飞书接收CloudWatch监控告警

叔牙

发布于 2023-06-21 11:12:09

2K00

代码可运行

文章被收录于专栏：一个执拗的后端搬砖工一个执拗的后端搬砖工

运行总次数：0

代码可运行

基于aws Cloudwatch创建监控和告警后,可以将告警信息结合SNS主题和lambda函数发送通知到告警群,比如钉钉、企业微信、飞书等等。本篇我们就详细介绍下如何将Cloudwatch告警信息推送到告警群,以飞书为例。

一、准备告警接收位置

1.创建告警群

如果已经有告警群,跳过此步骤

2.添加创建机器人

复制webhook地址备用:

https://open.feishu.cn/open-apis/bot/v2/hook/xxx

二、创建lambda函数

1.创建函数

选择python环境。

2.编写函数代码

import requests
import json
import os
def lambda_handler(event,context):

    message = event['Records'][0]['Sns']
    Timestamp = message['Timestamp']
    Subject = message['Subject']
    sns_message = message['Message']
    region = message['TopicArn'].split(':')[-3]
    new_state_reason = sns_message['NewStateReason']

    if "ALARM" in Subject:

        title = '[AI生产环境] 警报！!'
    elif "OK" in Subject:

        title = '[AI生产环境] 故障恢复!'
    else:

        title = '[AI生产环境] 警报状态异常'
    content = "**【详情信息】**\n" \
              + "**时间**: " + Timestamp + "\n" \
              + "**内容**: " + Subject + "\n" \
              + "**状态**: {old} => {new}".format(old=sns_message['OldStateValue'],
                                                  new=sns_message['NewStateValue']) + "\n" \
              + "**AWS区域**: " + sns_message['Region'] + "\n" \
              + "**监控资源对象**: " + sns_message['Trigger']['Namespace'] + "\n" \
              + "**监控指标**: " + sns_message['Trigger']['MetricName'] + "\n" \
              + "**报警名称**: " + sns_message['AlarmName'] + "\n" \
              + "**报警创建方式**: " + sns_message['AlarmDescription'] + "\n" \
              + "**报警细节**: " + new_state_reason

    data_alert = {
        "msg_type": 'interactive',
        "card": {
            "config": {
                "wide_screen_mode": True
            },
            "header": {
                "template": "red",
                "title": {
                    "tag": "plain_text",
                    "content": title
                }
            },
            "elements": [
                {
                    "tag": "div",
                    "text": {
                        "tag": "lark_md",
                        "content": content
                    }
                },
            ]
        }
    }
    data_recover = {
        "msg_type": 'interactive',
        "card": {
            "config": {
                "wide_screen_mode": True
            },
            "header": {
                "template": "green",
                "title": {
                    "tag": "plain_text",
                    "content": title
                }
            },
            "elements": [
                {
                    "tag": "div",
                    "text": {
                        "tag": "lark_md",
                        "content": content
                    }
                },
            ]
        }
    }
    try:
        if "OK" in Subject:
            response = requests.post(
                "https://open.feishu.cn/open-apis/bot/v2/hook/xxx",
                json=data_recover)
        else:
            response = requests.post(
                "https://open.feishu.cn/open-apis/bot/v2/hook/xxx",
                json=data_alert)
        print(response)
        print(response.json())
    except Exception as e:
        print("err=" + str(e))
        return {"error": e}

‍

此处发送请求的地址就是前边飞书机器人的webhook地址。

3.填写测试数据

sns接收cloudwatch告警事件转发给lambda函数的数据结构可参考:

https://docs.aws.amazon.com/zh_cn/lambda/latest/dg/with-sns.html

{
  "Records": [
    {
      "EventVersion": "1.0",
      "EventSubscriptionArn": "arn:aws:sns:us-east-1:123456789012:sns-lambda:21be56ed-a058-49f5-8c98-aedd2564c486",
      "EventSource": "aws:sns",
      "Sns": {
        "SignatureVersion": "1",
        "Timestamp": "2019-01-02T12:45:07.000Z",
        "Signature": "tcc6faL2yUC6dgZdmrwh1Y4cGa/ebXEkAi6RibDsvpi+tE/1+82j...65r==",
        "SigningCertUrl": "https://sns.us-east-1.amazonaws.com/SimpleNotificationService-ac565b8b1a6c5d002d285f9598aa1d9b.pem",
        "MessageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
        "Message": {
            "AlarmName":"test-cpu-alarm",
            "AlarmDescription":"从 EC2 控制台创建",
            "AWSAccountId":"382497278384",
            "AlarmConfigurationUpdatedTimestamp":"2023-05-08T14:25:48.891+0000",
            "NewStateValue":"ALARM",
            "NewStateReason":"Threshold Crossed: 1 datapoint [10.513693396388868 (08/05/23 15:04:00)] was greater than or equal to the threshold (10.0).",
            "StateChangeTime":"2023-05-08T15:09:11.111+0000",
            "Region":"Asia Pacific (Singapore)",
            "AlarmArn":"arn:aws:cloudwatch:ap-southeast-1:382497278384:alarm:test-cpu-alarm",
            "OldStateValue":"OK",
            "OKActions":[
        
            ],
            "AlarmActions":[
                "arn:aws:sns:ap-southeast-1:382497278384:test_ec2_alarm_topic"
            ],
            "InsufficientDataActions":[
        
            ],
            "Trigger":{
                "MetricName":"CPUUtilization",
                "Namespace":"AWS/EC2",
                "StatisticType":"Statistic",
                "Statistic":"AVERAGE",
                "Unit":null,
                "Dimensions":[
                    {
                        "value":"i-0e6969aba46132ce4",
                        "name":"InstanceId"
                    }
                ],
                "Period":300,
                "EvaluationPeriods":1,
                "ComparisonOperator":"GreaterThanOrEqualToThreshold",
                "Threshold":10,
                "TreatMissingData":"",
                "EvaluateLowSampleCountPercentile":""
            }
        },
        "MessageAttributes": {
          "Test": {
            "Type": "String",
            "Value": "TestString"
          },
          "TestBinary": {
            "Type": "Binary",
            "Value": "TestBinary"
          }
        },
        "Type": "Notification",
        "UnsubscribeUrl": "https://sns.us-east-1.amazonaws.com/?Action=Unsubscribe&amp;SubscriptionArn=arn:aws:sns:us-east-1:123456789012:test-lambda:21be56ed-a058-49f5-8c98-aedd2564c486",
        "TopicArn": "arn:aws:sns:us-east-1:123456789012:sns-lambda",
        "Subject": "TestInvoke"
      }
    }
  ]
}

测试发送: