Regular Expression Examples for Monitors and Autowatchers

CA SystemEDGE User Guide › Agent Configuration › Regular Expression Examples for Monitors and Autowatchers

Regular Expression Examples for Monitors and Autowatchers

This section provides regular expression examples in context to each monitor type.

Process Monitors

Matches processes that start with ‘svchost’:
```
^svchost
```
Matches processes that contain ‘sql’:
```
sql
```
Matches processes that end in ‘svc’:
```
svc$
```
Matches both ‘cmd’ and ‘CMD’ processes (requires PCRE):
```
/cmd/i
```

Note: Unless you are monitoring for the existence of multiple instances of a process (with the 0x4000 flag), use a regular expression that matches only one process.

Windows Service Monitors

Matches the service with the exact display name ‘Print Spooler’:
```
^Print Spooler$
```

Note: For Windows services, use a regular expression that matches only one service.

Process Group Monitors

Matches all processes that start with ‘sql’ or ‘svchost’:
```
^sql|^svchost
```

Windows Event Monitors (Source Filter)

Matches events from any source:
```
.*
```
Matches events from the http server:
```
http
```

Windows Event Monitors (Description Filter)

Matches events with Event ID of 277 (requires the ‘Prepend Event ID’ flag – 0x0100):
```
\[277\]
```
Matches events containing the text ‘FATAL’ anywhere in the line:
```
FATAL
```

Log File Monitors (Search Filter)

Matches on text indicating a failed su attempt:
```
su.*fail
```
Matches on the text strings “WARNING:” and “Invalid login attempt” which is separated by an unknown number of lines in the log file (requires PCRE):
```
/^WARNING:(.*\n)*Invalid login attempt/m
```
Matches on the text ‘error’ regardless of case (requires PCRE):
```
/error/i
```

Generic Autowatchers

Instance Criteria RegEx, RegEx 2, RegEx 3:

Matches on text containing ‘WiFi’:
```
WiFi
```
Matches on text containing ‘C:’, ‘D:’, or ‘E:’:
```
C:|D:|E:
```

Process Autowatchers

Instance Criteria RegEx, RegEx 2, RegEx 3:

Matches processes that start with ‘svchost’:
```
^svchost
```
Matches processes that contain ‘sql’:
```
sql
```
Matches processes that end in ‘svc':
```
svc$
```
Matches both ‘cmd’ and ‘CMD’ processes (requires PCRE):
```
/cmd/i
```
Matches all processes that start with ‘sql’ or ‘svchost’:
```
^sql|^svchost
```

Service Autowatchers

Instance Criteria RegEx, RegEx 2, RegEx 3:

Match on all services with ‘SQL’ in the display name:
```
.*SQL.*
```
Match on all services starting with ‘SQL’ in the display name:
```
^SQL
```
Match on all services starting with ‘SQL’ regardless of case:
```
/^SQL/i
```

More information:

Configure Text Pattern Exclusion

Regular Expression Examples

Perl Compatible Regular Expression (PCRE) Support

Multiline Regular Expressions