# hide info in the sensu command / email

**URL:** <https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64>\
**Category:** Sensu Classic (EOL)\
**Created:** [July 15, 2013, 7:38pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64 "2013-07-15T19:38:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micah\_Hoffmann](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@Micah\_Hoffmann](https://discourse.sensu.io/u/Micah_Hoffmann)\
**Post date:** [July 15, 2013, 7:38pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/1 "2013-07-15T19:38:21Z")

</div>

Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah

> **···**
>
> On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:
> 
> > {Check Name: mysql\_long\_queries\__HOST_  
> > Command: /etc/sensu/plugins/[check\_mysql\_longqueries.pl](http://check_mysql_longqueries.pl/) -H_HOST_ -P3306 -u_USER_ -p_PASS_ -w240 -c300}
> 
> > Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?
> 
> > 
> 
> > I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?
> 
> > 
> 
> > Thanks

---

<div class="post-metadata">

**Author:** ![Sean\_Porter](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@Sean\_Porter](https://discourse.sensu.io/u/Sean_Porter)\
**Post date:** [July 15, 2013, 8:22pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/2 "2013-07-15T20:22:16Z")

</div>

If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version \>= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.

As for mutator examples, you could check out those used by the specs:

[https://github.com/sensu/sensu/blob/master/spec/config.json#L25](https://github.com/sensu/sensu/blob/master/spec/config.json#L25)

[https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb](https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb)

Sean.

> **···**
>
> On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann [micah@pointinside.com](mailto:micah@pointinside.com) wrote:
> 
> > Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah
> > 
> > On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:
> 
> > > {Check Name: mysql\_long\_queries\__HOST_
> > > 
> > > Command: /etc/sensu/plugins/[check\_mysql\_longqueries.pl](http://check_mysql_longqueries.pl/) -H_HOST_ -P3306 -u_USER_ -p_PASS_ -w240 -c300}
> 
> > > Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?
> 
> > >
> 
> > > I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?
> 
> > >
> 
> > > Thanks

---

<div class="post-metadata">

**Author:** ![Micah\_Hoffmann](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@Micah\_Hoffmann](https://discourse.sensu.io/u/Micah_Hoffmann)\
**Post date:** [July 29, 2013, 5:28pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/3 "2013-07-29T17:28:56Z")

</div>

PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.

> **···**
>
> On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:
> 
> > If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version \>= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.
> 
> > As for mutator examples, you could check out those used by the specs:
> 
> > 
> 
> > [https://github.com/sensu/sensu/blob/master/spec/config.json#L25](https://github.com/sensu/sensu/blob/master/spec/config.json#L25)
> 
> > [https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb](https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb)
> 
> > 
> 
> > Sean.
> > 
> > On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann [mi...@pointinside.com](mailto:mi...@pointinside.com) wrote:
> > 
> > > Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah
> > > 
> > > On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:
> 
> > > > {Check Name: mysql\_long\_queries\__HOST_
> > > > 
> > > > Command: /etc/sensu/plugins/[check\_mysql\_longqueries.pl](http://check_mysql_longqueries.pl/) -H_HOST_ -P3306 -u_USER_ -p_PASS_ -w240 -c300}
> 
> > > > Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?
> 
> > > >
> 
> > > > I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?
> 
> > > >
> 
> > > > Thanks
> 
> >

---

<div class="post-metadata">

**Author:** ![Sean\_Porter](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@Sean\_Porter](https://discourse.sensu.io/u/Sean_Porter)\
**Post date:** [July 29, 2013, 5:35pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/4 "2013-07-29T17:35:55Z")

</div>

[http://docs.sensuapp.org/0.9/checks.html](http://docs.sensuapp.org/0.9/checks.html) under “Check command token substitution” 🙂

> **···**
>
> On Mon, Jul 29, 2013 at 10:28 AM, Micah Hoffmann [micah@pointinside.com](mailto:micah@pointinside.com) wrote:
> 
> > PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.
> > 
> > On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:
> 
> > > If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version \>= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.
> 
> > > As for mutator examples, you could check out those used by the specs:
> 
> > >
> 
> > > [https://github.com/sensu/sensu/blob/master/spec/config.json#L25](https://github.com/sensu/sensu/blob/master/spec/config.json#L25)
> 
> > > [https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb](https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb)
> 
> > >
> 
> > > Sean.
> > > 
> > > On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann [mi...@pointinside.com](mailto:mi...@pointinside.com) wrote:
> > > 
> > > > Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah
> > > > 
> > > > On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:
> 
> > > > > {Check Name: mysql\_long\_queries\__HOST_
> > > > > 
> > > > > Command: /etc/sensu/plugins/[check\_mysql\_longqueries.pl](http://check_mysql_longqueries.pl/) -H_HOST_ -P3306 -u_USER_ -p_PASS_ -w240 -c300}
> 
> > > > > Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?
> 
> > > > >
> 
> > > > > I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?
> 
> > > > >
> 
> > > > > Thanks
> 
> > >
> 
> –  
> Cheers,
> 
> Sean Porter
> 
> { blog: “[http://portertech.ca](http://portertech.ca/)”, projects: “[https://github.com/portertech](https://github.com/portertech)” }

---

<div class="post-metadata">

**Author:** ![Micah\_Hoffmann](https://avatars.discourse-cdn.com/v4/letter/m/7ba0ec/32.png) [@Micah\_Hoffmann](https://discourse.sensu.io/u/Micah_Hoffmann)\
**Post date:** [July 31, 2013, 7:45pm UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/5 "2013-07-31T19:45:19Z")

