This regex in Business rules is rejected : ^(?!ora_).+

[eduault]

This regular expression (negative look-ahead assertion) is rejected when I reload Shinken 2.4.3 configuration :
^(?!ora_).+

I'm having this service definition :

define service {
	host_name		host1
	service_description	service1
	
	# services on host "host2" which description does not start by "ora_"
	check_command		bp_rule!(host2,r:^(?!ora_).+)
}

When I reload Shinken configuration ( /etc/init.d/shinken reload ), I'm having a "ConfigCheck failed" error.

And /tmp/shinken_checkconfig_result contains those error messages :

ERROR: [Shinken] service1: my business rule is invalid
ERROR: [Shinken] service1: Business rule uses invalid regex host2,r:^?!ora_: nothing to repeat
ERROR: [Shinken] service1: Business rule uses unknown host .+

[geektophe]

Have you tried to match this regex against a sample string (one of your services that should not match, precisely) in a python shell ?

[eduault]

Here it is :

[eduault@server123 ~]$ python
Python 2.7.5 (default, Nov  6 2016, 00:28:07)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import re
>>> p = re.compile('^(?!ora_).+')
>>> print(p.match("ora_1234"))
None
>>> print(p.match("1234"))
<_sre.SRE_Match object at 0x7f22a5585308>

[geektophe]

I understood. The regex interferes with the business rule parser because of the parenthesis. The business rules processor uses parenthesis to express boolean logic, so it's impossible to use such a regex within bp_rule unfortunately...

Another approach you could use is to define labels on the services you want to monitor (could be from a common template), and use the label expansion expression: bp_rule!host2,l:service_label