PCRE reference with examples

13 messages in this thread

list Rich Smrcina · Wed, 12 Oct 2005 22:14:14 -0500 ·

Is there an online reference for PCRE available, including examples? 
I'm having difficulty setting up alerts and I clearly need help with PCRE.

Thanks.
-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Henrik Størner · Thu, 13 Oct 2005 07:49:33 +0200 ·

▸ quoted from Rich Smrcina

On Wed, Oct 12, 2005 at 10:14:14PM -0500, Rich Smrcina wrote:

Is there an online reference for PCRE available, including examples? 
I'm having difficulty setting up alerts and I clearly need help with PCRE.

I did a google on "regular expression tutorial" and came up with this:

http://www.regular-expressions.info/tutorial.html

It isn't specific to PCRE, but PCRE implements the regex flavor found
in Perl, so it should get you going.

Also, for trying out your regexes there's the "pcretest" utility which
comes with the PCRE library. It lets you input your regex and try it out
against selected candidate strings:

henrik at osiris:~$ pcretest
PCRE version 4.5 01-December-2003

  re> /(www|mail|ns).foo.com/
  data> ns.foo.com
   0: ns.foo.com
    1: ns
    data> print.foo.com
    No match


Note that you must put the regex inside slashes when entering it
into pcretest (it supports multi-line regexes - Hobbit doesn't).


Henrik

list Rob MacGregor · Thu, 13 Oct 2005 07:22:15 +0100 ·

▸ quoted from Rich Smrcina

On 13/10/05, Rich Smrcina <user-cf452ff334e0@xymon.invalid> wrote:

Is there an online reference for PCRE available, including examples?
I'm having difficulty setting up alerts and I clearly need help with PCRE.

As linked from the top page of www.pcre.org :)

http://perldoc.perl.org/perlre.html

--
                 Please keep list traffic on the list.
Rob MacGregor
      Whoever fights monsters should see to it that in the process he
        doesn't become a monster.                  Friedrich Nietzsche

list Rich Smrcina · Thu, 13 Oct 2005 10:50:26 -0500 ·

Ok, that's great info.  Thanks!

Based on that I'm ending up with an expression like:

HOST=$va[\d\w]*$

To match any host beginning with 'va' that has zero or more alphanumeric characters after it.  Is there an easier way to write this?  If not that's fine, I just want to make sure I'm using it correctly.

Another poster (Asif Iqbal) posted the MAIL directives with multiple recipients.  Does that work like he posted?  Can the multiple email recipients be put into a macro?  Consider the following:

$pg-tom=(user-09601a56c098@xymon.invalid|user-caed2b630f14@xymon.invalid)
HOST=tomshost
	MAIL $pg-tom DURATION=5m COLOR=red

▸ quoted from Henrik Størner


Henrik Stoerner wrote:

On Wed, Oct 12, 2005 at 10:14:14PM -0500, Rich Smrcina wrote:

Is there an online reference for PCRE available, including examples? I'm having difficulty setting up alerts and I clearly need help with PCRE.


I did a google on "regular expression tutorial" and came up with this:

http://www.regular-expressions.info/tutorial.html

It isn't specific to PCRE, but PCRE implements the regex flavor found
in Perl, so it should get you going.

Also, for trying out your regexes there's the "pcretest" utility which
comes with the PCRE library. It lets you input your regex and try it out
against selected candidate strings:

henrik at osiris:~$ pcretest
PCRE version 4.5 01-December-2003

  re> /(www|mail|ns).foo.com/
  data> ns.foo.com
   0: ns.foo.com
    1: ns
    data> print.foo.com
    No match


Note that you must put the regex inside slashes when entering it
into pcretest (it supports multi-line regexes - Hobbit doesn't).


Henrik

-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Henrik Størner · Thu, 13 Oct 2005 18:02:17 +0200 ·

▸ quoted from Rich Smrcina

On Thu, Oct 13, 2005 at 10:50:26AM -0500, Rich Smrcina wrote:

Ok, that's great info.  Thanks!

Based on that I'm ending up with an expression like:

HOST=$va[\d\w]*$

To match any host beginning with 'va' that has zero or more alphanumeric 
characters after it.  Is there an easier way to write this?  If not 
that's fine, I just want to make sure I'm using it correctly.

I'd say
  HOST=%^va[\d]*$

You need the "%" first, to tell Hobbit that what comes next is a regexp.
Then the "^" means that the expression must match at the beginning of
the string. "\w" is whitespace ? Think so - in that case it is not
needed, since Hobbit will never match with any whitepace in the
hostname.

