DumbMonit
DE
GitHub Live-Demo

Monitore

DNS, Mail und Sicherheit

Pi-hole, AdGuard Home, CrowdSec sowie Mailserver und Gateways: SMTP, MDaemon, SecurityGateway und Proxmox Mail Gateway. Blocklist-Prüfungen für einen Mailserver oder einen IP-Bereich.

Beschreibungen der Monitore und Texte der Alarmregeln sind wie im Produkt auf Englisch. Die Beschriftungen der Seite folgen Ihrer Sprache.

Pi-hole

pihole

The DNS ad blocker: blocking on or paused, queries and share blocked, blocklist age, upstream failures, updates and its own diagnosis messages.

Beispiele

  • Pi-hole v6 on a Raspberry Pi
  • Pi-hole in Docker

Was Sie brauchen

  • App password (recommended)Generated under Settings → Web interface / API in expert mode. It cannot change Pi-hole's settings.

Kein Konto nötig.

Standardport: 80

Mitgelieferte Alarmregeln 5

  • HinweisPi-hole blocking disabledBlocking is off, paused or failed. The hold lets a five-minute pause from the web interface go by.
  • HinweisPi-hole blocklists staleThe blocklists (gravity) have not been rebuilt for more than eight days: the weekly update fails.
  • InfoPi-hole update availableA newer version is available: the image in Docker, core, web interface or FTL otherwise. Pi-hole checks once a day.
  • InfoPi-hole diagnosis messagesPi-hole lists messages on its diagnosis page: a blocklist that failed to download, a rate-limited client, an overloaded host.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create an app password in Pi-hole

  1. In Pi-hole's web interface, open Settings → Web interface / API and switch the page from Basic to Expert.

  2. Click Configure app password, copy the password shown, then click Enable new app password.

  3. Check that Settings → All settings → Webserver and API → webserver.api.app_sudo is off, its default.

  4. In DumbMonit, enter Pi-hole's address and paste the app password, or pick No password if the web interface has none.

Hinweis. Pi-hole v6 or later is required; the app password can still pause blocking and edit lists through the API, so keep it for DumbMonit only.

Dokumentation

AdGuard Home

adguard

The DNS filter: protection on or paused, queries and blocks, filter lists that stopped updating, upstream servers that fail, updates.

Beispiele

  • AdGuard Home
  • AdGuard Home on OpenWrt or a NAS

Was Sie brauchen

  • User name / passwordThe dedicated user added to AdGuardHome.yaml, sent as HTTP basic authentication.

Kein Konto nötig.

Standardport: 80

Mitgelieferte Alarmregeln 6

  • HinweisAdGuard Home protection offProtection disabled, or paused and not back yet.
  • WarnungAdGuard Home DNS not runningThe web interface answers but the DNS server is stopped.
  • HinweisAdGuard Home upstream failingAn upstream DNS server fails AdGuard Home's own test, or stays silent 4 seconds.
  • HinweisAdGuard Home filter lists staleThe oldest update of an enabled filter list is more than three days old.
  • InfoAdGuard Home update availableA newer version is announced by AdGuard Home's own version check; never fires when that check is disabled, as in the official Docker image.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Add a user for DumbMonit to AdGuard Home

  1. Make a bcrypt hash of a long random password (htpasswd comes with apache2-utils or httpd-tools).

    htpasswd -B -C 10 -n -b dumbmonit 'LONG-RANDOM-PASSWORD'

  2. Stop AdGuard Home, add this line under users: in AdGuardHome.yaml with HASH replaced by the printed hash, then start it again.

    - { name: dumbmonit, password: "HASH" }

  3. In DumbMonit, enter the address of the AdGuard Home web interface, then the user dumbmonit and its password.

Hinweis. AdGuard Home has no read-only user, so dumbmonit can change every setting: keep its password to DumbMonit alone, and turn on HTTPS in Settings → Encryption settings across an untrusted network.

Dokumentation

CrowdSec

crowdsec

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

Beispiele

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

Was Sie brauchen

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

Kein Konto nötig.

Standardport: 6060

Mitgelieferte Alarmregeln 4

  • WarnungCrowdSec Local API downThe Local API does not answer /health.
  • HinweisCrowdSec bouncer stopped pullingA bouncer's requests did not change in 30 minutes (changes_prometheus(dumbmonit_crowdsec_bouncer_requests_total[30m])).
  • HinweisCrowdSec reads no logsNot a single log line read in six hours (increase_prometheus(dumbmonit_crowdsec_lines_read_total[6h])).
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

Hinweis. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

Dokumentation

Mail relay (SMTP)

smtp

A mail server greets, offers STARTTLS and accepts a login, like a real client.

