[Check_mk (english)] Windows service discovery -- regexp issue

Archive checkmk-en
1

Hi guys.

I set some services to being discovered from windows hosts.

The thing is that… i have 20 services that starts with the same word.

Example:

Service one

Service two

Service three

Service four
…

and so on

Now, i want to discover all but, say, “Service four”.

How i do that?

Already tried --> wato --> host and service parameters --> windows service discovery --> services (regular expressiones) -->
field: !Service four
another field: Service*

Not working!

Anyone?

Thanks!

Discover every windows service except some
2

Hi Gerardo,

untested (currently no CMK to work on here), but you could try this field entry (including all braces):

(Service (?!four))

…this should match only “begin with Service” and “four must not follow”.

We use this in ignored_services e.g. to ignore all LOG services but “System” and “Application”:

(LOG (?!(System|Application)))

HTH,

Marcel

···

Gerardo Ferreyra raptorg83@gmail.com schrieb am Do., 17. Sep. 2015 um 01:04 Uhr:

Hi guys.

I set some services to being discovered from windows hosts.

The thing is that… i have 20 services that starts with the same word.

Example:

Service one

Service two

Service three

Service four
…

and so on

Now, i want to discover all but, say, “Service four”.

How i do that?

Already tried → wato → host and service parameters → windows service discovery → services (regular expressiones) →
field: !Service four
another field: Service*

Not working!

Anyone?

Thanks!

checkmk-en mailing list

checkmk-en@lists.mathias-kettner.de

http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en

We’ll meet in Munich for the 2nd Check_MK Conference!

Book your place now and be part of it.

October 18th-20th, 2015

http://mathias-kettner.com/conference

3

Awesome Marcel. It worked!

Thanks!!

···

2015-09-16 22:47 GMT-03:00 Marcel Schulte schulte.marcel@gmail.com:

Hi Gerardo,

untested (currently no CMK to work on here), but you could try this field entry (including all braces):

(Service (?!four))

…this should match only “begin with Service” and “four must not follow”.

We use this in ignored_services e.g. to ignore all LOG services but “System” and “Application”:

(LOG (?!(System|Application)))

HTH,

Marcel

Gerardo Ferreyra raptorg83@gmail.com schrieb am Do., 17. Sep. 2015 um 01:04 Uhr:

Hi guys.

I set some services to being discovered from windows hosts.

The thing is that… i have 20 services that starts with the same word.

Example:

Service one

Service two

Service three

Service four
…

and so on

Now, i want to discover all but, say, “Service four”.

How i do that?

Already tried → wato → host and service parameters → windows service discovery → services (regular expressiones) →
field: !Service four
another field: Service*

Not working!

Anyone?

Thanks!

checkmk-en mailing list

checkmk-en@lists.mathias-kettner.de

http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en

We’ll meet in Munich for the 2nd Check_MK Conference!

Book your place now and be part of it.

October 18th-20th, 2015

http://mathias-kettner.com/conference

4

Great! Have a nice day!

···

2015-09-16 22:47 GMT-03:00 Marcel Schulte schulte.marcel@gmail.com:

Hi Gerardo,

untested (currently no CMK to work on here), but you could try this field entry (including all braces):

(Service (?!four))

…this should match only “begin with Service” and “four must not follow”.

We use this in ignored_services e.g. to ignore all LOG services but “System” and “Application”:

(LOG (?!(System|Application)))

HTH,

Marcel

Gerardo Ferreyra raptorg83@gmail.com schrieb am Do., 17. Sep. 2015 um 01:04 Uhr:

Hi guys.

I set some services to being discovered from windows hosts.

The thing is that… i have 20 services that starts with the same word.

Example:

Service one

Service two

Service three

Service four
…

and so on

Now, i want to discover all but, say, “Service four”.

How i do that?

Already tried → wato → host and service parameters → windows service discovery → services (regular expressiones) →
field: !Service four
another field: Service*

Not working!

Anyone?

Thanks!

checkmk-en mailing list

checkmk-en@lists.mathias-kettner.de

http://lists.mathias-kettner.de/mailman/listinfo/checkmk-en

We’ll meet in Munich for the 2nd Check_MK Conference!

Book your place now and be part of it.

October 18th-20th, 2015

http://mathias-kettner.com/conference

5

The generic answer is:
Write a Regular Expression that matches the ones you want and not
the ones you don’t want. (NOT Windows wildcards)
If you can’t come up with a single RE that does what you want, break
the problem down into two or more
rules that do what you want.

see:���� or more generally:����� As Marcel said, in your specifc example, you could use the following

RE:
�e
using the Logfile Pattern Analyzer and verified that it worked as
desired.
(WATO->Main Menu->Logfile Pattern Analyzer)

···

http://www.rexegg.com/regex-quickstart.html

http://bfy.tw/1plG

`service\s+?(one|two|three)

  Being generally lazy, I added that pattern to a test logfile rul`

  On 9/16/2015 6:55 PM, Gerardo Ferreyra

wrote:

Hi guys.

                              I set some services to being

discovered from windows hosts.

                            The thing is that... i have 20 services

that starts with the same word.

Example:

Service one

Service two

Service three

Service four

                  ...

and so on

Now, i want to discover all but, say, “Service four”.

How i do that?

          Already tried --> wato --> host and service

parameters → windows service discovery →
services� (regular expressiones) →
field: !Service four
another field: Service*

        Not working!

Anyone?

Thanks!




_______________________________________________
checkmk-en mailing list
We�ll meet in Munich for the 2nd Check_MK Conference!
Book your place now and be part of it.
October 18th-20th, 2015

checkmk-en@lists.mathias-kettner.dehttp://lists.mathias-kettner.de/mailman/listinfo/checkmk-enhttp://mathias-kettner.com/conference