SNMP Exporter Regex Not Returning Data

[Matthew Koch]

I'm trying to extract the MAC address out of what is returned by SNMP exporter. The Regex I am using seems to work in general when I used an online Regex tester but for some reason it's not working in SNMP exporter.

SNMPExporter config:

    - name: apSysStatBssid
      oid: 1.3.6.1.4.1.11.2.14.11.6.4.5.1.1.1.1.31.3
      type: PhysAddress48
      help: MAC address of the AP that the HPE501 is Associated to. - 1.3.6.1.4.1.11.2.14.11.6.4.5.1.1.1.1.31.3
      regex_extracts:
        Test:
          - regex: '([\w]{2}:[\w]{2}:[\w]{2}:[\w]{2}:[\w]{2}:[\w]{2})'
            value: '$1'

This is what I typically get data wise without the regex config:

# HELP apSysStatBssid BSSID of currently connected accesspoint - 1.3.6.1.4.1.29456.3.2
# TYPE apSysStatBssid gauge
apSysStatBssid{apSysStatBssid="6A:56:E3:7A:85:47"} 1

[Brian Candler]

Start with regex: '(.*)'

If that works, then you know it's just the regex at fault. I'd start by trying to double-backslash, i.e.

- regex: '([\\w]{2}:[\\w]{2}:[\\w]{2}:[\\w]{2}:[\\w]{2}:[\\w]{2})'

The spec for Go's regex language (RE2) is here: https://github.com/google/re2/wiki/syntax

I'm not sure if a backslash character class is allowed inside a square-bracket character class. So you could try:

- regex: '((\\w){2}:(\\w){2}:(\\w){2}:(\\w){2}:(\\w){2}:(\\w){2})'

- regex: '([[:alnum:]]{2}:[[:alnum:]]{2}:[[:alnum:]]{2}:[[:alnum:]]{2}:[[:alnum:]]{2}:[[:alnum:]]{2})'

or something simpler like:

- regex: '([a-fA-F0-9:]{17})'

[Matthew Koch]

I've tried the variety of Regex and still it doesn't return any data. It's interesting because nothing comes back in the output and it doesn't error as well.

[Brian Candler]

OK. I checked this. regex_extracts is only from when you want to extract a metric *value* (i.e. a floating-point number) from text, for some dodgy MIBs which respond with things like temperature as a string value.

Since you already have apSysStatBssid containing the MAC address as a string label, what exactly do you want to do with it?

[Matthew Koch]

In Grafana I am trying to use the metric to do a comparison, but I cannot do it because it is a label and not a value. SNMP returns a value of 1 with the label 

[Brian Candler]

Sorry, I don't understand - what sort of comparison do you want to do on a MAC address?

[Matthew Koch]

This is used to track how a wireless client is connected to a specific access point. What I am trying to determine is when a client has endured a significant amount of interference so when I read the noise level from the client I want to report when that metric has changed significant but I only want to do this if the mac address which is collected at the same time is unchanged. We need multiple readings to determine this so when I compare one point in the time series db to another I use the MAC address for comparison. the challenge is I cannot do this with the label.

[Brian Candler]

If you can show complete examples of the metrics (the noise level one and the one you want to correlate to, including all the labels) then it may be possible to show you how to join them.

[Matthew Koch]

So The BSSID is the constant and I want to know when the apCurrentNoise changes by -/+5 but only if I am connected to the same access point (BSSID). If the BSSID changes and the Noise level changes then its not as big of a deal. It's only if I am connected to the same BSSID and in a new polling interval the noise level changes. # HELP apCurrentNoise Background noise level (dBm) of the 802.11 device. - 1.3.6.1.4.1.11.2.14.11.6.4.5.1.1.21.6 # TYPE apCurrentNoise gauge apCurrentNoise -92 # HELP apSysStatBssid MAC address of the AP that the HPE501 is Associated to. - 1.3.6.1.4.1.11.2.14.11.6.4.5.1.1.1.1.31.3 # TYPE apSysStatBssid gauge apSysStatBssid{apSysStatBssid="07:8B:67:FF:4F:35"} 1

[Brian Candler]

Tidying that up:

apCurrentNoise -92

apSysStatBssid{apSysStatBssid="07:8B:67:FF:4F:35"} 1

and those will have job/instance labels added by Prometheus.

The main problem will be that ths bssid timeseries come and go when the bssid changes - the timeseries with the old bssid will be seen for 5 minutes (the default lookback delta). So it's not a case so much of checking the AP is on the *same* bssid as it was before, but that it's *not* been seen on a different bssid.

From the top of my head, and completely untested, here is a starting point:

abs(apCurrentNoise - apCurrentNoise offset 1m) >= 5 unless on (instance) count by (instance) (apSysStatBssid) > 1

This should suppress the alert if the AP has changed bssid within the last 5 minutes.

abs(pCurrentNoise - apCurrentNoise offset 2m) >= 5