Beispiele

  • Your provider's SMTP relay
  • A local Postfix or msmtp
  • Proxmox Mail Gateway
  • The submission port of a mail server

Was Sie brauchen

  • Username / passwordSent once the connection is encrypted, never before.

Kein Konto nötig.

Standardport: 587

Mitgelieferte Alarmregeln 5

  • WarnungService downThe service has not responded correctly for three minutes.
  • HinweisService flappingThe service changed state more than six times in thirty minutes (changes(dumbmonit_probe_success{probe!="push"}[30m])).
  • HinweisSlow serviceThe service takes more than three seconds to respond; failed checks are left out.
  • HinweisCertificate expiring soonThe certificate expires in less than fourteen days.
  • WarnungCertificate expiredThe certificate has expired.
Einrichtungsschritte: Monitor a mail relay

  1. In DumbMonit, enter the mail server, for example smtp.example.com:2525 (the usual port for the encryption by default).

  2. Pick the encryption: STARTTLS for port 587, TLS for port 465, None for a relay on your own network on port 25.

  3. Optional: fill in an account, to check that the relay still accepts it (a refused password is not reported as an outage).

  4. Optional: name an Expected extension, such as STARTTLS, to be warned when the relay stops advertising it.

Hinweis. An accepted session does not prove mail leaves: watch the relay's queues for that.

Dokumentation

Mailbox (IMAP)

imap

An IMAP server greets, offers TLS and accepts a login, like a real mail client.

Beispiele

  • Dovecot
  • Your provider's IMAP server
  • A mailbox behind Mailcow or Mailu
  • Proxmox Mail Gateway's mail host

Was Sie brauchen

  • Username / passwordSent once the connection is encrypted, never before.

Kein Konto nötig.

Standardport: 993

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Monitor an IMAP server

  1. In DumbMonit, enter the mail server, for example imap.example.com:1993 (port 993 with the default encryption).

  2. Pick the encryption: TLS for port 993, STARTTLS for port 143, None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Hinweis. The check never opens a mailbox: a server that logs in but cannot read its storage answers perfectly here.

Dokumentation

Mailbox (POP3)

pop3

A POP3 server greets, offers TLS and accepts a login, like a real mail client.

Beispiele

  • Dovecot
  • Your provider's POP3 server
  • An old mail server that only speaks POP3

Was Sie brauchen

  • Username / passwordSent once the connection is encrypted, never before.

Kein Konto nötig.

Standardport: 995

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Monitor a POP3 server

  1. In DumbMonit, enter the mail server, for example pop.example.com:1995 (port 995 with the default encryption).

  2. Pick the encryption: TLS for port 995, STARTTLS for port 110 (STLS command), None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Hinweis. The check never lists or reads messages: it logs in, then says goodbye.

Dokumentation

MDaemon Email Server

Über den Agentmdaemon

Needs the agent on the Windows server: mail queues, sessions, Windows services and disk space, plus the mail ports answering and, optionally, the XML API.

Beispiele

  • MDaemon Email Server

Was Sie brauchen

  • XML API account (optional, version only)Also reads the version through the XML API. Leave the credential empty to watch the mail services only.

Kein Konto nötig.

Standardport: 25

Mitgelieferte Alarmregeln 9

  • WarnungMDaemon mail service downA watched mail service of the MDaemon server does not answer, or greets to refuse service. Only the services listed on the monitor have a series. The notification names the service and its port.
  • HinweisMDaemon XML API not answeringThe XML API has stopped answering while the mail services still do: Remote Administration is probably stopped. Only a monitor with an account has the series.
  • HinweisMDaemon mail queue growingThe inbound, local or remote queue has grown by more than a hundred messages in two hours (delta(dumbmonit_mdaemon_queue_messages{queue=~"inbound\|local\|remote"}[2h])): MDaemon has stopped delivering from it. Read by the [agent](../devices/agent.md#windows-performance-counters) on the MDaemon server, so the alert is on the agent's monitor.
  • HinweisMDaemon Bad queue not emptyMessages are waiting in the Bad queue: MDaemon could neither deliver nor bounce them, and they stay there until an administrator releases or deletes them.
  • HinweisMDaemon Retry queue highMore than fifty messages wait in the Retry queue: remote servers keep refusing mail temporarily.
  • WarnungMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
3 weitere anzeigen
  • HinweisMail queue stuckThe oldest message of an inbound, local or remote queue has been waiting for more than two hours: the queue is frozen or delivery is blocked. Counted from the queue folders by the agent on the mail server.
  • HinweisMDaemon queue frozenMDaemon reports one of its queues as frozen: it no longer processes it. Read from the performance counters by the agent on the mail server.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Install the agent on the MDaemon server, then add this monitor

  1. On the Windows server that runs MDaemon, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds MDaemon by itself.

  2. Back here, enter the server address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Leave the credential on Services only: the agent already brings the queues, sessions, Windows services and disk space, and the mail ports are checked from DumbMonit.