</div>

Thanks Sean,

Here is what I have going for the command tokens, and it doesn’t quite work. The server.log shows the info being returned in the event handler, which is also returned in the emails. I will most likely try mutators next. Note: the client in this case is the same box as the sensu-server, the monitoring is checking AWS RDS boxes that you cannot connect too directly.

command:

“mysql\_long\_queries\_staging”: {

“handlers”: [“mailer\_mysql”],

“command”: "/etc/sensu/plugins/check\_mysql\_longqueries.pl -H [prod.us-east-1.rds.amazonaws.com](http://prod.us-east-1.rds.amazonaws.com) -P3306 -u :::mysql.user::: -p :::mysql.password::: -w240 -c300 ",

“interval”: 300,

“occurrences”: 1,

“subscribers”: [

“mysql”

]

},

client.json

{

“client”: {

“name”: “netbox”,

“address”: “10.xx.xx.xx”,

“subscriptions”: [

“linux”,

“urls”,

“mysql”

],

“mysql”: {

“user”: “monitor”,

“password”: “cnxcnx”

}

}

}

sensu-server.log

request----

{“timestamp”:“2013-07-31T19:35:42.949477+0000”,“level”:“info”,“message”:“publishing check request”,“payload”:{“name”:“mysql\_long\_queries\_box”,“issued”:1375299342,“command”:"/etc/sensu/plugins/check\_mysql\_longqueries.pl -H [prod.us-east-1.rds.amazonaws.com](http://prod.us-east-1.rds.amazonaws.com) -P3306 -u :::mysql.user::: -p :::mysql.password::: -w240 -c300 "},“subscribers”:[“mysql”]}

event----

{“timestamp”:“2013-07-31T08:44:40.443883+0000”,“level”:“info”,“message”:“handling event”,“event”:{“client”:{“name”:“net”,“address”:“10.xx.xx.xx”,“subscriptions”:[“linux”,“urls”,“mysql”],“mysql”:{“user”:“monitor”,“password”:“adcnkl@9cs”},“timestamp”:1375260266},“check”:{“handlers”:[“mailer\_mysql”],“command”:"/etc/sensu/plugins/check\_mysql\_longqueries.pl -H [prod.us-east-1.rds.amazonaws.com](http://prod.us-east-1.rds.amazonaws.com) -P3306 -umonitor -padcnkl@9cs -w240 -c300 ",“interval”:300,“occurrences”:1,“subscribers”:[“mysql”],“name”:“mysql\_long\_queries\_dbprod-00-etl”,“issued”:1375259488,“executed”:1375259488,“output”:"MYSQL\_LONGQUERIES CRITICAL - TIME:

> **···**
>
> On Monday, July 29, 2013 10:35:55 AM UTC-7, portertech wrote:
> 
> > [http://docs.sensuapp.org/0.9/checks.html](http://docs.sensuapp.org/0.9/checks.html) under “Check command token substitution” 🙂
> 
> > On Mon, Jul 29, 2013 at 10:28 AM, Micah Hoffmann [mi...@pointinside.com](mailto:mi...@pointinside.com) wrote:
> > 
> > > PorterTech- Thanks, is there more information about command token substitution somewhere? I don’t see anything in the docs.
> > > 
> > > On Monday, July 15, 2013 1:22:16 PM UTC-7, portertech wrote:
> 
> > > > If you’re worried about sending around sensitive information, please use command token substitution w/ Sensu version \>= 0.10.0. Sensu client attribute keys that match “password”, “passwd”, or “pass” get redacted from keep-alives, which can be used in check commands like “-p:::mysql.password:::” and the values are not sent in the result.
> 
> > > > As for mutator examples, you could check out those used by the specs:
> 
> > > >
> 
> > > > [https://github.com/sensu/sensu/blob/master/spec/config.json#L25](https://github.com/sensu/sensu/blob/master/spec/config.json#L25)
> 
> > > > [https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb](https://github.com/sensu/sensu/blob/master/spec/mutators/tag.rb)
> 
> > > >
> 
> > > > Sean.
> > > > 
> > > > On Mon, Jul 15, 2013 at 12:38 PM, Micah Hoffmann [mi...@pointinside.com](mailto:mi...@pointinside.com) wrote:
> > > > 
> > > > > Hmm there isn’t much doco about mutators… can you guys help me out a little with an example? Thanks, Micah
> > > > > 
> > > > > On Wednesday, July 10, 2013 10:03:01 AM UTC-7, Micah Hoffmann wrote:
> 
> > > > > > {Check Name: mysql\_long\_queries\__HOST_
> > > > > > 
> > > > > > Command: /etc/sensu/plugins/[check\_mysql\_longqueries.pl](http://check_mysql_longqueries.pl/) -H_HOST_ -P3306 -u_USER_ -p_PASS_ -w240 -c300}
> 
> > > > > > Hey all, can you help me brainstorm some ways to hide the various information that is emailed in the sensu check?
> 
> > > > > >
> 
> > > > > > I am thinking possibly set up some sort of reference file with the HOST= USER= PASS=, that each command can pull from?
> 
> > > > > >
> 
> > > > > > Thanks
> 
> > > >
> 
> > 
> 
> > –  
> > Cheers,
> 
> > Sean Porter
> 
> > { blog: “[http://portertech.ca](http://portertech.ca/)”, projects: “[https://github.com/portertech](https://github.com/portertech)” }
> 
> >

---

<div class="post-metadata">

**Author:** ![jspaleta](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/jspaleta/32/141_2.png) [@jspaleta](https://discourse.sensu.io/u/jspaleta)\
**Post date:** [November 22, 2018, 2:04am UTC](https://discourse.sensu.io/t/hide-info-in-the-sensu-command-email/64/6 "2018-11-22T02:04:57Z")

</div>