Regular Expressions for Monitoring Plugin Configuration

Many of our monitoring-checks have parameters that accept either a string or a regular expression (regex or regexp for short) as a value. This possibility, especially in combination with a naming convention, is a very flexible and powerful instrument to control what the monitoring plugins should check.

Basic Rules

If a value begins with a tilde (~), everything after the tilde is interpreted as a regex.
If the value does not begin with a tilde, it is interpreted as a string that must match exactly.

Examples

--include=aggr1 (exact match, check only the aggregate aggr1)

--include=~aggr1 (check only those aggregates, whose name contains the string aggr1)

--include=~^aggr1 (check only those aggregates, whose name starts with aggr1)

--exclude=~bak$ (do not check volumes, whose name ends with bak)

--include=~^\Qaggr1.tmp\E$ (check only the aggregates which start and end with aggr1.tmp, effectively this is the same as --include=aggr1.tmp)

More information about our monitoring plugin products can be found on our main page monitoring-plugins.pro/products.

What are Regular Expressions?

A regular expression is a special text string for describing a search pattern. You are probably familiar with wildcard notations such as *.txt to find all text files in a file manager. The regex equivalent is .*\.txt$

The following graphic explains each of this expressions components.

Regex for Nagios Plugins

The regex syntax offers thousands of different metacharacters. Below are the most important ones if you want to configure your monitoring system with our plugins.

Monitoring-Plugin’s most important regex notations

Dots (`.` vs `\.`)

The . (dot) is a wildcard. It matches any character. The most important thing is that you know how to write a normal, literal dot instead of the wildcard-dot.

The \. matches a literal dot only. This gets important, if an instance’s name uses dots to separate parts.

Dot Examples

--include=~^vsrv1\.

Checks volumes, which are on vserver vserv1 (but not on eg. vserv10 or vserv199).

Matching volume-names would be:

vsrv1.vol0
vsrv1.vol1
vsrv1.vol22
vsrv1.our-great-volume
vsrv1.someothervolume

--include=~^vsrv1. (without the backslash in front of the dot)

Checks volumes, which are on vserver vserv1 but also the ones whose vserver-name starts with vserv1 eg. vserv10 or vserv199.

Matching volume-names would be:

vsrv1.vol0
vsrv11.vol1
vsrv15.vol22
vsrv100.vol0
vsrv199.someothervolume
...

Anchors - begin and end of string (`^` and `$`)

You may have noticed the ^ in the examples above. They tell the regex-engine to match the following pattern only if the string starts with this pattern.

Anchoring Examples

--include=~vsrv1

No anchor at all: Checks volumes, which have vserv1 somewhere in their name.

Matching volume-names would be:

vsrv1.vol0
myvsrv1.vol1
other-vsrv1.vol22
vserv9.vol-vserv19bak
...

The above example, without any anchor, is most likely not useful in practice. It is mainly an example of how not to do it.

--include=~^vsrv1\.

We know this example already from the explanation on how to match a literal dot. This is a good example on how to successfully check instances on a single vserver only.

--exclude=~\.temp$

Checks any volume as long as they do not end with .temp.

Ignore Case

To match a string while ignoring the case of its letters, prefix (?i) to the pattern.

Example for ignoring the case

The regex pattern h?llo would match to the strings hello or hallo (and also h1llo, hhllo, …) but not Hello.

The regex pattern (?i)h?llo would match hello or hallo as well as Hello or Hallo (and many more like heLLo or HELLO).

Complex Examples

--include=~/^someaff300\.\*\.mycorp\.

This pattern will match any certificate name for the host someaff300 in any subdomain or any domain of mycorp. The trick here is that the asterisk (*) in the certificate name is already a wildcard, so you have to use it literally in the regex by escaping it with a backslash. The same goes for the dots in the certificate name.

Examples of matching strings (certificate names):

someaff300.*.mycorp.com_884C38B8836B84827A84EDE41D5234.someaff300
someaff300.*.mycorp.com_1234567890.someaff300
someaff300.*.mycorp.at_884C38B8836B84827A84EDE41D5234.someaff300