  4. Optional, only to read the exact version: open Accounts → Account Manager → New account and create the account below, with a long unique password.

    [email protected]

  5. Allow the address DumbMonit connects from in Setup → XML API Service → Address Restrictions (Setup → XML API Management on MDaemon 26), then enter the account's full email address and its password.

  6. To check more ports than SMTP, IMAP and webmail, set the Services option to a list like this one.

    smtp,msa,imap,pop3,imaps,webmail

Hinweis. The queues, sessions and Windows services of MDaemon can only be read on the server itself: without the agent, DumbMonit sees the mail ports and nothing else. The XML API account is optional and only brings the version; MDaemon has no read-only role for it, so never reuse your own account, and use a password found nowhere else, as repeated failures can get DumbMonit blocked.

Dokumentation

SecurityGateway for Email Servers

Über den Agentsecuritygateway

Needs the agent on the Windows server: Windows services, mail queue folders and disk space, plus the gateway ports answering and the REST API counters (12.5 and later).

Beispiele

  • SecurityGateway for Email Servers

Was Sie brauchen

  • API key (12.5 and later, recommended)Also reads the version and the performance counters through the REST API. Leave the credential empty to watch the services only.

Kein Konto nötig.

Standardport: 25

Mitgelieferte Alarmregeln 5

  • WarnungMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
  • WarnungSecurityGateway service downA watched service of the gateway does not answer, or greets to refuse service.
  • HinweisSecurityGateway API not answeringThe REST API has stopped answering while the services still do. Only a monitor with an API key has the series.
  • HinweisSecurityGateway delivery queue growingThe delivery queue has grown by more than a hundred messages in two hours (delta(dumbmonit_securitygateway_counter{counter=~".*(delivery_queue\|queued_for_delivery).*"}[2h])): the mail server behind the gateway is probably refusing mail. The counter names come from the API as they are; if your version names the queue differently, adjust the matcher.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Install the agent on the gateway server, then add this monitor

  1. On the Windows server that runs SecurityGateway, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds SecurityGateway by itself.

  2. Back here, enter the gateway address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Recommended, for the performance counters: in SecurityGateway 12.5 or later, open Setup/Users → Accounts → Administrators → New and create the account below, with a long unique password.

    dumbmonit

  4. Give the account the role listed below, and restrict it to the DumbMonit address in IP Restriction Options.

  5. Sign in as that account, open Setup/Users → Accounts → API Keys and create a key with an expiry date, then paste the key in DumbMonit.

  6. To check more ports than SMTP and the web interface, set the Services option to a list like this one.

    smtp,web_https

Hinweis. The Windows services, mail queue folders and disk space of SecurityGateway can only be read on the server itself: without the agent, DumbMonit sees the gateway ports and, with a key, the REST API counters. SecurityGateway has no read-only role or narrower key: create the key from the dedicated account, never your own, and give it an expiry date.

Dokumentation

Proxmox Mail Gateway

pmg

Mail queues and stuck mail, spam and virus traffic, quarantine, signature age.

Beispiele

  • Proxmox Mail Gateway

Was Sie brauchen

  • Username / password (recommended)Opens a two-hour session, renewed automatically. Proxmox Mail Gateway does not issue API tokens: this is its normal way in.
  • API tokenOnly if your gateway offers API tokens: Proxmox Mail Gateway 9 and earlier do not create any. Use the username and password instead.