▸ quoted from Rich Smrcina

Another poster (Asif Iqbal) posted the MAIL directives with multiple 
recipients.  Does that work like he posted?  Can the multiple email 
recipients be put into a macro?  Consider the following:

$pg-tom=(user-09601a56c098@xymon.invalid|user-caed2b630f14@xymon.invalid)
HOST=tomshost
	MAIL $pg-tom DURATION=5m COLOR=red

What comes after the MAIL keyword is passed directly to your "mail"
utility. So it would probably be better to have

   $pg-tom=user-09601a56c098@xymon.invalid,user-caed2b630f14@xymon.invalid

if your "mail" tool supports listing multiple recipients separated by
commas. Some dont - then you can use a short-hand notation like:

   $pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

and separate them by spaces - Hobbit will handle this as if you had
multiple "MAIL ..." lines with each of the mail recipients. So it sends
out the mail in separate e-mails, instead of one e-mail to all of the
recipients. (Same net effect).


One more thing: I'm sure "DURATION=5m" is not what you want. Make that
"DURATION>5m".


Regards,
Henrik

list Dan Vande More · Thu, 13 Oct 2005 11:03:22 -0500 ·

You'll probably be better off with:

HOST=^va.*$

(Note the caret instead of the dollar sign.)

-Dan

▸ quoted from Rich Smrcina


On 10/13/05, Rich Smrcina <user-cf452ff334e0@xymon.invalid> wrote:

Ok, that's great info.  Thanks!

Based on that I'm ending up with an expression like:

HOST=$va[\d\w]*$

To match any host beginning with 'va' that has zero or more alphanumeric
characters after it.  Is there an easier way to write this?  If not
that's fine, I just want to make sure I'm using it correctly.

Another poster (Asif Iqbal) posted the MAIL directives with multiple
recipients.  Does that work like he posted?  Can the multiple email
recipients be put into a macro?  Consider the following:

$pg-tom=(user-09601a56c098@xymon.invalid|user-caed2b630f14@xymon.invalid)
HOST=tomshost
        MAIL $pg-tom DURATION=5m COLOR=red

Henrik Stoerner wrote:

On Wed, Oct 12, 2005 at 10:14:14PM -0500, Rich Smrcina wrote:

Is there an online reference for PCRE available, including examples?
I'm having difficulty setting up alerts and I clearly need help with PCRE.


I did a google on "regular expression tutorial" and came up with this:

http://www.regular-expressions.info/tutorial.html

It isn't specific to PCRE, but PCRE implements the regex flavor found
in Perl, so it should get you going.

Also, for trying out your regexes there's the "pcretest" utility which
comes with the PCRE library. It lets you input your regex and try it out
against selected candidate strings:

henrik at osiris:~$ pcretest
PCRE version 4.5 01-December-2003

  re> /(www|mail|ns).foo.com/
  data> ns.foo.com
   0: ns.foo.com
    1: ns
    data> print.foo.com
    No match


Note that you must put the regex inside slashes when entering it
into pcretest (it supports multi-line regexes - Hobbit doesn't).


Henrik

--
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Larry Barber · Thu, 13 Oct 2005 12:17:50 -0400 (EDT) ·

No \s is typically used to indicate whitespace in regexp's. \w usually
matches alphanumeric characters and the underscore character, hence Rich
probably wants something like:

HOST=%^va\w*

% - required by Hobbit to indicate the start of a regexp
^ - start of line character
\w - matches any alphanumeric/underscore character
* - 0 or more \w's

You can add a $ to the end of the line, but it won't change anything
since the * will grab all the characters to the end of the line anyway,
assuming that they are all alphanumeric and that Hobbit strips off all
the leading and trailing whitespace.

Thanks,
Larry Barber

▸ quoted from Henrik Størner


On Thu, 2005-10-13 at 11:02 -0500, user-ce4a2c883f75@xymon.invalid wrote:

On Thu, Oct 13, 2005 at 10:50:26AM -0500, Rich Smrcina wrote: > Ok, that's great info.  Thanks! >  > Based on that I'm ending up with an expression like: >  > HOST=$va[\d\w]*$ >  > To match any host beginning with 'va' that has zero or more
alphanumeric  > characters after it.  Is there an easier way to write this?  If
not  > that's fine, I just want to make sure I'm using it correctly.

I'd say   HOST=%^va[\d]*$

You need the "%" first, to tell Hobbit that what comes next is a
regexp. Then the "^" means that the expression must match at the beginning of the string. "\w" is whitespace ? Think so - in that case it is not needed, since Hobbit will never match with any whitepace in the hostname.

