# TICK Script for alert Host down

**URL:** <https://community.influxdata.com/t/tick-script-for-alert-host-down/971>\
**Category:** Kapacitor\
**Tags:** kapacitor\
**Created:** [May 18, 2017, 1:24pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971 "2017-05-18T13:24:00Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![gon](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@gon](https://community.influxdata.com/u/gon)\
**Post date:** [May 18, 2017, 1:24pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/1 "2017-05-18T13:24:00Z")

</div>

Hi,

I’m noob using Kapacitor and influxdb, but, I created 3 alerts (cpu,mem and disk) for differents hosts and they are working fine.  
Now, I want to create and alert that notify me if a host/server is down or offline.  
I read about deadman and created and alert, but, I think it doesn’t work:

`````auto
|from()
 .database('telegraf')
 .retentionPolicy('autogen')
 .measurement('system')
|deadman(1.0, 10s)
 .message('Server {{ index .Tags "node" }} DOWN!')
 .hipChat()
 .stateChangesOnly()````

I think that something is wrong, but I can't find ane example for my case.

Any ideas?
`````

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/michael/32/2902_2.png) [@michael](https://community.influxdata.com/u/michael)\
**Post date:** [May 18, 2017, 5:45pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/2 "2017-05-18T17:45:09Z")

</div>

Hey @gon can you include a bit more information. In particular the output of

```auto
kapacitor show <task>

```

---

<div class="post-metadata">

**Author:** ![gon](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@gon](https://community.influxdata.com/u/gon)\
**Post date:** [May 19, 2017, 7:32am UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/3 "2017-05-19T07:32:44Z")

</div>

Hi @michael,

thanks for answer me.  
Yes, This is the output of `kapacitor show deadman_alert_stream`

```
root@52d4eb22efe9:~# kapacitor show deadman_alert_stream
ID: deadman_alert_stream
Error:
Template:
Type: stream
Status: enabled
Executing: true
Created: 18 May 17 11:56 UTC
Modified: 18 May 17 15:08 UTC
LastEnabled: 18 May 17 15:08 UTC
Databases Retention Policies: ["telegraf"."autogen"]
TICKscript:
var data = stream
    |from()
        .database('telegraf')
        .retentionPolicy('autogen')
        .measurement('system')
    |deadman(0.0, 10s)
        .id('{{ index .Tags "node" }}')
        .message('Server {{ .ID }} is OFFLINE')
        .hipChat()
        .stateChangesOnly()

DOT:
digraph deadman_alert_stream {
graph [throughput="0.00 points/s"];

stream0 [avg_exec_time_ns="0s"];
stream0 -> from1 [processed="138890"];

from1 [avg_exec_time_ns="9.168µs"];
from1 -> noop3 [processed="138890"];

noop3 [avg_exec_time_ns="0s"];

stats2 [avg_exec_time_ns="26.445µs"];
stats2 -> derivative4 [processed="5787"];

derivative4 [avg_exec_time_ns="6.432µs"];
derivative4 -> alert5 [processed="5786"];

alert5 [alerts_triggered="0" avg_exec_time_ns="77.149µs" crits_triggered="0" infos_triggered="0" oks_triggered="0" warns_triggered="0"];
}

```

Do you need more info?

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/michael/32/2902_2.png) [@michael](https://community.influxdata.com/u/michael)\
**Post date:** [May 19, 2017, 2:17pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/4 "2017-05-19T14:17:37Z")

</div>

Try changing the deadman to the following

```auto
...
  |deadman(1.0, 10s)
        .id('{{ index .Tags "node" }}')
        .message('Server {{ .ID }} is OFFLINE')
        .hipChat()
        .stateChangesOnly()

```

---

<div class="post-metadata">

**Author:** ![gon](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@gon](https://community.influxdata.com/u/gon)\
**Post date:** [May 22, 2017, 9:39am UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/5 "2017-05-22T09:39:11Z")

</div>

Hi again @michael

I modified deadman tick script as you show me. Then, I stopped a machine that sends data to influxdb by telegraf, but the deadman alert does trigger.

```
root@52d4eb22efe9:~# kapacitor show deadman_alert_stream
ID: deadman_alert_stream
Error:
Template:
Type: stream
Status: enabled
Executing: true
Created: 18 May 17 11:56 UTC
Modified: 22 May 17 08:50 UTC
LastEnabled: 22 May 17 08:50 UTC
Databases Retention Policies: ["telegraf"."autogen"]
TICKscript:
var data = stream
    |from()
        .database('telegraf')
        .retentionPolicy('autogen')
        .measurement('system')
    |deadman(1.0, 10s)
        .id('{{ index .Tags "node" }}')
        .message('Server {{ .ID }} is OFFLINE')
        .hipChat()
        .stateChangesOnly()

DOT:
digraph deadman_alert_stream {
graph [throughput="0.00 points/s"];

stream0 [avg_exec_time_ns="0s"];
stream0 -> from1 [processed="6764"];

from1 [avg_exec_time_ns="1.213µs"];
from1 -> noop3 [processed="6764"];

noop3 [avg_exec_time_ns="0s"];

stats2 [avg_exec_time_ns="24.136µs"];
stats2 -> derivative4 [processed="279"];

derivative4 [avg_exec_time_ns="6.478µs"];
derivative4 -> alert5 [processed="278"];

alert5 [alerts_triggered="0" avg_exec_time_ns="75.662µs" crits_triggered="0" infos_triggered="0" oks_triggered="0" warns_triggered="0"];
}

