clients

// The clients of a Redis server, by SSH and redis-cli INFO on its server: the clients connected, those blocked
// on a blocking command, and the connections refused because maxclients was reached. The password, when Redis
// asks for one, stays on the server.
need('protocol:ssh');
$port = variable('redis:port', 'integer', array(
    'label'   => 'Port',
    'help'    => 'The port Redis listens on, on the server itself.',
    'default' => 6379,
));
$password_file = variable('redis:password-file', 'text', array(
    'label'    => 'Password file',
    'help'     => 'The path, on the server, of a file the SSH account reads and that holds the Redis password alone, for instance /home/monitoring/.redis-password. Empty: no password.',
    'required' => false,
));

output('clients', 'number', array('label' => 'Clients connected'));
output('blocked', 'number', array('label' => 'Clients blocked'));
output('rejected', 'number', array('label' => 'Connections refused at maxclients since start'));

watch.increase('rejected', 'Connections refused', 'rejected', array('critical' => 0, 'window' => '1 h'));
watch.above('many', 'Many clients', 'clients', array('enabled' => false));
watch.above('blocked', 'Clients blocked', 'blocked', array('warning' => 10, 'for' => '3 runs', 'enabled' => false));

// INFO through redis-cli, to the Redis of the server on its port: one line "field:value" per figure. A
// password goes from its file into REDISCLI_AUTH, which redis-cli reads, by the shell of the server: it is
// never written on a command line, and never leaves the server. LC_ALL=C keeps the messages in English.
function redis_info($port, $password_file) {
    $command = 'LC_ALL=C redis-cli -p ' . $port;
    if ($password_file != '') {
        if (list.count(text.match($password_file, '^/[A-Za-z0-9_./-]+$')) == 0) {
            fail('misconfigured', 'The password file must be an absolute path of letters, digits and . _ / -');
        }
        $command = 'REDISCLI_AUTH="$(cat \'' . $password_file . '\')" ' . $command;
    }
    $read = ssh.run($command . ' INFO');
    $said = $read['output'] . $read['errors'];
    if (!text.contains($read['output'], 'redis_version:')) {
        if (text.contains($said, 'Could not connect') || text.contains($said, 'Connection refused')) {
            fail('critical', 'Redis is not running', $said);
        }
        if (list.count(text.match($said, 'NOAUTH|WRONGPASS|NOPERM|invalid password')) > 0) {
            fail('misconfigured', 'Redis refuses the account', $said);
        }
        fail('misconfigured', 'redis-cli did not answer INFO', $said);
    }
    $info = array();
    foreach (text.lines($read['output']) as $line) {
        $m = text.match($line, '^([a-z0-9_]+):(.*)$');
        if (list.count($m) > 0) {
            $info[$m[1]] = $m[2];
        }
    }
    return $info;
}

$info = redis_info($port, $password_file);

// connected_clients counts redis-cli itself; rejected_connections only grows until Redis restarts.
value('clients', $info['connected_clients']);
value('blocked', $info['blocked_clients']);
value('rejected', $info['rejected_connections']);