Another poster (Asif Iqbal) posted the MAIL directives with
multiple  > recipients.  Does that work like he posted?  Can the multiple
email  > recipients be put into a macro?  Consider the following: >  > $pg-tom=(user-09601a56c098@xymon.invalid|user-caed2b630f14@xymon.invalid) > HOST=tomshost >       MAIL $pg-tom DURATION=5m COLOR=red

What comes after the MAIL keyword is passed directly to your "mail" utility. So it would probably be better to have

   $pg-tom=user-09601a56c098@xymon.invalid,user-caed2b630f14@xymon.invalid

if your "mail" tool supports listing multiple recipients separated by commas. Some dont - then you can use a short-hand notation like:

   $pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

and separate them by spaces - Hobbit will handle this as if you had multiple "MAIL ..." lines with each of the mail recipients. So it
sends out the mail in separate e-mails, instead of one e-mail to all of the recipients. (Same net effect).


One more thing: I'm sure "DURATION=5m" is not what you want. Make
that "DURATION>5m".


Regards, Henrik

list Rich Smrcina · Thu, 13 Oct 2005 14:32:14 -0500 ·

▸ quoted from Larry Barber

Henrik Stoerner wrote:


I'd say
  HOST=%^va[\d]*$

You need the "%" first, to tell Hobbit that what comes next is a regexp.
Then the "^" means that the expression must match at the beginning of
the string. "\w" is whitespace ? Think so - in that case it is not
needed, since Hobbit will never match with any whitepace in the
hostname.

Based on the tutorial, \w is a word character (usually letters, 
underscores).  Good tip about beginning of string.

▸ quoted from Larry Barber

What comes after the MAIL keyword is passed directly to your "mail"
utility. So it would probably be better to have

   $pg-tom=user-09601a56c098@xymon.invalid,user-caed2b630f14@xymon.invalid

if your "mail" tool supports listing multiple recipients separated by
commas. Some dont - then you can use a short-hand notation like:

   $pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

and separate them by spaces - Hobbit will handle this as if you had
multiple "MAIL ..." lines with each of the mail recipients. So it sends
out the mail in separate e-mails, instead of one e-mail to all of the
recipients. (Same net effect).

Then is the syntax for using macros in the MAIL line the same as HOST:

$pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

HOST %^va.*$
	MAIL=%$pg-tom

When I run this through 'bbcmd hobbitd-alert --test' I get two lines 
that look like this:

00008432 2005-10-13 14:30:06 Failed 'MAIL %$pg-tom 
DURATION>5 COLOR=red' (min. duration 0<300)

I would have expected the actual email addresses...

▸ quoted from Larry Barber

One more thing: I'm sure "DURATION=5m" is not what you want. Make that
"DURATION>5m".

Correct, I typed it into the message incorrectly.

▸ quoted from Dan Vande More


Thanks.
-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Rich Smrcina · Thu, 13 Oct 2005 14:33:21 -0500 ·

Thanks Larry, Dan and Henrik!

▸ quoted from Larry Barber


user-7a6c75d6cc10@xymon.invalid wrote:

No \s is typically used to indicate whitespace in regexp's. \w usually
matches alphanumeric characters and the underscore character, hence Rich
probably wants something like:

HOST=%^va\w*

% - required by Hobbit to indicate the start of a regexp
^ - start of line character
\w - matches any alphanumeric/underscore character
* - 0 or more \w's

You can add a $ to the end of the line, but it won't change anything
since the * will grab all the characters to the end of the line anyway,
assuming that they are all alphanumeric and that Hobbit strips off all
the leading and trailing whitespace.

Thanks,
Larry Barber

On Thu, 2005-10-13 at 11:02 -0500, user-ce4a2c883f75@xymon.invalid wrote:

On Thu, Oct 13, 2005 at 10:50:26AM -0500, Rich Smrcina wrote:

Ok, that's great info.  Thanks! 
Based on that I'm ending up with an expression like: 
HOST=$va[\d\w]*$ 
To match any host beginning with 'va' that has zero or more

alphanumeric

characters after it.  Is there an easier way to write this?  If

not

that's fine, I just want to make sure I'm using it correctly.

I'd say  HOST=%^va[\d]*$

You need the "%" first, to tell Hobbit that what comes next is a
regexp. Then the "^" means that the expression must match at the beginning of the string. "\w" is whitespace ? Think so - in that case it is not needed, since Hobbit will never match with any whitepace in the hostname.

