influxdata / influxdata/kapacitor

Kapacitor .exec() not working

Open
#2,182 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.4k
Forks
479
Avg merge
4d 16h
Merged PRs (30d)
4

Description

Hi everyone,
I am fairly new to TICK and I am trying to have kapacitor run a bash script then email me a notification. The following is my tickscript:

`var db = 'telegraf'

var rp = 'autogen'

var measurement = 'syslog'

var groupBy = []

var whereFilter = lambda: ("appname" == 'sshd') AND ("facility" == 'authpriv') AND ("hostname" == 'vyos') AND ("severity" == 'notice')

var period = 10s

var every = 30s

var name = 'Brute Force Attack'

var idVar = name

var message = ''

var idTag = 'alertID'

var levelTag = 'level'

var messageField = 'message'

var durationField = 'duration'

var outputDB = 'chronograf'

var outputRP = 'autogen'

var outputMeasurement = 'alerts'

var triggerType = 'threshold'

var details = 'script has been ran'

var crit = 3

var data = stream
|from()
.database(db)
.retentionPolicy(rp)
.measurement(measurement)
.groupBy(groupBy)
.where(whereFilter)
|window()
.period(period)
.every(every)
.align()
|count('timestamp')
.as('value')

var trigger = data
|alert()
.exec('/usr/bin/bash', '/scripts/script.sh')
.crit(lambda: "value" >= crit)
.message(message)
.id(idVar)
.idTag(idTag)
.levelTag(levelTag)
.messageField(messageField)
.durationField(durationField)
.details(details)
.email()
.to('italianoaj@**********')

trigger
|eval(lambda: float("value"))
.as('value')
.keep()
|influxDBOut()
.create()
.database(outputDB)
.retentionPolicy(outputRP)
.measurement(outputMeasurement)
.tag('alertName', name)
.tag('triggerType', triggerType)

trigger
|httpOut('output')
`

the script reads:

`#!/bin.bash

echo "test" > /var/lib/kapacitor/test.txt`

When the script fires, the email is sent but the script doesn't run being the test.txt file is not created. Am I using .exec() properly? Again I am very new to this and would like to implement TICK for some of my system's syslogs and have scripts run in response to certain log anomalies. Thank you in advance for your help.

Contributor guide

Open the contributing guide

Research direction

Start with the TICKscript alert node's .exec('/usr/bin/bash', '/scripts/script.sh') configuration and the shown script contents. Check the relevant execution behavior, paths, and permissions, then reproduce the alert and verify that /var/lib/kapacitor/test.txt is created while the email still sends.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash
Domain
devops, observability-sre
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.