CODEWITHSUNDEEP
regexlinuxmonit
Akshat
Akshat

Reputation: 45

Despite trying posix regex, getting this error in monit

I have this monit syntax,

check file access_log_1 with path /app/DNIF_logs/access_log_1
        ignore content = ".*favicon.*"
        if content = "^([:digit:]{1,3}\.){3}[:digit:]{1,3}[:space:]((((([:digit:]{1,3}\.){3}[:digit:]{1,3})|\-)[:space:]([:digit:]{6,7}|\-)[:space:][-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&=]*)[:space:])|)-[:space:]-[:space:]\[[:digit:]{2}\/([A-Z]|[a-z]){3}\/[:digit:]{4}\:[:digit:]{2}\:[:digit:]{2}\:[:digit:]{2}[:space:]\+[:digit:]{4}\][:space:]\"(.*)\"[:space:](500|502|503)([:digit:]|[:space:])*\"https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&\/\/=]*)\"(.*)" then alert

While running this monit I'm getting this error

/monitrc:40: syntax error '.*'

I tried removing the first .* and got

monitrc:41: syntax error '"[:space:](500|502|503)([:digit:]|[:space:])*\"'

so got to know error is at the first occurance of (.*) As per the answer here, we've to use posix regex syntax. Is there a different posix syntax for .* or what should I do?

Upvotes: 1

Views: 102

Answers (1)

Wiktor Stribiżew
Wiktor Stribiżew

Reputation: 627126

In POSIX ERE,

  • Bare POSIX character classes are not allowed, you should always use them inside bracket expressions (i.e. square brackets)
  • Note [[:digit:]] is the same as [0-9]
  • Inside bracket expressions, you can't use regex escapes, all literal backslashes are treated as literal backslash matching patterns
  • \b is not recognized, but you can usually use \< as a starting and \> as a trailing word boundaries
  • To use double quotes in the regex, use single quotes to delimit the regex string.

You may fix the regex like

if content = '^([0-9]{1,3}\.){3}[0-9]{1,3}[[:space:]]((((([0-9]{1,3}\.){3}[0-9]{1,3})|-)[[:space:]]([0-9]{6,7}|-)[[:space:]][-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\>([-a-zA-Z0-9()@:%_+.~#?&=]*)[[:space:]])|)-[[:space:]]-[[:space:]]\[[0-9]{2}/[[:alpha:]]{3}/[0-9]{4}:[0-9]{2}:[0-9]{2}:[0-9]{2}[[:space:]]\+[0-9]{4}][[:space:]]"(.*)"[[:space:]](500|502|503)[0-9[:space:]]*"https?://(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\>([-a-zA-Z0-9()@:%_+.~#?&/=]*)"(.*)' then alert

Note:

  • ([A-Z]|[a-z])* is better written as just [[:alpha:]]* (any zero or more letters
  • ([0-9]|[[:space:]])* has a shorter variant, [0-9[:space:]]*.

Upvotes: 3

Related Questions