sensu-plugins-redis

Sensu Go checks for Redis:

• check-redis-alive: the server answers PING;
• check-redis-memory: memory used by the server (used_memory), in MB or in % of maxmemory, against warning and critical thresholds.

Static Go binaries (no CGO, no Ruby runtime): one asset for every Linux distribution, amd64 only.

Behavior

check-redis-alive:

Situation	State
PING answers PONG	OK
Other answer, connection refused, timeout, authentication error	CRITICAL
Invalid argument	UNKNOWN

check-redis-memory reads INFO memory and compares used_memory in % of maxmemory (default thresholds 80 / 90), or of total_system_memory when maxmemory is not set (0). With --percentage=false, it is compared in MB. Values are rounded to the nearest integer, a threshold is reached when the value is greater than or equal to it. In percentage mode the output shows the reference and, with maxmemory, the eviction policy: 50% used / 20% limit (maxmemory 100MB, volatile-lru).

With noeviction, or volatile-lru once no key with a TTL is left, Redis rejects writes when maxmemory is reached. On a volatile-lru instance used as a cache, running close to maxmemory is normal: raise the thresholds for that host (e.g. redis_memory_warning: "95", redis_memory_critical: "98").

Situation	State
Below --warning	OK
--warning reached	WARNING
--critical reached	CRITICAL
Connection refused, timeout, authentication error	CRITICAL
Invalid argument (threshold ≤ 0, warning above critical, critical above 100 in percentage mode), field missing from INFO memory	UNKNOWN

Usage

check-redis-alive [flags]
  -H, --host string       Redis host, e.g. 127.0.0.1 (required)
  -p, --port int          Redis port, e.g. 6379 (required)
  -P, --password string   Redis password (requirepass), "none" for no password
      --timeout int       Timeout of the whole check in seconds (default 10)

check-redis-memory [flags]
  -H, --host string       Redis host, e.g. 127.0.0.1 (required)
  -p, --port int          Redis port, e.g. 6379 (required)
  -P, --password string   Redis password (requirepass), "none" for no password
      --timeout int       Timeout of the whole check in seconds (default 10)
  -w, --warning int       Warning threshold, in % (or in MB with --percentage=false) (default 80)
  -c, --critical int      Critical threshold, in % (or in MB with --percentage=false) (default 90)
  -a, --percentage        Thresholds are percentages of maxmemory (of the system memory when maxmemory is not set); false for MB (default true)

Every option can also be set with an environment variable, which keeps the password out of the process list:

Option	Variable	Annotation
--host	CHECK_REDIS_HOST	redis_host
--port	CHECK_REDIS_PORT	redis_port
--password	CHECK_REDIS_PASSWORD	redis_password
--timeout	CHECK_REDIS_TIMEOUT	redis_timeout
--warning	CHECK_REDIS_MEMORY_WARNING	redis_memory_warning
--critical	CHECK_REDIS_MEMORY_CRITICAL	redis_memory_critical
--percentage	CHECK_REDIS_MEMORY_PERCENTAGE (true/false)	redis_memory_percentage

Examples:

check-redis-alive -H 127.0.0.1 -p 6379                                 # password in CHECK_REDIS_PASSWORD
check-redis-memory -H 127.0.0.1 -p 6379                                # 80 / 90 % of maxmemory
check-redis-memory -H 127.0.0.1 -p 6379 --percentage=false -w 1024 -c 2048  # MB

Check definitions

Options are passed through env_vars, filled per host from entity annotations with token substitution (applied by the agent to the whole check definition, env_vars included). One annotation maps to one option.

Naming rule: an annotation is named after its environment variable, lowercased, without the CHECK_ prefix (CHECK_REDIS_HOST → redis_host).

• Every token has a non-empty default: Sensu rejects an empty env_vars value (FOO=) and then silently skips the check, without any event. Never use | default "" there.
• Host-specific values (host, port) have their default in the check definition only; technical settings (thresholds, percentage) have the same default in the plugin and in the check definition.
• The password defaults to none, which means no password: an empty value would make the agent skip the check, and Redis rejects AUTH when no password is configured. A real password cannot be the literal none.

