Invert Regex

[ecarrasq]

Linux Distribution and version? CentOS, 2.6.18-308.8.2.el5PAE
32 or 64bit? 32bit
VMware Image or Manual Install of XI? VMware Image
Are there specials configurations on your system, ie; is Gnome installed? No
Are you using a proxy? No
Are you using SSL? Yes
Nagios Version? Nagios XI 2012R1.8

Question:

I'm trying to monitor and alert when a phrase shows up on a web page that uses xml using check_http invert regex option; However, I do not know how to go about doing this.

We normally monitor and alert on web page content, so if a particular word is not found = alert. We would like to do the opposite, when if a certain word or phrase IS found, then alert.

I understand I can build it out with the "Website Wizard" in Xi, and then modify it in CCM, but I do not know syntax to use for the $ARG1. Looking to alert if the word "LEAD tools" is found.

Please help.

Thank you,
Eddie

[abrist]

Take a look at the check_http usage page: http://nagiosplugins.org/man/check_http
"--invert-regex" is what you are looking for. You will want to use a check that resembles:

Code: Select all

./check_http -H <hostname> -r "LEAD tools" --invert-regex

[ecarrasq]

I just tried that, but no matter what I put after -r "place text here" it returns "OK" even if the "place text here" is found.

[abrist]

What version of the plugins are you running? I tested this in my test environment and I get criticals if the pattern is matched. It is case sensitive though.

Code: Select all

./check_http -V

Also, try it from the cli first.

[ecarrasq]

check_http v2053 (nagios-plugins 1.4.13)

I just re-tested it on:

./check_http -H http://www.nagios.com -r javascript --invert-regex
HTTP CRITICAL - pattern found|time=0.957482s;;;0.000000 size=44648B;;;0

and that worked just fine....

I got it to work!

I placed the -r "insert text here" --invert-regex at the very end of the check_http line and it worked!!!!! I was using:

-f ok -I <IP> -u "specific url&mode=XML" -p 80 -r "LEAD" --invert-regex <-- I tested this with a known word, and it returned "HTTP CRITICAL - pattern found"

THANK YOU!!!!!!!!!
Eddie

[abrist]

Fantastic. Locking thread with immutable delight.