# Cannot get monitor.check function to write to \_monitoring Bucket

**URL:** <https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431>\
**Category:** Kapacitor\
**Tags:** influxdb-cloud-2-0\
**Created:** [January 1, 2021, 6:20pm UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431 "2021-01-01T18:20:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![tcasanova](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcasanova](https://community.influxdata.com/u/tcasanova)\
**Post date:** [January 1, 2021, 6:20pm UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431/1 "2021-01-01T18:20:23Z")

</div>

Hello guys I’m new to InfluxDB and chances are I might be overlooking something very simple.

Basically I’m trying to do an alert if a data point gets received, like a reverse deadman.

I have created a deadman alert and have gathered the flux code using the check/{checkID}/query API endpoint and edited it to my specification. I went through mutliple reformating sessions and ended up rewriting the whole thing myself based on the examples in the knowlegde base. The problem is that even though the task succesfully completed without errors with various versions of my flux code but the monitor.check function has not once written a single thing into the \_monitoring Bucket. There is no entry for my \_checkID.

This is my current code, can someone help me figure out what I’m missing?

> import “influxdata/influxdb/monitor”
> 
> import “experimental”
> 
> import “influxdata/influxdb/v1”
> 
> option task = {name: “testalarm deadman2”, every: 5m}
> 
> from(bucket: “Smart Maintenance”)
> 
> ```
> |> range(start: -10m)
> 
> |> filter(fn: (r) =>
> 
> (r["labels_description"] == "Testlabel"))
> 
> |> filter(fn: (r) =>
> 
> (r["_field"] == "event_eventId"))
> 
> |> v1.fieldsAsCols()
> 
> |> monitor.deadman(t: experimental.subDuration(from: now(), d: 90s))
> 
> |> monitor.check(
> 
> ok: (r) =>
> 
> (r["dead"]),
> 
> crit: (r) =>
> 
> (r["dead"] == false),
> 
> messageFn: (r) =>
> 
> ("Check: ${r._check_name} is: ${r._level}"),
> 
> data: {
> 
> _check_id: "0000000000000001",
> 
> _check_name: "testalarm deadman2",
> 
> _type: "deadman",
> 
> tags: {},
> 
> },
> 
> )
> 
> ```

---

<div class="post-metadata">

**Author:** ![tcasanova](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcasanova](https://community.influxdata.com/u/tcasanova)\
**Post date:** [January 4, 2021, 7:30am UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431/2 "2021-01-04T07:30:22Z")

</div>

bumping this thread because I have more than one use case where it is necessary to alert based any record being received… the deadman check i created in the UI does work (if no events received set status to OK) but as soon as I do receive an event the check doesn’t work any more either. is it possible that I’m running into a logic problem? similarly i tried to do a threshold check based on the “count” aggregate function but this always runs into “InfluxDB issues” and no data can be displayed.

---

<div class="post-metadata">

**Author:** ![thopewell](https://avatars.discourse-cdn.com/v4/letter/t/b782af/32.png) [@thopewell](https://community.influxdata.com/u/thopewell)\
**Post date:** [February 18, 2021, 7:23pm UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431/3 "2021-02-18T19:23:46Z")

</div>

> [@tcasanova](#):
>
> ```auto
> |> monitor.check(
> 
> ok: (r) =>
> 
> (r["dead"]),
> 
> crit: (r) =>
> 
> (r["dead"] == false),
> 
> messageFn: (r) =>
> 
> ("Check: ${r._check_name} is: ${r._level}"),
> 
> ```

Hi tcasanova,

I was playing around with monitor.deadman too.  
The below worked for me - I’ve swapped the logic around because I want to alert on no data. The problem I had is this only works when there has been some data in the range. For your use case, if the last time you see a datapoint is outside of the your “start: -10m” range, then your query might return “no results” and the monitor.check doesn’t do anything.  
I was running the entire task code in the query window - not sure whether you have done this, I don’t think you can rely on seeing “success” in the task logs.

```auto
    |> monitor.deadman(t: experimental.subDuration(d: 5m, from: now() ))
    |> group(columns: ["_measurement"])
    |> yield()
    |> monitor.check(
      ok: (r) => (r["dead"] == false),
      crit: (r) => (r["dead"] == true),
      messageFn: (r) => ("Check: ${r._check_name} is: ${r._level}"),
      data: data,
    )

```

The “group” statement avoids this error:

```auto
runtime error @28:8-33:6: check: found column "_field" in the group key; experimental.to() expects pivoted data

```

and the yield() statement just provides some useful output - you can check you have the “dead” column as expected before you see output from the monitor.check.  
Suggest you run the whole lot in the query window - it will still write to the \_monitor measurement and you can see exactly what is - or isn’t - happening.

