[ZBXNEXT-968] multiline regular expression matching Created: 2007 Dec 21  Updated: 2022 Jul 27  Resolved: 2022 Jul 27

Status: Closed
Project: ZABBIX FEATURE REQUESTS
Component/s: Agent (G), Proxy (P), Server (S)
Affects Version/s: None
Fix Version/s: None

Type: Change Request Priority: Major
Reporter: Stanislav Kogan Assignee: Zabbix Support Team
Resolution: Duplicate Votes: 20
Labels: patch, regexps, trivial
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Attachments: Text File regexp.patch    
Issue Links:
Causes
caused by ZBX-16453 Can't discover JSON from top level Closed
Duplicate
duplicates ZBX-3924 frontend and daemons use different re... Closed

 Description   

The regular expressions in Zabbix are currently compiled with the REG_NEWLINE flag, which causes the new line character not to be treated as "any character" ( . ). This is counter intuitive for web scenario steps.



 Comments   
Comment by Stanislav Kogan [ 2007 Dec 21 ]

Suggested patch

Comment by richlv [ 2009 Sep 23 ]

valid/not ?
maybe should be moved to the feature requests to allow runtime configuration of the mentioned REG_NEWLINE ?

Comment by dean [ 2013 Sep 10 ]

8 years? still no one(Zabbix) notice this?

Comment by richlv [ 2013 Nov 12 ]

related : ZBXNEXT-846

Comment by Oleksii Zagorskyi [ 2015 Dec 02 ]

a bit related ZBXNEXT-434

Comment by Tiago Cruz [ 2016 Mar 09 ]

any update and/or workaround here?

Comment by Marián Černý [ 2016 Jun 20 ]

Zabbix documentation links to Wikipedia Regular expressions article, section POSIX Extended Regular Expressions. (The section doesn't exist any more, should probably link to section POSIX extended.)

According to POSIX standard, Metacharacter . Normally matches any character except a newline.

The trick (workaround) is to include character class that contains newline, which seems to be [:space:] or [:cntrl:]. So the complete solution is to replace . with (.|[[:space:]]), which is mentioned also in ZBXNEXT-846.

Comment by richlv [ 2016 Jun 20 ]

majo, could you please create a new bugreport about the documentation link being wrong ?

Comment by Marián Černý [ 2016 Jun 22 ]

Bug report ZBX-10930 created.

Comment by Oleg Ivanivskyi [ 2016 Jul 04 ]

The possible solution (http://zabbix.org/wiki/Start_with_SNMP_traps_in_Zabbix#Create_items_for_linkUp.2FlinkDown_traps_with_LLD):

snmptrap["(IF-MIB::linkDown|IF-MIB::linkUp)(.|[[:space:]])*{#SNMPVALUE}"]
Comment by Oleksii Zagorskyi [ 2016 Jul 04 ]

I can additionally confirm that [[:space:]] or [[:cntrl:]] include newline character and may be used in zabbix for multiline regexp match.

Comment by Oleksii Zagorskyi [ 2021 Apr 05 ]

I don't think we need to keep this opened as it's actually possible.
Just remember that with ZBX-3924 (from v3.4) implemented we use PCRE.

Also remember that in case of log file monitoring and filtering on agent side, multiline filtering is not possible by design, when reading log file by zabbix agent.
The limit is because of nature and logic of zabbix agent - it takes a line first and then perform regexp match test for each line. ZBXNEXT-967 asks for that option.

Comment by Oleksii Zagorskyi [ 2021 Apr 05 ]

Let's set resolution as Fixed, to indicate that it's actually possible.

Comment by dimir [ 2022 Jul 27 ]

Since nothing was actually done here let's consider it as duplicate of ZBX-3924 .

Generated at Sat Apr 27 00:49:55 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.