Bosun Templates: Overview Low Memory Alert and Template

Example

Templates can be previewed and edited using the Rule Editor tab in Bosun. Use the Jump to links to select the alert you want to edit, then you can use the template button next to macro to switch between the alert an template sections of the configuration. If an alert has multiple instances you can use host=xxx,name=xxx in the Template Group section to specify for which tagset you want to see the template rendered.

template os.low.memory {
    subject = {{.Last.Status}}: Low Memory: {{.Eval .Alert.Vars.q | printf "%.0f"}}% Free Memory on {{.Group.host}} ({{.Eval .Alert.Vars.free | bytes }} Free of {{.Eval .Alert.Vars.total | bytes }} Total)

    body = `
    <p><a href="{{.Ack}}">Acknowledge</a> | <a href="{{.Rule}}">View Alert in Bosun's Rule Editor</a></p>
    <p><strong>Alert Key: </strong>{{printf "%s%s" .Alert.Name  .Group }}</p>
    <p><strong>Incident: </strong><a href="{{.Incident}}">#{{.Last.IncidentId}}</a></p>
    <p><strong>Notes: </strong>{{html .Alert.Vars.notes}}</p>

    <strong>Graph</strong>
    <div>{{.Graph .Alert.Vars.graph .Alert.Vars.graph_unit}}</div>
    `
}

notification sample.notification {
    email = [email protected]
}

alert os.low.memory {
    template = os.low.memory
    $notes = Alerts when less than 5% free, or less than 500MB (when total > 2GB). In Linux, Buffers and Cache are considered "Free Memory".

    $default_time = "2m"
    $host = wildcard(*)
    $graph = q("avg:300s-avg:os.mem.percent_free{host=$host}", "1d", "")
    $graph_unit = Percent Free Memory (Including Buffers and Cache)
    $q = avg(q("avg:os.mem.percent_free{host=$host}", $default_time, ""))
    $total = last(q("sum:os.mem.total{host=$host}", $default_time, ""))
    $free = last(q("sum:os.mem.free{host=$host}", $default_time, ""))

    #Warn when less than 5% free or total > 2GB and free < 500MB
    warn = $q < 5 || ($total > 2147483648 && $free < 524288000)
    #Crit when less than 0.5% free
    crit = $q <= .5
    critNotification = sample.notification
}

After you test the alert on the Rule Editor page you can use the Results tab to see computations, Template to see the rendered alert notification, and Timeline to see all alert incidents (only when From and To dates are specified).