f3ew_riemann.config

(logging/init {:file "/var/log/riemann/riemann.log"})

; Listen on the local interface over TCP (5555), UDP (5555), and websockets
; (5556)
(let [host "0.0.0.0"]
  (tcp-server {:host host})
  (udp-server {:host host})
  (ws-server  {:host host}))

; Expire old events from the index every hour.
(periodically-expire 3600)

(let [index (index)]
  ; Inbound events will be passed to these streams:
  (streams
    (default :ttl 60
      ; Index all events immediately.
      index

      ; Log expired events.
      (expired
        (fn [event] (info "expired" event))))))

(def graph (graphite {:host "graphite.example.com"}))

; Note #() is the Clojure construct to build an anonymous function
(defn notify [ recipient ] 
    (let [ email (mailer { :from "nagios@example.com" } ) ]
; Make copies of the incoming stream to be handled by different adapters
        (by :service
; Log
            #(info "Notifying about " %)
; Send to Graphite
            #(graph %)
; Notify via email.
            (email recipient)
        )
    )
)
(streams
    (where (re-matches #"tst-clk-app-00.*" host)
        (by :service
; Debug logging for matched events
;            #(info %)
;  ddt takes the difference between metric values.
; d(metric)/dt
; If you send a constant value, this will always return 0.
;            (ddt 60 
;                (with {:description "Clicks, ddt"}
;                     (pipe -
;                         (splitp > metric
;                               5.0 (with :state "critical" - )
;                             100.0 (with :state "warning"  - )
;                                   (with :state "ok"       - )
;                         )
;                         (notify "luser@example.com")
;                     )
;                )
;            )
; -> is one of the Swiss arrow functions in Clojure
; http://clojuredocs.org/clojure.core/-> because this is hard to google for.
            ( ->
                (rate 60
                    (with {:description "Clicks, ddt" :service "Click"}
                         (pipe -
                             (splitp > metric
                                   5.0 (with :state "critical" - )
                                 160.0 (with :state "warning"  - )
                                       (with :state "ok"       - )
                             )
                             (notify "luser@example.com")
                         )
                    )
; Due to the ->, ddt gets the output of rate as a stream and processes it via the with block.
                    ( ddt
                        (with {:description "Clicks, ddt" :service "click_rate_accel"}
                             (pipe -
                                 (splitp > metric
                                       5.0 (with :state "critical" - )
                                     160.0 (with :state "warning"  - )
                                           (with :state "ok"       - )
                                 )
                                 (notify "luser@example.com")
                             )
                        )
                    )
                )
            )
        )
;  Enable debug logging for unhandled events
;        (else
;            #(info %)
;        )
    )
)