hide info in the sensu command / email

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

···

On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:

{Check Name: mysql_long_queries_HOST
Command: /etc/sensu/plugins/check_mysql_longqueries.pl -HHOST -P3306 -uUSER -pPASS -w240 -c300}

Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?

I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?

Thanks

If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version >= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.

As for mutator examples, you could check out those used by the specs:

https://github.com/sensu/sensu/blob/master/spec/config.json#L25

https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb

Sean.

···

On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann micah@pointinside.com wrote:

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:

{Check Name: mysql_long_queries_HOST

Command: /etc/sensu/plugins/check_mysql_longqueries.pl -HHOST -P3306 -uUSER -pPASS -w240 -c300}

Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?

I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?

Thanks

PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.

···

On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:

If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version >= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.

As for mutator examples, you could check out those used by the specs:

https://github.com/sensu/sensu/blob/master/spec/config.json#L25

https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb

Sean.

On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann mi...@pointinside.com wrote:

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:

{Check Name: mysql_long_queries_HOST

Command: /etc/sensu/plugins/check_mysql_longqueries.pl -HHOST -P3306 -uUSER -pPASS -w240 -c300}

Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?

I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?

Thanks

http://docs.sensuapp.org/0.9/checks.html under “Check command token substitution” :slight_smile:

···

On Mon, Jul 29, 2013 at 10:28 AM, Micah Hoffmann micah@pointinside.com wrote:

PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.

On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:

If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version >= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.

As for mutator examples, you could check out those used by the specs:

https://github.com/sensu/sensu/blob/master/spec/config.json#L25

https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb

Sean.

On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann mi...@pointinside.com wrote:

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:

{Check Name: mysql_long_queries_HOST

Command: /etc/sensu/plugins/check_mysql_longqueries.pl -HHOST -P3306 -uUSER -pPASS -w240 -c300}

Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?

I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?

Thanks


Cheers,

Sean Porter

{ blog: “http://portertech.ca”, projects: “https://github.com/portertech” }

Thanks Sean,

Here is what I have going for the command tokens, and it doesn’t quite work. The server.log shows the info being returned in the event handler, which is also returned in the emails. I will most likely try mutators next. Note: the client in this case is the same box as the sensu-server, the monitoring is checking AWS RDS boxes that you cannot connect too directly.

command:

“mysql_long_queries_staging”: {

“handlers”: [“mailer_mysql”],

“command”: "/etc/sensu/plugins/check_mysql_longqueries.pl -H prod.us-east-1.rds.amazonaws.com -P3306 -u :::mysql.user::: -p :::mysql.password::: -w240 -c300 ",

“interval”: 300,

“occurrences”: 1,

“subscribers”: [

“mysql”

]

},

client.json

{

“client”: {

“name”: “netbox”,

“address”: “10.xx.xx.xx”,

“subscriptions”: [

“linux”,

“urls”,

“mysql”

],

“mysql”: {

“user”: “monitor”,

“password”: “cnxcnx”

}

}

}

sensu-server.log

request----

{“timestamp”:“2013-07-31T19:35:42.949477+0000”,“level”:“info”,“message”:“publishing check request”,“payload”:{“name”:“mysql_long_queries_box”,“issued”:1375299342,“command”:"/etc/sensu/plugins/check_mysql_longqueries.pl -H prod.us-east-1.rds.amazonaws.com -P3306 -u :::mysql.user::: -p :::mysql.password::: -w240 -c300 "},“subscribers”:[“mysql”]}

event----

{“timestamp”:“2013-07-31T08:44:40.443883+0000”,“level”:“info”,“message”:“handling event”,“event”:{“client”:{“name”:“net”,“address”:“10.xx.xx.xx”,“subscriptions”:[“linux”,“urls”,“mysql”],“mysql”:{“user”:“monitor”,“password”:“adcnkl@9cs”},“timestamp”:1375260266},“check”:{“handlers”:[“mailer_mysql”],“command”:"/etc/sensu/plugins/check_mysql_longqueries.pl -H prod.us-east-1.rds.amazonaws.com -P3306 -umonitor -padcnkl@9cs -w240 -c300 ",“interval”:300,“occurrences”:1,“subscribers”:[“mysql”],“name”:“mysql_long_queries_dbprod-00-etl”,“issued”:1375259488,“executed”:1375259488,“output”:"MYSQL_LONGQUERIES CRITICAL - TIME:

···

On Monday, July 29, 2013 10:35:55 AM UTC-7, portertech wrote:

http://docs.sensuapp.org/0.9/checks.html under “Check command token substitution” :slight_smile:

On Mon, Jul 29, 2013 at 10:28 AM, Micah Hoffmann mi...@pointinside.com wrote:

PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.

On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:

If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version >= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.

As for mutator examples, you could check out those used by the specs:

https://github.com/sensu/sensu/blob/master/spec/config.json#L25

https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb

Sean.

On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann mi...@pointinside.com wrote:

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:

{Check Name: mysql_long_queries_HOST

Command: /etc/sensu/plugins/check_mysql_longqueries.pl -HHOST -P3306 -uUSER -pPASS -w240 -c300}

Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?

I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?

Thanks


Cheers,

Sean Porter

{ blog: “http://portertech.ca”, projects: “https://github.com/portertech” }