Hope this helps,  
Tom

By the way, I have defined my “data” after the import statements, like:

```auto
data = {
  _check_id: "0000000000000001",
  _check_name: "testalarm deadman2",
  _type: "deadman",
  tags: {},
 }

```

---

<div class="post-metadata">

**Author:** ![tcasanova](https://avatars.discourse-cdn.com/v4/letter/t/71e660/32.png) [@tcasanova](https://community.influxdata.com/u/tcasanova)\
**Post date:** [February 19, 2021, 7:27am UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431/4 "2021-02-19T07:27:16Z")

</div>

Hi thopewell,

Thank you for your in-depth reply, your idea of using the group function is very interesting.  
I have since tried to avoid the Null/No Data situation by using the fill() function, that’s when I discovered this issue that has been known to InfluxDB since 2016 but noone has feeled compelled to solve yet:

> <https://github.com/influxdata/influxdb/issues/6967>
>
> \### Feature Request
> 
> Could be considered a bug, really a matter of perspective.
> …
> \*\*Proposal:\*\* \[Description of the feature\]
> If there is a \`fill()\` clause attached to the query, the query should return all buckets specified, even if there are no matching points.
> 
> \*\*Current behavior:\*\* \[What currently happens\]
> If the query has nothing but null results, the \`fill()\` clause is ignored.
> 
> Simple measurement with one point from yesterday:
> 
> \`\`\`
> \> select \* from fillfoo
> name: fillfoo
> \-------------
> time value
> 2016-07-05T20:20:00Z 42
> 
> \> 
> \`\`\`
> 
> Selecting a \`SUM\` with a \`GROUP BY time()\` and \`fill()\` clauses returns all expected buckets, with the \`fill()\` clause applied to buckets with no data:
> 
> \`\`\`
> \> select sum(value) from fillfoo where time \> now() - 21h group by time(4h) fill(0)
> name: fillfoo
> \-------------
> time sum
> 2016-07-05T16:00:00Z 0
> 2016-07-05T20:00:00Z 42
> 2016-07-06T00:00:00Z 0
> 2016-07-06T04:00:00Z 0
> 2016-07-06T08:00:00Z 0
> 2016-07-06T12:00:00Z 0
> 2016-07-06T16:00:00Z 0
> \`\`\`
> 
> However, if every bucket has no data, \`fill()\` is not invoked.
> 
> \`\`\`
> \> select sum(value) from fillfoo where time \> now() - 20h group by time(4h) fill(0)
> \> 
> \`\`\`
> 
> \*\*Desired behavior:\*\* \[What you would like to happen\]
> \`fill()\` should be used to populate all buckets that don't otherwise have data, including when all buckets are null.
> 
> \`\`\`
> \> select sum(value) from fillfoo where time \> now() - 20h group by time(4h) fill(0)
> name: fillfoo
> \-------------
> time sum
> 2016-07-06T00:00:00Z 0
> 2016-07-06T04:00:00Z 0
> 2016-07-06T08:00:00Z 0
> 2016-07-06T12:00:00Z 0
> 2016-07-06T16:00:00Z 0
> \`\`\`
> 
> \*\*Use case:\*\* \[Why is this important (helps with prioritizing requests)\]
> 
> This is not expected behavior and leads to user confusion when they expect \`fill()\` to always be applied:
> 
> https://groups.google.com/d/msgid/influxdb/6b233752-edd2-4523-9022-5c83dbcae344%40googlegroups.com
> https://github.com/influxdata/influxdb/issues/6412
> https://github.com/influxdata/influxdb/issues/6953

Seems like influxdb has a general problem when working with queries that return no data.  
I have decided to give Grafana a try and as it seems it was just what I needed for my project.

Not only can you define how it should handle queries that return no data, you can also share dashboards and enable anonymous access, which was necessary for my use case.

Basically I’m now running tasks that convert the string values of my events that I want to alert on into numerical values and I am alerting based on that value within grafana. In case the query returns no data I was able to define to “set state to OK” within grafana.

I think InfluxDB Cloud has quite a way to go before it can be used as an “All-In-One” solution but I’m very happy how it works together with Grafana now.

---

<div class="post-metadata">

**Author:** ![kramik1](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/kramik1/32/5932_2.png) [@kramik1](https://community.influxdata.com/u/kramik1)\
**Post date:** [April 15, 2021, 10:44pm UTC](https://community.influxdata.com/t/cannot-get-monitor-check-function-to-write-to-monitoring-bucket/17431/5 "2021-04-15T22:44:22Z")

</div>

Just wanted to say thanks for the conversation. It helped me figure out why it wasn’t reporting anything. I have some values that don’t get reported often but I figured it would write something somewhere. Using the yield function helped breakdown the steps.

As for InfluxDB UI vs Grafana, Grafana is the only way to go right now for end users. I was using chronograf for exploring data and running some internal graphs but the UI for 2.0 needs some time to mature more. I will use it for myself but I don’t want any end users playing with it.