```

Any idea?  
Thanks for your help

---

<div class="post-metadata">

**Author:** ![michael](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/michael/32/2902_2.png) [@michael](https://community.influxdata.com/u/michael)\
**Post date:** [May 22, 2017, 2:26pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/6 "2017-05-22T14:26:31Z")

</div>

Ah, You don’t have a `.groupBy(*)` so it still thinks its receiving data. Try the following

```auto
var data = stream
    |from()
        .database('telegraf')
        .retentionPolicy('autogen')
        .measurement('system')
        .groupBy(*)
    |deadman(1.0, 10s)
        .id('{{ index .Tags "node" }}')
        .message('Server {{ .ID }} is OFFLINE')
        .hipChat()
        .stateChangesOnly()

```

---

<div class="post-metadata">

**Author:** ![gon](https://avatars.discourse-cdn.com/v4/letter/g/cab0a1/32.png) [@gon](https://community.influxdata.com/u/gon)\
**Post date:** [May 22, 2017, 2:49pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/7 "2017-05-22T14:49:43Z")

</div>

> [@michael](#):
>
> 1.

It’s works! Thanks a lot!

---

<div class="post-metadata">

**Author:** ![fchiorascu](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/fchiorascu/32/995_2.png) [@fchiorascu](https://community.influxdata.com/u/fchiorascu)\
**Post date:** [January 6, 2018, 5:31pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/8 "2018-01-06T17:31:17Z")

</div>

Hi,

I can have something similar for Host - UP/ DOWN using telegraf + InlfuxDB + Grafana an not having Kapacitor?  
I could do something with Grafana “Alert”?

Kind Regards,

---

<div class="post-metadata">

**Author:** ![veymarjoe](https://avatars.discourse-cdn.com/v4/letter/v/5fc32e/32.png) [@veymarjoe](https://community.influxdata.com/u/veymarjoe)\
**Post date:** [August 23, 2018, 2:24pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/10 "2018-08-23T14:24:59Z")

</div>

Hello I have the same problem, and I add the groupBy(\*) sentence, but nothing seems to happen. this is my task:

ID: webserver\_health  
Error:  
Template:  
Type: stream  
Status: enabled  
Executing: true  
Created: 16 Aug 18 12:25 UTC  
Modified: 23 Aug 18 13:46 UTC  
LastEnabled: 23 Aug 18 13:46 UTC  
Databases Retention Policies: [“telegraf.dev”.“dev”]  
TICKscript:  
dbrp “telegraf.dev”.“dev”

stream  
|from()  
.measurement(‘httpjson\_webserver\_stats’)  
.groupBy(\*)  
|deadman(1.0, 10s)  
.message(‘Be-services is offline’)  
.stateChangesOnly()  
.slack()  
.channel(’#kapacitortests’)

DOT:  
digraph webserver\_health {  
graph [throughput=“0.00 points/s”];

stream0 [avg\_exec\_time\_ns=“0s” errors=“0” working\_cardinality=“0”];  
stream0 -\> from1 [processed=“166”];

from1 [avg\_exec\_time\_ns=“11.396µs” errors=“0” working\_cardinality=“0”];  
from1 -\> noop3 [processed=“166”];

noop3 [avg\_exec\_time\_ns=“0s” errors=“0” working\_cardinality=“0”];

stats2 [avg\_exec\_time\_ns=“37.684µs” errors=“0” working\_cardinality=“0”];  
stats2 -\> derivative4 [processed=“190”];

derivative4 [avg\_exec\_time\_ns=“6.752µs” errors=“0” working\_cardinality=“2”];  
derivative4 -\> alert5 [processed=“188”];

alert5 [alerts\_inhibited=“0” alerts\_triggered=“0” avg\_exec\_time\_ns=“39.059µs” crits\_triggered=“0” errors=“0” infos\_triggered=“0” oks\_triggered=“0” warns\_triggered=“0” working\_cardinality=“1”];  
}

Please you have any Idea. thanks

---

<div class="post-metadata">

**Author:** ![virajrathod](https://avatars.discourse-cdn.com/v4/letter/v/a88e57/32.png) [@virajrathod](https://community.influxdata.com/u/virajrathod)\
**Post date:** [April 16, 2019, 12:45pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/11 "2019-04-16T12:45:15Z")

</div>

Hey @michael  
I am using kapacitor v1.5 and I want alerting to be set on a metric whenever the “Active” changes.

