1

I'm using Sensu for alerting. If anything goes wrong with any of service then it would trigger the alert and send us notification mail.

I've just come across one document where I can change the notification time outside business hours, this is the document I was referring to.

I've created filter rule, /etc/sensu/conf.d/filters/nine_to_fiver.json

{
    "filters": {
      "nine_to_fiver": {
        "negate": false,
        "attributes": {
          "timestamp": "eval: [1,2,3,4,5].include?(Time.at(value).wday) && Time.at(value).hour.between?(9,17)"
        }
     }
  }
}

After making this change, I reloaded sensu-client deamon on client side but I'm still getting notification on mail ID. Is there anything wrong with filter rules ? Or Am I missing anything ?

Any help would be appreciated.

Rahul
  • 402
  • 2
  • 9
  • 23

1 Answers1

1

Filters must be applied on the Sensu Server, not the Sensu Client. Furthermore, the filter must reside server-side and the handler must be configured to apply the filter.

Alternatively, you might be able to get a little fancy with the when filter field.

vase
  • 339
  • 1
  • 6
  • thank you so much. I really appreciate your help. Does "when" filter field also supposed to be configured on server-side ? – Rahul Nov 15 '17 at 10:01
  • 1
    The "when" attributes can exist on any filter JSON configuration, so it would be within the `/etc/sensu/conf.d/filters/nine_to_fiver.json` that you originally showed (so, yes, server-side as well). I haven't tried it, but I imagine a filter that is exclusive (matched events are NOT handled), with just `eval: true` as the filter logic and a "when" block from 9 to 5, _might_ work. Your filter is directly from Sensu's documentation on how to filter for 9-to-5 though, so I'd stick with that. – vase Nov 15 '17 at 14:43
  • just one question, can [sudue](https://sensuapp.org/docs/1.0/reference/checks.html#subdue-attributes) helps in this case for each check. And if so where it can be configured? – Rahul Nov 20 '17 at 10:36
  • 1
    I imagine `subdue` and `when` are two similar constructs that have the same purpose. The difference being that `subdue` is configured in the check JSON (so client-side if using standalone checks) and `when` is configured in the handler JSON (always server-side). – vase Nov 20 '17 at 12:12
  • ok got it. One more question, let's say I have one sensu server and 100 clients. But those 100 clients are divided based on environment. 50 clients are in production and 50 are in development. If I want to setup `subdue` only for development environment clients then how would I do that ? Can I setup global filter or do I have to set it per-check ? – Rahul Nov 21 '17 at 10:38
  • can I contact you via email or something, please ? – Rahul Nov 23 '17 at 11:08