Annotations, e.g. in the agent configuration (/etc/sensu/agent.yml), all optional with the definitions below:

annotations:
  redis_host: 127.0.0.1             # default 127.0.0.1
  redis_port: "6379"                # default 6379
  redis_password: secret            # requirepass, default none (no password)
  redis_memory_percentage: "true"   # default true (thresholds in % of maxmemory), "false" for MB
  redis_memory_warning: "80"        # default 80
  redis_memory_critical: "90"       # default 90

Alive

---
type: CheckConfig
api_version: core/v2
metadata:
  name: check-redis-alive
spec:
  command: check-redis-alive
  env_vars:
    - CHECK_REDIS_HOST={{ .annotations.redis_host | default "127.0.0.1" }}
    - CHECK_REDIS_PORT={{ .annotations.redis_port | default "6379" }}
    - CHECK_REDIS_PASSWORD={{ .annotations.redis_password | default "none" }}
  runtime_assets:
    - opsone/sensu-plugins-redis
  interval: 60
  timeout: 30
  publish: true
  subscriptions:
    - redis

Memory

---
type: CheckConfig
api_version: core/v2
metadata:
  name: check-redis-memory
spec:
  command: check-redis-memory
  env_vars:
    - CHECK_REDIS_HOST={{ .annotations.redis_host | default "127.0.0.1" }}
    - CHECK_REDIS_PORT={{ .annotations.redis_port | default "6379" }}
    - CHECK_REDIS_PASSWORD={{ .annotations.redis_password | default "none" }}
    - CHECK_REDIS_MEMORY_PERCENTAGE={{ .annotations.redis_memory_percentage | default "true" }}
    - CHECK_REDIS_MEMORY_WARNING={{ .annotations.redis_memory_warning | default "80" }}
    - CHECK_REDIS_MEMORY_CRITICAL={{ .annotations.redis_memory_critical | default "90" }}
  runtime_assets:
    - opsone/sensu-plugins-redis
  interval: 300
  timeout: 30
  publish: true
  subscriptions:
    - redis

Entity annotations are visible in the Sensu dashboard and API: to keep the password out of them, use Sensu secrets instead of env_vars for CHECK_REDIS_PASSWORD.

Migrating from the Ruby version (0.1.0)

• Commands lose their .rb suffix: check-redis-alive.rb → check-redis-alive, check-redis-memory.rb → check-redis-memory.
• The host shorthand is now -H (-h is --help).
• --host and --port are required (they defaulted to 127.0.0.1 and 6379); the defaults now live in the check definition.
• --db / -n is removed: PING and INFO do not depend on the selected database. Passing it now fails.
• check-redis-memory works in percentage by default (thresholds 80 / 90); MB thresholds need --percentage=false (a critical threshold above 100 in percentage mode is rejected as UNKNOWN).
• check-redis-memory --percentage is relative to maxmemory (it was relative to total_system_memory, which stays the fallback when maxmemory is not set), and computed from bytes instead of MB rounded first.
• --password (new) defaults to none, meaning no password.
• Invalid arguments and unexpected INFO output are UNKNOWN (they were CRITICAL with a generic "Could not connect" message); connection errors stay CRITICAL and give the actual cause.
• The asset no longer depends on the Ruby runtime asset, nor on the Debian release.

Build and release

make test          # go vet + unit tests
make integration   # runs the checks against real Redis servers in Docker

Release:

git tag 0.3.0 && git push origin 0.3.0
make release       # version taken from the tag, or forced: make release VERSION=0.3.0
sensuctl create -f dist/opsone-sensu-plugins-redis_0.3.0.yml

make release runs make dist, which runs the tests then produces in dist/:

• one archive per architecture listed in ARCHS (linux/amd64) in Sensu asset layout (bin/check-redis-*);
• the sha512 checksums file;
• opsone-sensu-plugins-redis_<version>.yml, the asset definition pointing to the GitHub release of the tag.

It then creates the GitHub release of the tag with gh, uploads the archives and checksums, and uses the asset definition as release description.

check-redis-alive version prints the version, commit and build date.