AMP: regex with special chars

[G4Zz0L1]

Hi, I'd like to know if someone has already done this.
I'm trying to fetch the number of open ssh connections on the server with the following regex in an AMP:
If I use the commented one it doesn't work (and in the debug logs it doesn't show anything useful).
The other one is ok, but shows other processes too, which should be excluded.
I've tried to check on the python pages for regex, but nothing useful except quoting, and even with that I can't get it work.
I'm not a python dev, but I tried something on the python console, and it works fine.
Any ideas?

Snippet of the config

[amp_ssh]
enable=true
#regex=.*sshd:[ a-zA-Z0-9]+@.*
regex=.*sshd:.*
refresh=30

Python console

>>> import re
>>> print (re.findall('sshd:[ a-zA-Z0-9]+@','0:00 sshd: g4zz0l1@pts/17'))
['sshd: g4zz0l1@']
>>> print (re.search('sshd:[ a-zA-Z0-9]+@','0:00 sshd: g4zz0l1@pts/17'))
<re.Match object; span=(5, 19), match='sshd: g4zz0l1@'>

Example of a ps aux | grep "sshd", it should get only the third line

root        1218  0.0  0.0   8620  5996 ?        Ss   set26   0:00 sshd: /usr/bin/sshd -D [listener]
root     1346931  0.0  0.0  13628  8024 ?        Ss   18:25   0:00 sshd: g4zz0l1 [priv]
g4zz0l1  1346944  0.0  0.0  13888  5024 ?        S    18:25   0:00 sshd: g4zz0l1@pts/17

[nicolargo]

It works on my side:

Example:

[amp_python]
# Use the default AMP (no dedicated AMP Python script)
# Monitor all the Python scripts
# Alert if more than 20 Python scripts are running
enable=true
regex=.*python.*
refresh=3
countmax=20

Result:

Perhaps the problem cames from the ':' character ?

[G4Zz0L1]

Exactly what I was saying.
The python amp works, with a string just like the uncommented one in my amp snippet above.
The problem is on the commented one, do you know how to make it work with special regex chars (like [)?

[G4Zz0L1]

I give up, I've tried every regex I cound think of, nothing works.
I've found out that the same problem exist on the process filtering.
Complex regex (aside from the standard .* ones) don't work.
I just have to narrow down to what's causing this, I even looked at the source code for the amp plugin, but I'm not that expert with python, so I'm kinda lost.

[G4Zz0L1]

Any suggestion on this?

[nicolargo]

Just publish a patch on the develop branch.

Can you test it @G4Zz0L1 ?

See #2152
Commit: 1aa5596

[G4Zz0L1]

It seems to work perfectly now, at least with the amp.
The problem remains on the processes filtering, with a string like sshd:[ a-zA-Z0-9]+@ or cmdline:sshd:[ a-zA-Z0-9]+@ it fails because of the function to search in the column, but I think I can live with that.
Thanks a lot!