Another poster (Asif Iqbal) posted the MAIL directives with

multiple

recipients.  Does that work like he posted?  Can the multiple

email

recipients be put into a macro?  Consider the following: 
$pg-tom=(user-09601a56c098@xymon.invalid|user-caed2b630f14@xymon.invalid) HOST=tomshost      MAIL $pg-tom DURATION=5m COLOR=red

What comes after the MAIL keyword is passed directly to your "mail" utility. So it would probably be better to have

  $pg-tom=user-09601a56c098@xymon.invalid,user-caed2b630f14@xymon.invalid

if your "mail" tool supports listing multiple recipients separated by commas. Some dont - then you can use a short-hand notation like:

  $pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

and separate them by spaces - Hobbit will handle this as if you had multiple "MAIL ..." lines with each of the mail recipients. So it
sends out the mail in separate e-mails, instead of one e-mail to all of the recipients. (Same net effect).


One more thing: I'm sure "DURATION=5m" is not what you want. Make
that "DURATION>5m".


Regards, Henrik

-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Henrik Størner · Thu, 13 Oct 2005 21:56:53 +0200 ·

▸ quoted from Rich Smrcina

On Thu, Oct 13, 2005 at 02:32:14PM -0500, Rich Smrcina wrote:

What comes after the MAIL keyword is passed directly to your "mail"
utility. So it would probably be better to have

  $pg-tom=user-09601a56c098@xymon.invalid,user-caed2b630f14@xymon.invalid

if your "mail" tool supports listing multiple recipients separated by
commas. Some dont - then you can use a short-hand notation like:

  $pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

and separate them by spaces - Hobbit will handle this as if you had
multiple "MAIL ..." lines with each of the mail recipients. So it sends
out the mail in separate e-mails, instead of one e-mail to all of the
recipients. (Same net effect).

Then is the syntax for using macros in the MAIL line the same as HOST:

$pg-tom=user-09601a56c098@xymon.invalid user-caed2b630f14@xymon.invalid

HOST %^va.*$
	MAIL=%$pg-tom

No, just 
        MAIL $pg-tom


Henrik

list Rich Smrcina · Thu, 13 Oct 2005 15:02:14 -0500 ·

That produces two lines that look like this:

00008432 2005-10-13 14:30:06 Failed 'MAIL $pg-tom DURATION>5 COLOR=red' (min. duration 0<300)

Shouldn't the individual email addresses appear in place of $pg-tom?

Henrik Stoerner wrote:


No, just         MAIL $pg-tom

▸ quoted from Rich Smrcina



Henrik

-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

list Henrik Størner · Thu, 13 Oct 2005 22:13:50 +0200 ·

▸ quoted from Rich Smrcina

On Thu, Oct 13, 2005 at 03:02:14PM -0500, Rich Smrcina wrote:

That produces two lines that look like this:

00008432 2005-10-13 14:30:06 Failed 'MAIL $pg-tom DURATION>5 COLOR=red' 
(min. duration 0<300)

Oops You're right - the test option doesn't show the expanded macros.
Try the --dump-config instead:

$ bbcmd hobbitd_alert --dump-config
2005-10-13 22:09:02 Using default environment file /usr/lib/hobbit/server/etc/hobbitserver.cfg

HOST=%^va.*
	MAIL user-09601a56c098@xymon.invalid FORMAT=TEXT REPEAT=30
	MAIL user-caed2b630f14@xymon.invalid FORMAT=TEXT REPEAT=30


Regards,
Henrik

list Rich Smrcina · Thu, 13 Oct 2005 15:21:25 -0500 ·

Good show, that looks better.  Thanks!

▸ quoted from Henrik Størner


Henrik Stoerner wrote:

On Thu, Oct 13, 2005 at 03:02:14PM -0500, Rich Smrcina wrote:

That produces two lines that look like this:

00008432 2005-10-13 14:30:06 Failed 'MAIL $pg-tom DURATION>5 COLOR=red' (min. duration 0<300)


Oops You're right - the test option doesn't show the expanded macros.
Try the --dump-config instead:

$ bbcmd hobbitd_alert --dump-config
2005-10-13 22:09:02 Using default environment file /usr/lib/hobbit/server/etc/hobbitserver.cfg

HOST=%^va.*
	MAIL user-09601a56c098@xymon.invalid FORMAT=TEXT REPEAT=30
	MAIL user-caed2b630f14@xymon.invalid FORMAT=TEXT REPEAT=30


Regards,
Henrik

-- 
Rich Smrcina
VM Assist, Inc.
Main: (262)392-2026
Cell: (XXX)XXX-XXXX
Ans Service:  (360)715-2467
user-61add9955ef9@xymon.invalid

Catch the WAVV!  http://www.wavv.org
WAVV 2006 - Chattanooga, TN - April 7-11, 2006

PCRE reference with examples 🔗 link

PCRE reference with examples