System monitoring regular expression

[ArielRauch]

Hi,
I have connected Nagios to OTRS via the system monitoring module without any problems.
Now I have another input source and I would like to use the "before postmaster" filter for it. It works, but I have some problems with the regular expression. Perhaps someone can help me out:
The relevant sentence in the source is either:
Webmetrics Connectivity Alert for KloutAPIProxy and more stuff (=> here I need to look for "Alert for" and filter out "KloutAPIProxy " for the service.)
The closing message is:
Webmetrics OK for KloutAPIProxy and more stuff (=> here I need to look for "OK for" and filter out "KloutAPIProxy " for the service.)

I need ONE regexp that filters out the service for both cases

The State will be of course either Alert or OK.

Some regexp expert to help me?

Thanks

Ariel

[crythias]

Not quite sure if I am followin well, but this might work
Match: Webmetrics Connectivity Alert for (KloutAPIProxy|Queue2|Queue3)
Set: X-OTRS-Queue: [***]

Match: Webmetrics OK for (KloutAPIProxy|Queue2|Queue3)
Set: X-OTRS-Queue: [***]

You probably don't want to try to do something like (\w+) because it's possible you might have queues that don't match spelling, case, etc.
http://regexpal.com/

[ArielRauch]

Sorry my fault, I was not clear at all.
The service name is not always the same and I need him for the service field.
This can be easily achieved by putting him into round brackets. The state (alert or ok) which is the word before "for" must be also in round brackets (alert|ok) but the it will be selected instead of the service name.
Notvsure that this time I was clearer but I give it a try.
Thanks for the patience with me.

Ariel

[crythias]

Why do you need one regex? What does "before postmaster" mean? Are you creating your own PostMaster Filter as a file?

[ArielRauch]

ok - I'll explain:
I am using the system monitoring module for Nagios. for this purpose I am using the "before postmaster filter" option.
In addition I have a customer where I need to poll a mailbox. As it works very similar to Nagios I thought I will "misuse" the "before postmaster filter" option in the system monitoring module for this.
In fact I already made it work nut the regular expression I used are not very strong. Actually I was looking for a solution where I can use the round brackets twise and decide which one shall be returned.

I know it is not very clear but I hope you understand.

Thanks again,

Ariel

[Wolfgangf]

The relevant sentence in the source is either:
Webmetrics Connectivity Alert for KloutAPIProxy and more stuff (=> here I need to look for "Alert for" and filter out "KloutAPIProxy " for the service.)
The closing message is:
Webmetrics OK for KloutAPIProxy and more stuff (=> here I need to look for "OK for" and filter out "KloutAPIProxy " for the service.)

I need ONE regexp that filters out the service for both cases

could thisone help?

Code: Select all

.*(Alert|OK) for\s*(\w*).*

[ArielRauch]

Wouldn't this one return alert or ok instead of the service?

[Wolfgangf]

did you try? I assume the Service will be returned