Answers: <p><a href="https://sensuapp.org/docs/0.28/reference/plugins.html#check-definition-attributes" rel="nofollow noreferrer">https://sensuapp.org/docs/0.28/reference/plugins.html#check-definition-attributes</a></p>
  
  <p>The <code>occurrences</code> as defined in the other answer was required (+1). The <code>refresh</code> and <code>interval</code> were needed as well.</p>
  
  <p>Refresh and occurrences had to be assigned to a check. It was not needed to change the handlers.</p>
  
  <pre><code>"a-check": {
    "command": "echo hello"
    "occurrences": 6,
    "refresh": 60,
    "interval": 10
  },
  </code></pre>
  
  <p><a href="https://gist.github.com/calebhailey/8a30a00c6aadfebf7f767444f0a3df49" rel="nofollow noreferrer">https://gist.github.com/calebhailey/8a30a00c6aadfebf7f767444f0a3df49</a></p>
  
  <p>The <code>interval</code> means after how many seconds a check is executed. The refresh means that after <code>60 seconds</code> a notification is sent and the occurrences mean that if within 60 seconds the event was triggered 6 times that a notification will be sent.</p>
  
  <p>It seems like the formula is as follows:</p>
  
  <p><code>occurrences</code> * <code>interval</code> = <code>refresh</code></p>
  
  <p><code>10</code>          * <code>10</code>       = <code>100</code></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-07T09:58:18.903Z
Answers: 2017-08-07T12:21:38.077Z
Answers: 2017-08-07T12:21:38.077Z
Answers: 030
Answers: <p>You want to use <a href="https://github.com/sensu-extensions/sensu-extensions-occurrences/" rel="nofollow noreferrer">the <code>occurrences</code> filter</a>, which is included <a href="https://sensuapp.org/docs/0.28/reference/plugins.html#check-definition-attributes" rel="nofollow noreferrer">by default in Sensu</a>.</p>
  
  <p>First, apply the filter to your handlers:</p>
  
  <pre><code>{
    "handlers": {
      "email": {
        "...": "...",
        "filters": ["occurrences"]
      }
    }
  }
  </code></pre>
  
  <p>Then, in your check, you can use the <code>occurrences</code> attribute to only trigger the handler once the check fails or warns a certain number of times in a row:</p>
  
  <pre><code>{
    "checks": {
      "check-http": {
        "...": "...",
        "occurrences": 2
      }
    }
  }
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-06-10T17:34:08.607Z
Answers: 2017-08-07T13:37:19.897Z
Answers: 2017-08-07T13:37:19.897Z
Answers: Xiong Chiamiov
Body: <p>A certain check works, but it should be checked multiple times within a certain range before a user gets notified.</p>
  
  <p>There are <a href="https://sensuapp.org/docs/latest/reference/checks.html#check-attributes" rel="nofollow noreferrer">multiple Sensu attributes</a> that could be configured. This list has been consulted, but no solution was found. Is it possible to mark a check as warning or error if a check fails multiple times in a certain time range?</p>
  
  <p>Perhaps <a href="https://sensuapp.org/docs/latest/reference/aggregates.html" rel="nofollow noreferrer">aggregates</a> would be an option, but should this not be used for multiple clients instead of using it for one check?</p>
  
  <blockquote>
  <pre><code>{
    "clients": 15,
    "checks": 2,
    "results": {
      "ok": 18,
      "warning": 0,
      "critical": 1,
      "unknown": 0,
      "total": 19,
      "stale": 0
    }
  }
  </code></pre>
  </blockquote>
  
Comments: CC BY-SA 3.0
Comments: 2017-06-08T17:26:07.503Z
Comments: Take a look at Sensu filters and you will probably find out how to do it! Then write the answer here!
Comments: Kobbe
Tags: <sensu>
Title: How to mark a check as warning or error if a check fails multiple times within a certain time range using Sensu?
UserDisplayName: 030
ThreadText: # How to mark a check as warning or error if a check fails multiple times within a certain time range using Sensu?
  
  (Asked by: username_0 on 2017-06-08)
  
  A certain check works, but it should be checked multiple times within a certain range before a user gets notified.
  
  There are [multiple Sensu attributes](https://sensuapp.org/docs/latest/reference/checks.html#check-attributes) that could be configured. This list has been consulted, but no solution was found. Is it possible to mark a check as warning or error if a check fails multiple times in a certain time range?
  
  Perhaps [aggregates](https://sensuapp.org/docs/latest/reference/aggregates.html) would be an option, but should this not be used for multiple clients instead of using it for one check?
  
  > ```
  > {
  >   "clients": 15,
  >   "checks": 2,
  >   "results": {
  >     "ok": 18,
  >     "warning": 0,
  >     "critical": 1,
  >     "unknown": 0,
  >     "total": 19,
  >     "stale": 0
  >   }
  > }
  >
  > ```
  
  **Tags:** sensu
  
  > **Comments:**
  > **username_1**: Take a look at Sensu filters and you will probably find out how to do it! Then write the answer here!  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-06-10. Score: 4 | Accepted answer
  
  You want to use [the `occurrences` filter](https://github.com/sensu-extensions/sensu-extensions-occurrences/), which is included [by default in Sensu](https://sensuapp.org/docs/0.28/reference/plugins.html#check-definition-attributes).
  
  First, apply the filter to your handlers:
  
  ```
  {
    "handlers": {
      "email": {
        "...": "...",
        "filters": ["occurrences"]
      }
    }
  }
  
  ```
  
  Then, in your check, you can use the `occurrences` attribute to only trigger the handler once the check fails or warns a certain number of times in a row:
  
  ```
  {
    "checks": {
      "check-http": {
        "...": "...",
        "occurrences": 2
      }
    }
  }
  
  ```
  
  
  ---
  
  ### Answer by username_0 on 2017-08-07. Score: 1
  
  <https://sensuapp.org/docs/0.28/reference/plugins.html#check-definition-attributes>
  
  The `occurrences` as defined in the other answer was required (+1). The `refresh` and `interval` were needed as well.
  
  Refresh and occurrences had to be assigned to a check. It was not needed to change the handlers.
  
  ```
  "a-check": {
    "command": "echo hello"
    "occurrences": 6,
    "refresh": 60,
    "interval": 10
  },
  
  ```
  
  <https://gist.github.com/calebhailey/8a30a00c6aadfebf7f767444f0a3df49>
  
  The `interval` means after how many seconds a check is executed. The refresh means that after `60 seconds` a notification is sent and the occurrences mean that if within 60 seconds the event was triggered 6 times that a notification will be sent.
  
  It seems like the formula is as follows:
  
  `occurrences` \* `interval` = `refresh`
  
  `10` \* `10` = `100`
  
  
  ---
  
  