paskevics RESOLVED in r61569

asaveljevs Can you make it shorter still? Also, "ret_regexp_value" and other variables are not needed outside that "0 == p_count" if. REOPENED.

s.paskevics RESOLVED in r61666

asaveljevs Looks good, but please see some further suggestions in r61682. TESTED.

s.paskevics Ok. CLOSED

Comment by Aleksandrs Saveljevs [ 2016 Aug 09 ]

(3) In case there is an invalid regular expression, we do not call finalize_eventlog6().

s.paskevics RESOLVED in r61569

asaveljevs CLOSED

Comment by Aleksandrs Saveljevs [ 2016 Aug 09 ]

(4) One consideration is that we should only check regular expression validity once. After we know that regular expressions are valid, we should try to do as few checks as possible.

s.paskevics RESOLVED in r61569

asaveljevs CLOSED

Comment by Aleksandrs Saveljevs [ 2016 Aug 09 ]

(5) It is not related to this development, but the Windows compiler warns about the following:

..\..\..\src\zabbix_agent\active.c(1142) : warning C4244: '=' : conversion from 'double' to 'float', possible loss of data

s.paskevics RESOLVED in r61569

asaveljevs According to https://www.zabbix.org/wiki/C_coding_guidelines , no space should be added after the type when casting. REOPENED.

s.paskevics RESOLVED in r61666

asaveljevs As discussed on IRC, it seems dubious to have "max_delay" variable (introduced in ZBXNEXT-2430) as float, because we cast it to double in several places anyway, but OK - let's leave as is. CLOSED.

Comment by Aleksandrs Saveljevs [ 2016 Aug 09 ]

I did some alternative implementation in svn://svn.zabbix.com/branches/dev/ZBX-7602-alt . If you like it, feel free to use it for further development.

Comment by Aleksandrs Saveljevs [ 2016 Aug 09 ]

(6) Currently, if there is an invalid regular expression, we complain without pointing to the offending expression. Do we want to specify exactly which one is bad?

s.paskevics RESOLVED in r61569

asaveljevs CLOSED

Comment by Sergejs Paskevics [ 2016 Aug 16 ]

Fixed in:

  • pre-3.2.0 (trunk) r61690
Generated at Wed Apr 24 11:10:32 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.