Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 11

SmartGroup using negated RegEx

I want to create a scheduled email report publisher which gives the network uptime of our critical infrastructure (namely servers and routers).  To do this I figure I need to create a SmartGroup that includes only the ping monitors of these devices.  That's because I don't want pesky bandwidth/disk/memory monitors that go "down" to affect the uptime stats.

I've started creating a SmartGroup as follows:

SmartGroup contains: Monitors
Start with: No Monitors
Add monitors where property Device Type matches regular expression \i(router|server)
Remove monitors where property Type matches regular expression [insert expression here]

This is where I need an expression that removes all monitors except 'ping' monitors.  Does anyone know how to negate the expression \i(ping)?  My searches on the topic have shown that regular expressions don't allow you to negate a whole word (only a single character class).  I've tried a few alternative suggestions but none give the desired result.

Or does someone have a completely different way of achieving the same result?

Thanks - Simon

0 Kudos
9 Replies
Level 18

Simon, since you're starting this SmartGroup with "No Monitors", you should only have to add the Ping monitors to the SmartGroup to have the desired effect (versus using a "remove" clause).

0 Kudos

Hi Chris

Thanks for your reply. 

The problem I'm encountering is that I only want to include router/server ping monitors, eg, (device type = router OR server) AND monitor type = ping.  With the way the SmartGroup logic works, when I add 'device type = router|server', I get all the monitors for these devices so I then need to remove everything except the ping monitors, hence the request for negating the ping regex.  You get the same problem if you start with nothing and add 'monitor type = ping' -- you then need to remove all monitors for devices other than routers and servers.

Does this make sense?

I think SmartGroups would work better if you could use standard and/or conditionals, rather than it's current approach of starting with nothing/everything and then adding/removing.  As this example shows, there are times when you can't get the result you want.

Rgds, Simon

0 Kudos

Hi Simon, you can import this SmartGroup as is. It adds ping monitors, then removes anything that doesn't belong to a router or server. Import is: Configuration Tab > Server Settings > Import Settings > Cut and paste from XML.

<name>Ping Monitors from Routers &amp; Switches</name>


0 Kudos

Hi Peter

That's fanastic!  I just needed to change 'hub_sw' to 'router' and it worked perfectly.  Thanks very much.

Do you have a good regex guide you would recommend?  I'm familiar with Perl regexs but these ones are quite different.

Thanks - Simon

0 Kudos

Hello Simon, I have a treat for you!

Download Espresso:

They have a tutorial in there that's pretty good. Also, free software to help test this stuff out.

In the tutorial it explains the "(?!)" syntax, which means: fail if you find this stuff at this spot. ipMonitor has its own regular expression engine, as its not written in .NET. It's pretty faithful to Perl's modern regex rules (minus running perl code for conditionals). For the most part, rules built in Espresso should work in ipMonitor, as long as you don't use named captures.

0 Kudos

Hi Peter

Wow.  That certainly takes the guesswork out of regexs.

Thanks very much.


0 Kudos


I have this problem and cannot find the solution. I also want to remove monitors that dont match a certain string, thereby leaving only those ones behind. The problem is I need to match on a small subsection of the display name string, how can I do this?

I have tried to no avail with Expresso using for example: \i^.*?(?!Tyburn\.EU).*?$


0 Kudos

The problem with a zero-width negative assertion is that you really need something that always appears next to it... otherwise it will match when you don't mean to.

You say "remove monitors that don't match a certain string". I translate this to mean "include only monitors that match a certain string". To do that, I'd start with "empty" instead of "All Monitors", then add monitors that have Tyburn.EU in them. Then subsequent rules work towards removing monitors from this list.


0 Kudos

here is another regex tool, this one is web based or a desktop version based on adobe air.

0 Kudos