This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.

You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

SmartGroup using negated RegEx

simonpt over 15 years ago

I want to create a scheduled email report publisher which gives the network uptime of our critical infrastructure (namely servers and routers). To do this I figure I need to create a SmartGroup that includes only the ping monitors of these devices. That's because I don't want pesky bandwidth/disk/memory monitors that go "down" to affect the uptime stats.

I've started creating a SmartGroup as follows:

SmartGroup contains: Monitors
Start with: No Monitors
Add monitors where property Device Type matches regular expression \i(router|server)
Remove monitors where property Type matches regular expression [insert expression here]

This is where I need an expression that removes all monitors except 'ping' monitors. Does anyone know how to negate the expression \i(ping)? My searches on the topic have shown that regular expressions don't allow you to negate a whole word (only a single character class). I've tried a few alternative suggestions but none give the desired result.

Or does someone have a completely different way of achieving the same result?

Thanks - Simon

0 chris.lapoint over 15 years ago

Simon, since you're starting this SmartGroup with "No Monitors", you should only have to add the Ping monitors to the SmartGroup to have the desired effect (versus using a "remove" clause).
Cancel
Vote Up 0 Vote Down

Cancel
0 simonpt over 15 years ago in reply to chris.lapoint

Hi Chris

Thanks for your reply.

The problem I'm encountering is that I only want to include router/server ping monitors, eg, (device type = router OR server) AND monitor type = ping. With the way the SmartGroup logic works, when I add 'device type = router|server', I get all the monitors for these devices so I then need to remove everything except the ping monitors, hence the request for negating the ping regex. You get the same problem if you start with nothing and add 'monitor type = ping' -- you then need to remove all monitors for devices other than routers and servers.

Does this make sense?

I think SmartGroups would work better if you could use standard and/or conditionals, rather than it's current approach of starting with nothing/everything and then adding/removing. As this example shows, there are times when you can't get the result you want.

Rgds, Simon
Cancel
Vote Up 0 Vote Down

Cancel

0 Peter.Cooper over 15 years ago in reply to simonpt

Hi Simon, you can import this SmartGroup as is. It adds ping monitors, then removes anything that doesn't belong to a router or server. Import is: Configuration Tab > Server Settings > Import Settings > Cut and paste from XML.

<group>
 <typeid>3899979</typeid>
 <nv>
 <ui>
 <name>Ping Monitors from Routers &amp; Switches</name>
 </ui>
 </nv>
 <ignore>
 <u0>
 <kind>4</kind>
 </u0>
 <u1>
 <kind>4</kind>
 </u1>
 </ignore>
 <col/>
 <depends/>
 <devices>false</devices>
 <start>empty</start>
 <constraints>
 <u0>
 <mode>5</mode>
 <name>type</name>
 <regex>^ping$</regex>
 </u0>
 <u1>
 <mode>4</mode>
 <name>device.type</name>
 <regex>^(?!hub_sw|server)</regex>
 </u1>
 </constraints>
</group>

0 simonpt over 15 years ago in reply to Peter.Cooper

Hi Peter

That's fanastic! I just needed to change 'hub_sw' to 'router' and it worked perfectly. Thanks very much.

Do you have a good regex guide you would recommend? I'm familiar with Perl regexs but these ones are quite different.

Thanks - Simon
Cancel
Vote Up 0 Vote Down

Cancel
0 Peter.Cooper over 15 years ago in reply to simonpt

Hello Simon, I have a treat for you!
Download Espresso:
www.ultrapico.com/expresso.htm
They have a tutorial in there that's pretty good. Also, free software to help test this stuff out.
In the tutorial it explains the "(?!)" syntax, which means: fail if you find this stuff at this spot. ipMonitor has its own regular expression engine, as its not written in .NET. It's pretty faithful to Perl's modern regex rules (minus running perl code for conditionals). For the most part, rules built in Espresso should work in ipMonitor, as long as you don't use named captures.
Cancel
Vote Up 0 Vote Down

Cancel
0 simonpt over 15 years ago in reply to Peter.Cooper

Hi Peter

Wow. That certainly takes the guesswork out of regexs.

Thanks very much.

Simon
Cancel
Vote Up 0 Vote Down

Cancel
0 ChrisR99 over 14 years ago in reply to simonpt

Bump!
I have this problem and cannot find the solution. I also want to remove monitors that dont match a certain string, thereby leaving only those ones behind. The problem is I need to match on a small subsection of the display name string, how can I do this?
I have tried to no avail with Expresso using for example: \i^.*?(?!Tyburn\.EU).*?$
Thanks!
Cancel
Vote Up 0 Vote Down

Cancel
0 Peter.Cooper over 14 years ago in reply to ChrisR99

The problem with a zero-width negative assertion is that you really need something that always appears next to it... otherwise it will match when you don't mean to.
You say "remove monitors that don't match a certain string". I translate this to mean "include only monitors that match a certain string". To do that, I'd start with "empty" instead of "All Monitors", then add monitors that have Tyburn.EU in them. Then subsequent rules work towards removing monitors from this list.
Cancel
Vote Up 0 Vote Down

Cancel
0 ejensen over 14 years ago in reply to Peter.Cooper

here is another regex tool, this one is web based or a desktop version based on adobe air.
http://gskinner.com/RegExr/
Cancel
Vote Up 0 Vote Down

Cancel