Flapjack Notification Rules created automatically and overriding implicit rules

[Damian Lubosch]

Hello,

I am struggling with a problem that there are some default notification rules created automatically. 

I have grouped my entities with tags, as "prod", "stage", "test" for environments based on the hostname. The tags are set; at least I can see it in the Redis DB, but not the UI. 

Anyway when adding additional notification rules that should be valid only on tags, e.g., 

contacts.each do |contact_id|

  Flapjack::Diner.create_contact_notification_rules(

    contact_id[:id],

    {

      'tags'               => [ 'test' ],

      'time_restrictions'  => [

        {

          'start_time' => '2015-01-28 09:00:00',

          'end_time'   => '2015-01-28 18:00:00',

          'rrules'     => [

            {

              'validations' => {

                'day' => [ 1, 2, 3, 4, 5 ]

                },

              'rule_type'   => 'Weekly',

              'interval'    => 1,

              'week_start'  => 0

            }

          ],

        'exrules'       => [],

        'rtimes'        => [],

        'extimes'       => []

        }

      ],

      'unknown_media'      => [],

      'warning_media'      => [ 'email' ],

      'critical_media'     => [ 'email' ],

      'unknown_blackhole'  => false,

      'warning_blackhole'  => false,

      'critical_blackhole' => false

    }

  )

end

then the notifications are also sent after 18:00h and on Saturdays and Sundays and on media not configured for "Test", because for each contact there are some automatic notification rules (I haven't even configured any other media except email and sms_twilio):

Notification Rules

ID	Entities	Entities Regex	Tags	Tags Regex	Warning Media	Critical Media	Time Restrictions	Blackholes
f2d62055-2fcd-439d-99ef-dfffe7725e90	-	-	-	-	email, sms, sms_twilio, sms_nexmo, jabber, pagerduty, sns	email, sms, sms_twilio, sms_nexmo, jabber, pagerduty, sns	[]
9a898db2-f908-425f-9d4e-2616f347686f	-	-	test	-	email	email	[{"start_time"=>"2015-01-28 09:00:00", "end_time"=>"2015-01-28 18:00:00", "rrules"=>[{"validations"=>{"day"=>[1, 2, 3, 4, 5]}, "rule_type"=>"Weekly", "interval"=>1, "week_start"=>0}], "exrules"=>[], "rtimes"=>[], "extimes"=>[]}]

For Prod I also configured a SMS gateway "sms_twilio" which should be used only for Prod, but it is used for all environments. Is there a way to disable this automatic notification rule?

I am using Flapjack 1.5.0 together with Sensu.

Thanks,

Damian

[Jesse Reynolds]

Hi Damian, 

Flapjack will always ensure there is a catch-all rule. A catch-all rule is one that has no tags or entities specified in it. But you can modify this rule to drop all notifications, by removing all media from it. In which case, only the notification rules that are specific about entities or tags to match will allow alerts through. 

I hope this clears it up. 

Cheers

Jesse

--

---
You received this message because you are subscribed to the Google Groups "flapjack" group.
To unsubscribe from this group and stop receiving emails from it, send an email to flapjack-proje...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Damian Lubosch]

Hi Jesse, 

thank you, sounded like a good idea, I tried that out but my tagged notification rules seem to be ignored. Using entity matching does not work either. When I add tags, are must all tags be present or any?

There is one drawback in changing the catch-all-rule's media, when creating flapjack from scratch (I use vagrant for this), when flapjack is started, the catch-all rules seem to be created only after I listed them in the GUI. So after creating my notification rules (like in my first post) when I run 

require 'flapjack-diner'

Flapjack::Diner.base_uri('localhost:3081')

notifications = Flapjack::Diner.notification_rules

notifications.each do |notification|

  puts notification[:id],

  if notification[:time_restrictions] == []

    Flapjack::Diner.update_notification_rules(

      notification[:id],

      :warning_media => [],

      :critical_media => []

    )

  end

end

it does not find any media to delete. When I check on the GUI I can see the catch-all-rule containing all media. Running the snippet above again, then deletes the media.

When using tagged or entity based notification rules, do I still need to assign entities to contacts? (I have tried using the ALL entity but also specific) without much success in using the filters.

Thanks a lot!

Damian

[Damian Lubosch]

Hi,

I have played for a couple of hours with all kinds of config changes, and at end, I do following so that the filtering is working:

- Create the ALL entity and assign it to all contacts.

- Create custom notification rules, based on regex_entities in form of [ '^prod.*$' ] for each environment a separate one. Array of regex_entities did not seem to work.

- Download/open each contact's http://flapjack/contact/0XX contact site (so that the catch-all notification rule is created)

- Run the script below to remove all media from the catch_all notification rule.

I know this is somewhat rugged but works for me so far. If someone wants to share a more elegant solution - I am open for it ;-)

I also have tried to work with tags, but since I do not know how to provide tags out of the Sensu provider it is not handy for new hosts, etc.

I'd be happy about any feedback.

Cheers,

Damian

[Jesse Reynolds]

Bravo!

Yes, the notification rules AND together all regex entities and tags specified etc. To achieve a logical OR you have to add separate rules, as you' e done. 

Note also the words in the check and host are broken into ephemeral tags that you can also match on with tags in the notification rules.

Cheers

Jesse

[George Necula]

I have also found this part hard to understand. I am about to add a pull-request with documentation for now the rules are processed. 

Cheers,

George.

[George Necula]

Please see my https://github.com/flapjack/flapjack.io/pull/21

George.