Twitter alerts: how to integrate Pandora FMS alerts with Twitter

No, we’re not talking about Donald Trump’s latest midnight briefing to an astonished world, or a flame war between Hollywood celebrities. Instead we’re going to take a look at another kind of Twitter alert; the kind you can configure with Pandora FMS using one of the many applications to be found online and designed for this purpose. Alerting is one of the principal tasks of monitoring, and the more channels through which you can get alerts the better. In this case we’re talking about: Oysttyer project.

Installing Oysttyer

First, download and install the tool on your Pandora FMS server. You can download it from their Github project and decompile it onto your Pandora FMS server by executing the following commands:

# wget https://github.com/oysttyer/oysttyer/archive/master.zip
# unzip master.zip

Since it has been developed in perl, which is one of the Pandora FMS server dependencies, you don’t need to install any additional dependencies and can execute it right away. Getting it running is no problem, just execute the oysttyer.pl application and authorize its use on your account. The application itself will walk you through this stage:

# cd oysttyer-master
# ./oysttyer.pl

If it doesn’t work, try granting execute permissions to oysttyer.pl or execute it with perl. You should get the following messages when you first execute:

Just copy the complete URL from step 1 and paste it into a browser with your open Twitter session. Once this is done, you’ll be asked to provide access to the account and, when you confirm, a numeric code appears which you’ll need when you get to step 5 (see screenshot):

A warning will appear confirming that the petition was successful. Now you can use it to publish alerts from your Twitter account using the command line:

Using Oysttyer

Oysttyer has its own command console, from which you can view help and carry out any available command. Let’s look at the quickest and most optimal way to integrate your new tool with Pandora FMS. Rather than using Oysttyer’s own command console, execute the commands from the OS’s terminal.

The two basic actions which most interest us here are: to publish a tweet and to send a private message. There is a multitude of additional options, but here we’ll just take a look at what’s necessary to be able to work with Pandora FMS’s alerts system.

Firstly, do a check on both actions from the Oysttyer console:

# ./oysttyer.pl
oysttyer> publishing test tweet

You should see “publishing test tweet”, simple as that. Now try sending a private message. Obviously, the other contact needs to be following your account:

# ./oysttyer.pl
oysttyer> /dm @system_administrator private message

In the previous example @testing_alerts2 is substituted for the Twitter contact to whom the message is going to be sent. If both actions have been successful you won’t see a confirmation message, but a warning will appear in case there’s a problem.

Now that you’ve checked that the actions are correctly working, execute them from your system’s terminal without going through the Oysttyer console. This way you’ll only need echo and the tubes or pipes “|”.

Public Tweet:

echo “This is a public tweet from command line” | ./oysttyer.pl &>/dev/null

Private message:

echo “/dm @system_administrator private message from terminal” | ./oysttyer.pl &>/dev/null

Configure alerts on Pandora FMS

Now that your Pandora server is ready to interact with Twitter configure the alerts on Pandora FMS to use the utility with real cases, to both publish tweets and send private messages.

Publishing an alert tweet with Pandora FMS

Define the command or call, so that you are directed to the corresponding section and decide the execution as in the previous examples:

Alert commands section:

Definition of the command to execute:

This execution (see screenshot above) is the following (in a single line):

echo "Alert fired from agent: _agent_ on module: _module_ at _timestamp_" | /usr/share/pandora_server/util/oysttyer-master/oysttyer.pl &>/dev/null

The _agent_, _module_ and _timestamp_ parameters are macros that Pandora  FMS substitutes for real values when the alert is triggered, in this case, the agent’s name, the name of the module and the exact moment of the situation that triggered the alert. The redirection &>/dev/null makes the alert execute “silently” without displaying error messages or a warning on your server terminal.

Now create the action following these brief steps.

Actions section:

Configure the action:

The above screenshot shows the command for this case, i.e. Twitter publication. Now you can create a template or use an already available one. In the second case, create a simple template to define the triggering conditions: the alert will fire when a module passes to critical status.

Descriptive parameters on a template:

Trigger conditions, timing and default action:

The third step, Advanced fields can be left as default, as it isn’t used in this case. Once the alert is defined it can be associated with a module, so that when the module passes to critical, a warning will be published on Twitter. Access the admin section of any agent’s alerts section, and fill out the form by choosing the module, action (or not, if you’ve already established a default action in the previous step), and the template:

The alert will fire when the Free_RAM passes to critical status. These trigger conditions are defined on the template, which executes the default action.

If you follow all the above steps, when your module passes to critical status you will see the result of the alert execution as a tweet in the account you’ve used:

Sending private messages with a Pandora FMS alert

Configuring this kind of alert is basically the same as the one previously explained, the only difference being the command executed when the alert is triggered. Let’s go over them again, and take a look at the command you’re going to use.

Creating a private message command:

Use the following command (in a single line):

echo "/dm @pandora_alerts2 Private twitter notification for critical status on: _agent_ / _module_ at _timestamp_" |/usr/share/pandora/server/util/oysttyer-master/oysttyer.pl &>/dev/null

Substitute @pandora_alerts2 for the Twitter contact to whom you want to send the message. The address &>/dev/null avoids error messages appearing on your server terminal when you execute the alert, ensuring that they are launched “silently”.

Creating an action:

In the next case, now that you’ve already defined a template with the trigger conditions, let’s reuse it, but this time to indicate that the action to execute isn’t the default action associated with that template, but a new action that you’ve just created.

As seen in the previous screenshots, for this case you’ll need a receiver address belonging to a Twitter follower of the account you’re using to send your Pandora FMS alerts to. In this case we’re using the recipient account “@pandora_alerts2”.

Associating a module:

How the alert will look:

If all the configuration steps have been followed correctly, and everything works you should see the following private message in the @pandora_alerts2 account when there’s a situation:

As well as the cases we’ve already seen, Oysttyer is also capable of performing many other actions, even autonomously operating a Twitter account via the different options available, so from this point onward feel empowered to explore the integration options you prefer.

Scaling alerts

Apart from the simple alerts already looked at, Pandora FMS supports alert scaling, making it possible to execute other actions in case of repeated alerts. Here’s how to configure an alert in order to publish a tweet the first times a critical situation is produced, and how to scale alerts after repeated warnings in order to send a private message.

In the two previous sections you can see in detail how to individually configure public alert tweets and private messages.

To configure aggregated actions which are scaled to the existing alert from the agent’s alerts section first you have to define the basic alert, in this case a public tweet, which is our “Critical status” template’s default action:

When you have the basic alert add the new scaled actions in the following way:

Specify the new action and the range of coincidences in which it will be applied: