0

未知通知真的让我很苦恼，官方文档似乎比发布的 bosun 二进制文件更新，就像unknownPost非法选项一样。

以下未知模板和通知不起作用。我可以在 bosun UI 中看到未知通知，但它不发送通知（http 警报）。其他正常警报工作正常。

template tmpl_unknown {
    body = 'x'
    subject = `{{$v := .Eval .Alert.Vars.val }}{"warn_undo": [{"app":"xxx","db_type":"NOSQL","db_cat":"aaaa","ip":"{{.Group.host}}","warn_level":1,"warn_type":"cpu","warn_detail":"cpu {{.Group.device}} total util is {{$v.Value | pct}} ","notifier": "xxxxxxxx","status":"undo","report_time":""}]}`

    # body = {{.Name}}: {{.Group | len}} unknown alerts
    # subject = `{"warn_undo": [{"app":"aaaa","db_type":"NOSQL","db_cat":"aaaa","ip":"x.x.x.x","warn_level":1,"warn_type":"alive","warn_detail":"Time: {{.Time}} xName: {{.Name}}  Alerts:{{range .Group}}{{.}},{{end}}","notifier": "xxxxxxxx","status":"undo","report_time":""}]}`

    unknown_alive = `
    {"warn_undo": [{"app":"aaaa","db_type":"NOSQL","db_cat":"aaaa","ip":"x.x.x.x","warn_level":1,"warn_type":"alive","warn_detail":"Time: {{.Time}} Name: {{.Name}}  Alerts:{{range .Group}}{{.}},{{end}}","notifier": "xxxxxxxx","status":"undo","report_time":""}]}`
}

unknownTemplate = tmpl_unknown


notification gcsx_unknown {
        post = ${sys.gcsAlert}
        contentType = application/json
        print = True
        timeout = 5m
        next = gcsx_unknown
        unknownBody = unknown_alive
        bodyTemplate = subject
        # unknownMinGroupSize = 5
        # unknownThreshold = 0
}

alert cpu_total_util_or_unknown {
        template = tmpl_unknown
        $val = avg(q("none:0all-last:cpu.pct_used{host=*,device=total}", "1m", ""))
        warn = $val > 60
        warnNotification = gcsx_unknown
        runEvery = 1
        unknown = 1m
}

我想提醒 cpu 使用情况。如果主机不在，则没有数据报告，我将收到未知警报。

Bosun版本：master分支最新编译(2018.10.08)

4

1 回答 1

0

挖掘代码后，我终于发现了问题，它很简单：

未知通知必须发送为critNotification

cmd/bosun/sched/check.go:290

    incident.NeedAck = true
    switch event.Status {
    case models.StCritical, models.StUnknown:
        notify(a.CritNotification)
    case models.StWarning:
        notify(a.WarnNotification)
    }

Change warn, warnNotificationtocrit和critNotification通知发送成功。这应该记录在 bosun.org 中。

unknownPost是一个合法的选项，就像unknownPost, unknownGet, unknownBody, unknownEmailSubject. 但是应该在模板变量中定义，否则会报错：

2018/10/11 16:19:36 fatal: main.go:130: couldn't read rules: conf: bosun_rule.conf:47:0: at <alert x...>: 
notification x uses template key unknown_post in unknown post url, but template cpu_util does not include it

正确的方法是：

template tmpl_unknown {
    unknown_alive = `
    {"warn_undo": [{"app":"xxx","db_type":"NOSQL","db_cat":"aaaa","ip":"x.x.x.x","warn_level":1,"warn_type":"alive","warn_detail":"Time: {{.Time}} Name: {{.Name}}  Alerts:{{range .Group}}{{.}},{{end}}","notifier": "xxx","status":"undo","report_time":""}]}`
    unknown_post = "//x.x.x.x:7777/alert"
    # unknown_post = {{ V "$gcsAlert" }}
}

notification gcsx_unknown {
        post = ${sys.gcsAlert}
        contentType = application/json
        print = True
        timeout = 5m
        next = gcsx_unknown
        unknownBody = unknown_alive
        unknownPost = unknown_post
}

正如您所注意到的，http:需要删除 http url 前缀。

于 2018-10-11T08:27:45.557 回答