This is the code I am using.  
var info = 1  
var warn = 2  
var crit = 3  
var period = 15s  
var every = 15s

// Dataframe  
var data = batch  
|query('SELECT ActiveBaselineNodes AS Active FROM “telegraf\_ignite\_sit”.“autogen”.“kernel\_cluster\_metrics” ')  
.groupBy(‘host’)  
.period(period)  
.every(every)

// Thresholds  
var alert = data  
|alert()  
.id(’{{ index .Tags “host”}}/baselinenodes’)  
.message(’{{ .ID }}:{{ index .Fields “Active” }}’)  
// .info(lambda: “Active” \> info)  
// .warn(lambda: “Active” \> warn)  
// .crit(lambda: “Active” \> crit)  
.stateChangesOnly()  
.slack()  
.log(’/data/kapacitor\_alerts/ignite/activebaseline.txt’)

How should I use stateChangesOnly()? I don’t want to statically define the comparing parameters.

---

<div class="post-metadata">

**Author:** ![MarcV](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/marcv/32/7676_2.png) [@MarcV](https://community.influxdata.com/u/MarcV)\
**Post date:** [April 16, 2019, 12:52pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/12 "2019-04-16T12:52:29Z")

</div>

HI @virajrathod welcome ,

I think you can use the ChangeDetectNode …

> **[ChangeDetectNode (Kapacitor TICKscript node) | Kapacitor 1.6 Documentation](https://docs.influxdata.com/kapacitor/v1.5/nodes/change_detect_node/)**
>
> ChangeDetectNode creates a new node that only emits new points if different from the previous point.

followed by the alertNode …

---

<div class="post-metadata">

**Author:** ![virajrathod](https://avatars.discourse-cdn.com/v4/letter/v/a88e57/32.png) [@virajrathod](https://community.influxdata.com/u/virajrathod)\
**Post date:** [April 16, 2019, 1:22pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/13 "2019-04-16T13:22:36Z")

</div>

Hi @MarcV,  
I need to put up the alert only when the number of nodes go down and not on state change.

---

<div class="post-metadata">

**Author:** ![MarcV](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/marcv/32/7676_2.png) [@MarcV](https://community.influxdata.com/u/MarcV)\
**Post date:** [April 16, 2019, 1:29pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/14 "2019-04-16T13:29:57Z")

</div>

Hi ,

> [@](#):
>
> I want alerting to be set on a metric whenever the “Active” changes.

> [@](#):
>
> SELECT ActiveBaselineNodes AS Active

> [@](#):
>
> only when the number of nodes go down

You want an alert when the ActiveBaselineNodes is lower than the previous value ?

---

<div class="post-metadata">

**Author:** ![virajrathod](https://avatars.discourse-cdn.com/v4/letter/v/a88e57/32.png) [@virajrathod](https://community.influxdata.com/u/virajrathod)\
**Post date:** [April 16, 2019, 1:32pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/15 "2019-04-16T13:32:27Z")

</div>

Yes  
Correct.

I want the Active to give alerts when the ActiveBaselineNodes value is lower than previously check value.

---

<div class="post-metadata">

**Author:** ![MarcV](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/marcv/32/7676_2.png) [@MarcV](https://community.influxdata.com/u/MarcV)\
**Post date:** [April 16, 2019, 1:34pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/16 "2019-04-16T13:34:19Z")

</div>

Okay ,

then maybe this one is for you : [difference](https://docs.influxdata.com/kapacitor/v1.5/nodes/query_node/#difference)  
if the difference is negative , the ActiveBaselineNodes is lower than the previous …

---

<div class="post-metadata">

**Author:** ![ram0973](https://sea1.discourse-cdn.com/flex023/user_avatar/community.influxdata.com/ram0973/32/3355_2.png) [@ram0973](https://community.influxdata.com/u/ram0973)\
**Post date:** [July 23, 2019, 1:49pm UTC](https://community.influxdata.com/t/tick-script-for-alert-host-down/971/17 "2019-07-23T13:49:01Z")

</div>

Good day, can you explain, please, how to do alert like nagios:  
Check host every 10 second, if host is down, send message: “Host is down”,  
continue check host every 10 second, and send repeated messages “Host is down” ONLY ONCE in 1-2 hours, or even just ONCE. When host will up, send message “Host is up”. Thanks in advance.  
When I tried to do this, messages come every 10 seconds, even if .stateChangesOnly() is stated.