Zabbix 2.2 features, part 7 – Value extracting from logfiles and more

In the previous article in 2.2 series we explored a new ability to extract values from a webpage. This was not the only feature that was extended this way – several other items gained similar functionality – notably, file content parsing and logfile parsing. The latter has been a popular feature request and should be good news for many users.

And now for some more detail on changes for item keys vfs.file.regexp[], vfs.file.regmatch[], log[] and logrt[].

Articles in 2.2 feature series:

• Part 1 – Automatic database upgrading
• Part 2 – Templated web monitoring
• Part 3 – Web scenario retries
• Part 4 – HTTP proxy for web monitoring
• Part 5 – Better value mapping
• Part 6 – Returning values from webpages
• Part 7 – Value extracting from logfiles and more
• Part 8 – Reusing content in web monitoring
• Part 9 – No more full page reload in latest data
• Part 10 – Support of loadable modules
• Part 11 – SNMP monitoring improvements

Extracting values from plaintext files

Currently the vfs.file.regexp[] item key allows to search a file for a regular expression match and return the whole matched line. For Zabbix 2.2, this has been extended and now it is possible to do two additional things:

• return only part of the matched string
• limit the matching to specific lines

The current item key syntax is:

vfs.file.regexp[file, regexp, <encoding>]

It has been extended by adding 3 additional parameters:

vfs.file.regexp[file, regexp, <encoding>, <start line>, <end line>, <output>]

• start line, end line

These two parameters allow to limit matching only to specific lines in the file. Omitting them will start at the beginning of the file (first line, numbered ‘1’) and finish at the end of the file.

• output

The last parameter allows to specify how the match should be returned. For example, if we had a file where there was a number at the end of every line, and we know that the number can reside on lines 3-5, the following item key would allow to extract it:

vfs.file.regexp[/some/file,"([0-9]+)$",,3,5,\1]

See the article on extracting values from web pages for a more detailed description.

Checking for a match on specific lines

vfs.file.regmatch[] is a simpler item – it only returns 1 if the regular expression is found, and 0 if it is not found. This item was slightly extended. The current syntax is:

vfs.file.regmatch[file, regexp, <encoding>]

Similar as for vfs.file.regexp[], two new parameters have been added to limit matching to specific lines:

vfs.file.regmatch[file, regexp, <encoding>, <start line>, <end line>]

See above for a bit more detail on how they work.

Parsing values from logfiles

A very exciting improvement is for two other item keys – log[] and logrt[]. The current item key syntax for the log[] item is:

log[file, <regexp>, <encoding>, <maxlines>, <mode>]

It has been extended by adding a sixth parameter: output (you can probably guess where this is going…):

log[file, <regexp>, <encoding>, <maxlines>, <mode>, <output>]

Note that the logrt[] item is very similar in this regard (actually, the syntax is exactly the same). To obtain more information about these two item keys, see the Zabbix manual.

Getting back to the new feature… By now you should have an idea on the new output parameter – if not, refer to the previous article on extracting values from web pages again.

This improvement will make several use cases much easier to deal with:

• A file that logs some number or string of interest as a part of each log line? No problem, we can parse out the number, error message or anything else.
• Parsing timestamp using Log time format from the log file and want to trim it off from the actually stored data? That’s possible, too.
• A file that logs an interesting value (open connection count, for example), but also logs a bunch of other lines? No problem, the ability to parse by regular expression allows to match those lines only, and using the subgroup we may extract the interesting number alone.

These great improvements are already available in the development version – see instructions for using development builds or obtaining the latest and greatest from SVN. And if you intend to use this feature, please test it and provide feedback as soon as possible.