Check syntax for triggering remediation (publish:false) actions. If occurrences is 1 or 2, and the severity is 1 (warning), the light_remediation will be triggered. If occurrences is 3 through 10, and the severity is 1 (warning), the medium_remediation will be triggered. If occurrences is above 2, and the severity is 2 (critical), the heavy_reme…

config.json

{
  "handlers": {
    "remediator": {
      "type": "pipe",
      "command": "/etc/sensu/handlers/remediator.rb"
    },
  },
  "checks": {
    "fail_with_remediation": {
      "command": "/bin/false",
      "interval": 9999,
      "publish": false,
      "subscribers": ["sensu_server"],
      "handlers": ["debug", "remediator", "irc"],
      "remediate": {
        "light_remediation": {
          "occurrences": [1,2],
          "severities": [1]
        },
        "medium_remediation": {
          "occurrences": ["3-10"],
          "severities": [1]
        },
        "heavy_remediation": {
          "occurrences": ["2+"],
          "severities": [2]
        }
      }
    },
    "light_remediation": {
      "command": "/bin/touch /tmp/remediation_light",
      "publish": false,
      "interval": 9999,
      "subscribers": ["sensu_server"]
    },
    "medium_remediation": {
      "command": "/bin/touch /tmp/remediation_medium",
      "publish": false,
      "interval": 9999,
      "subscribers": ["sensu_server"]
    },
    "heavy_remediation": {
      "command": "/bin/touch /tmp/remediation_heavy",
      "publish": false,
      "interval": 9999,
      "subscribers": ["sensu_server"]
    }
  }
}

remediator.rb

#!/usr/bin/env ruby
#
# "remediation": {
#    "light_remediation": {
#      "occurrences": [1,2],
#      "severities": [1]
#    },
#    "medium_remediation": {
#      "occurrences": ["3-10"],
#      "severities": [1]
#    },
#    "heavy_remediation": {
#      "occurrences": ["1+"],
#      "severities": [2]
#    }
#  }
# ===
#
# Copyright 2012 Nick Stielau <nick.stielau@gamil.com>
#
# Released under the same terms as Sensu (the MIT license); see LICENSE
# for details.


require 'rubygems' if RUBY_VERSION < '1.9.0'
require 'sensu-handler'

class Remediator < Sensu::Handler

  # Override filter_repeated from Sensu::Handler.
  # Remediations are not alerts.
  def filter_repeated; end

  def handle
    client = @event['client']['name']
    remediations = @event['check']['remediate']
    occurrences = @event['occurrences']
    severity = @event['check']['status'].to_i
    puts "Evaluating remediation: #{client} #{remediations.inspect} #=#{occurrences} sev=#{severity}"

    remediation_checks = parse_remediations(remediations, occurrences, severity)

    remediation_checks.each do |remediation_check|
      puts "Triggering remediation check '#{remediation_check}' for #{[client].inspect}"
      response = trigger_remediation(remediation_check, [client])
      puts "Recieved API Response (#{response.code}): #{response.body}, exiting."
    end
  end

  def parse_remediations(remediations, occurrences, severity)
    puts "Parsing remediations from #{remediations}[#{occurrences}]"
    remediations_to_trigger = []

    remediations.each do |check, conditions|
      valid_occurrences = []
      (conditions["occurrences"] || []).each do |value|
        if value.is_a?(Integer)
          valid_occurrences << value
        elsif value.to_s.match(/^\d+$/)
          valid_occurrences << $~.to_a.first.to_i
        elsif value.to_s.match(/^(\d+)-(\d+)$/)
          valid_occurrences << Range.new($~.to_a[1].to_i, $~.to_a[2].to_i).to_a
        elsif value.to_s.match(/^(\d+)\+$/)
          puts "Matchdata: #{$~.inspect}"
          valid_occurrences << Range.new($~.to_a[1].to_i, 99999).to_a
        end
      end
      valid_occurrences.flatten!

      puts "Valids: #{valid_occurrences}"
      next unless valid_occurrences.include?(occurrences) && (conditions["severities"] || []).include?(severity)

      remediations_to_trigger << check
    end
    remediations_to_trigger
  end

  # Issue a check via the API
  def trigger_remediation(check, subscribers)
    result = api_request(:POST, '/checks/request') do |req|
      req.body = JSON.dump({"check" => check, "subscribers" => subscribers})
    end
  end

end

test.sh

curl 127.0.0.1:4567/checks/request -XPOST -d '{"subscribers": ["sensu_server"], "check": "fail_with_remediation"}'