[Bug]: Alerts: Negated regex not working

[McSh4dow]

Bug Description

Only positive patterns work. Is it possible to implement negated regex?

Steps to Reproduce

When attempting to delete an 'Unused Disk' from a VM that still has a snapshot containing this Disk, following error is produced: TASK ERROR: unable to delete 'local-zfs-zpool1:vm-1234567-disk-0' - volume is still in use (snapshot?)

With an Alert configured like:

• Category=All
• Event Level=Error
• Pattern=unable

an Alert is triggered as expected:
2026-04-23T12:55:03+02:00 INF Event alert created event_id=UPID:PVE-2-1:0001DA59:0ADE57F5:69E9FA86:qmconfig:1234567:root@pam: rule_id=f1d9806c-c0da-4341-9f57-b0688be169e0 rule_name="ProxCenter Warning Found"

With an Alert configured like:

• Category=All
• Event Level=Error
• Pattern=^(?!.*(failed|error|timeout)).*

no Alert is triggered, event though it should, since this regular expression matches 'unable to delete'.

Log about invalid regex pattern:
2026-04-23T12:55:03+02:00 WRN Invalid regex pattern error="error parsing regexp: invalid or unsupported Perl syntax: (?!" rule_id=2b49d1df-a2b7-467e-ab20-e09bf4968370

Expected Behavior

Negated regex pattern should trigger events.

Actual Behavior

Negated regex pattern doesn't trigger events.

ProxCenter Version

1.3.5

Proxmox VE Version

9.1.6

Browser

No response

Logs / Screenshots

No response

[adminsyspro]

Hi @McSh4dow,

Thanks for the clear repro. The root cause is that Go's standard regexp package uses RE2, which deliberately does not support lookahead / lookbehind assertions ((?!...), (?=...), (?<!...), (?<=...)) to guarantee linear-time matching and avoid ReDoS attacks. This is also why you see invalid or unsupported Perl syntax: (?!.

Rather than swap the regex engine for a Perl-compatible one (which would reintroduce the ReDoS risk on user-provided patterns that run on every event), we added a dedicated Exclude pattern field on alert rules. An event matches the rule when Pattern matches AND Exclude pattern does not match.

For your use case:

• Pattern: .* (or leave empty)
• Exclude pattern: failed|error|timeout

Any event whose message does NOT contain failed, error or timeout will fire the rule. This is equivalent to your ^(?!.*(failed|error|timeout)).* intent but uses only RE2-safe primitives.

The fix ships in the next release. Existing rules are unaffected (the new field defaults to empty).