Standardport: 8006

Mitgelieferte Alarmregeln 9

  • HinweisMail queue growingThe deferred mail queue has grown by more than a hundred messages in two hours (delta(dumbmonit_pmg_queue_messages{queue="deferred"}[2h])): the next hop is probably refusing mail. Growth rather than size, because a busy gateway always keeps a few dozen deferred.
  • WarnungMail stuck in the queueA message has been waiting in a queue for more than four hours. The age is a lower bound — qshape reports brackets — so the rule fires late rather than early. The notification names the queue.
  • WarnungMail gateway service stoppedA service the gateway needs to accept and filter mail is stopped. A unit that is not installed has no series and cannot fire.
  • HinweisVirus signatures out of dateThe ClamAV daily virus signatures are more than two days old: freshclam has stopped updating them and the gateway keeps filtering with last week's list.
  • HinweisSpam rules out of dateThe SpamAssassin rules are more than eight days old. A channel that has never been updated has no date and no series.
  • HinweisQuarantine filling upThe spam quarantine has taken in more than a thousand messages in six hours (delta(dumbmonit_pmg_quarantine_messages{kind="spam"}[6h])): a campaign, or a rule that just put a legitimate domain in the bin.
3 weitere anzeigen
  • HinweisMail gateway cluster degradedA gateway of the cluster is no longer in sync with the others: it filters with an out-of-date rule database. A standalone gateway has no series.
  • HinweisMail gateway certificate expiringA certificate of the mail gateway expires in less than fourteen days.
  • InfoMail gateway updates pendingMore than twenty package updates are pending on the mail gateway.
Einrichtungsschritte: Create a read-only user in Proxmox Mail Gateway

  1. Open Configuration → User Management → Users → Add, enter the user name below, a long password used nowhere else, and tick Enabled.

    dumbmonit@pmg

  2. Set its Role to Audit, then click Add.

  3. In DumbMonit, enter the gateway address (for example mail.lan:8006), then this user name, realm included, and its password.

Hinweis. Proxmox Mail Gateway has no API tokens, so DumbMonit signs in with this password. It uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

Dokumentation

mailcow

Betamailcow

Stopped containers, Postfix queue size and age, mail volume, mailboxes near their quota.

Beispiele

  • mailcow: dockerized

Was Sie brauchen

  • Read-only API keyThe read-only key of System → Configuration → Access → API, sent in the X-API-Key header.

Standardport: 443

Mitgelieferte Alarmregeln 5

  • Warnungmailcow container downA mailcow container is not running. The notification names the container.
  • Hinweismailcow mail queue stuckThe oldest message in Postfix's queue has waited more than four hours.
  • Hinweismailcow mail volume almost fullThe volume holding the mailboxes is more than 90 % full; clears below 88 %.
  • Infomailcow mailbox near quotaA mailbox is at 90 % of its quota or more.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only API key in mailcow

  1. In mailcow, open System → Configuration → Access → API and find the Read-only access section.

  2. Tick Activate API, add DumbMonit's IP address to the allowed addresses and save.

  3. Copy the read-only key, then enter mailcow's address in DumbMonit and paste it.

Hinweis. mailcow only answers the addresses allowed on its API page: if DumbMonit reaches it through NAT or a relay agent, allow that address instead.

Dokumentation

Mail server reputation

mail_blacklist

A mail domain's MX, or a mail server's public address, checked against the major DNS blocklists (Spamhaus, Barracuda, SpamCop…) or the ones you pick, with reverse DNS, SPF and DMARC, and the delisting page of every list that lists it. No API key needed.

Beispiele

  • Your company's mail domain
  • The public address of a mail server
  • An outgoing relay

Was Sie brauchen

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Kein Konto nötig.

Mitgelieferte Alarmregeln 5

  • WarnungListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • HinweisListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • HinweisMail server reverse DNS mismatchAn address of the mail server has no reverse DNS, or its name does not resolve back to it: Gmail, Outlook.com and Yahoo refuse or junk such mail.
  • HinweisSPF or DMARC missingThe domain has no SPF record (or several), or no DMARC record: Gmail and Yahoo require both from bulk senders.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Check a mail server against the blocklists

  1. Enter the domain you send mail for ("example.com"), or the public IP address the server sends from.

  2. No API key is needed: leave the credential on No key.

  3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Hinweis. A blocklist that does not answer is shown as unknown, never as clean.

Dokumentation

IP range blocklist

ip_blacklist

Every address of a public IPv4 range, up to a /24, checked against the major DNS blocklists, or the ones you pick: how many are listed, on which lists, and the delisting page of each. No API key needed.

Beispiele

  • Your office's public addresses
  • The /24 your servers send from
  • A hosting provider's block

Was Sie brauchen

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Kein Konto nötig.

Mitgelieferte Alarmregeln 3

  • WarnungListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • HinweisListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Check a public IP range against the blocklists

  1. Enter an IPv4 address or a CIDR range up to /24, for example "198.51.100.0/24".

  2. No API key is needed: leave the credential on No key.

  3. Tick the address blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Hinweis. Spamhaus PBL lists end-user ranges that should not send mail directly: a listing there only matters for an address that runs a mail server.

Dokumentation

Weitere Familien