Handling Aggregates in Sensu Core 1.x

[aaronsachs]

A quick discussion on hoow to handle aggregates in Sensu Core 1.x from the Community Slack

View in #help on Slack

@mdelaney: Is it possible to have a handler on an aggregate?

@aaronsachs: @mdelaney indeed it is.
Just add the "handlers":[] scope with your desired handlers

@mdelaney: @aaronsachs Dol you happen to have some docs on hand that show this?

@aaronsachs: Hmmmm
it doesn’t look like the aggregates reference show this
But, it’s definitely possible
I’ll open an issue on the repo to have this added.

@mdelaney: Awesome, thank you.

@aaronsachs: @mdelaney before I do that, how do you have your aggregate set up?
It’s worth noting that aggregates themselves don’t alert
You have to configure a check to query them and put the handler there

{
  "checks": {
    "check_http_8080": {
      "command": "check-http.rb -u http://127.0.0.1:8080",
      "interval": 10,
      "handle": false,
      "standalone": true,
      "aggregate": "http_ports"
    }
  }
}
{
  "checks": {
    "check_http_8088": {
      "command": "check-http.rb -u http://127.0.0.1:8088",
      "interval": 10,
      "handle": false,
      "standalone": true,
      "aggregate": "http_ports"
    }
  }
}
{
  "checks": {
    "check_http_8888": {
      "command": "check-http.rb -u http://127.0.0.1:8888",
      "interval": 10,
      "handle": false,
      "standalone": true,
      "aggregate": "http_ports"
    }
  }
}
{
  "checks": {
    "check_http_ports_aggregate": {
      "command": "check-aggregate.rb -c http_ports --warning 30 --critical 60",
      "interval": 10,
      "standalone": true,
      "handlers":["email"]
    }
  }
}

@mdelaney: @aaronsachs That is actually pretty damn close to how things are setup, sans the last element check_http_ports_aggregate.

@aaronsachs:
Yeah, so if you have the check that queries the aggregate, that should get you what you need

@mdelaney: Perfect, I’ll give that a shot.

@aaronsachs: Woot!

@mdelaney:

[majormoses]

I will see about updating my example in my guide: https://blog.sensu.io/alert-fatigue-part-4-alert-consolidation with a handlers example. I guess I never really thought about not including it, I took that from my slides where I was trying to save real estate for common check config. Essentially you want the handlers set on the check that is checking the aggregate not the check that creates and updates the aggregate.