DumbMonit
DE
GitHub Live-Demo

Monitore

Netzwerkgeräte

Switches, Router, Access Points und VPNs: jedes SNMP-Gerät, MikroTik, UniFi, Tailscale und OpenVPN.

Beschreibungen der Monitore und Texte der Alarmregeln sind wie im Produkt auf Englisch. Die Beschriftungen der Seite folgen Ihrer Sprache.

SNMP device

snmp

Switches, routers, UPS, printers, access points: anything that answers SNMP.

Beispiele

  • Switch
  • Router
  • NAS
  • UPS
  • Printer

Was Sie brauchen

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Standardport: 161

Mitgelieferte Alarmregeln 9

  • HinweisHigh CPUCPU load sustained above 90%, averaged per monitor across SNMP, Proxmox and agent sources; clears below 85 %.
  • InfoUnusual CPUCPU load noticeably different from the usual at this time and day of the week (seasonal baseline).
  • HinweisDisk almost fullFilesystem 90% full or more, per mount point (SNMP, Proxmox storages and root filesystems); clears below 88 %.
  • HinweisFilesystem almost fullAt this rate, the filesystem will be full within four days.
  • WarnungUPS on batteryThe UPS is powering the load from battery.
  • WarnungUPS battery lowThe UPS battery is low or depleted.
3 weitere anzeigen
  • HinweisPort accumulating errorsA network port logged more than fifty errors in the last hour: usually a failing cable, a dirty fibre or a duplex mismatch (increase_prometheus(dumbmonit_if_errors_in[1h]) + increase_prometheus(dumbmonit_if_errors_out[1h]); nothing fires during the first hour of a new monitor, so errors counted before it was added are not reported as new).
  • HinweisPort flappingA network port went down and up again more than twice in thirty minutes (changes_prometheus(dumbmonit_if_oper_status[30m])). A port disabled on purpose has no series and never fires.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Enable SNMP on the device

  1. Open the device's web interface and find its SNMP settings, often under Network, Services or Administration.

  2. Enable SNMP v2c and note the read-only community (public on many devices).

  3. If the device filters by address, allow this server's address.

  4. In DumbMonit, enter the address and the community: the rest is detected automatically.

Hinweis. A community is not encrypted on the network: on a shared network, prefer SNMP v3, which authenticates and encrypts.

Dokumentation

SNMP value (single OID)

snmp_oid

Reads one SNMP object and checks its value against a range or a text.

Beispiele

  • A temperature or humidity sensor
  • A UPS status or battery level
  • A version string or a firmware flag
  • A counter exposed by a Net-SNMP extend script

Was Sie brauchen

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Standardport: 161

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Monitor a single SNMP value

  1. On the device, enable SNMP and check that the community or the v3 user may read the object (the SNMP view must grant its branch).

  2. In DumbMonit, enter the device address, then the community or the v3 user.

  3. Fill in the object (OID) with its instance suffix, for example 1.3.6.1.2.1.1.3.0.

  4. Optional: set a minimum and a maximum, or an expected text, to be warned when the value drifts.

Hinweis. An object the agent does not know, or that its SNMP view hides, is reported down with the reason not_found.

Dokumentation

MikroTik RouterOS

mikrotik

RouterOS and RouterBOOT versions behind, CPU, memory, temperatures, fans and power supplies, and errors and link losses on every interface.

Beispiele

  • hAP
  • RB5009
  • CCR
  • CRS switch
  • Cloud Hosted Router

Was Sie brauchen

  • Read-only userThe dumbmonit user created above, in the dumbmonit-read group. Sent as HTTP basic authentication.

Standardport: 443

Mitgelieferte Alarmregeln 2

  • HinweisMikroTik CPU highThe router's CPU has stayed above 90 %: routing, the firewall or a script is saturating it. Clears below 80 %.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only user on the router

  1. WinBox or WebFig → System → Users → Groups → Add: name the group as follows and tick only the policies listed below.

    dumbmonit-read

  2. System → Users → Add: create the user dumbmonit in that group, with a long random password.

    dumbmonit

  3. IP → Services: enable www-ssl and pick a certificate (create one under System → Certificates).

  4. Optional, to hear about new RouterOS versions: System → Scheduler → Add, interval 1d, start time startup, with this On Event script.

    /system package update check-for-updates once

  5. In DumbMonit, enter the router's address (192.168.88.1) with that user name and password.

Hinweis. RouterOS 7.1 or later is required (RouterOS 6 has no REST API); with a self-signed certificate, tick "Accept an unverifiable certificate" in the options.

Dokumentation

UniFi Network

unifi

The UniFi network and what it manages: gateways, switches and access points offline or waiting for adoption, firmware updates, WAN and Internet status, clients and alarms, and the last connection of the clients you mark as worth watching.

Beispiele

  • UniFi OS console (Dream Machine, Cloud Gateway, Cloud Key)
  • UniFi Network Server (self-hosted)

Was Sie brauchen

  • API key (UniFi OS console)Reads devices, their load and the client count through the official Integration API. Created in Settings → Control Plane → Integrations.
  • View Only accountA local account with the View Only role. Also reads the WAN, Internet and alarm status, and works on a self-hosted server.

Standardport: 443

Mitgelieferte Alarmregeln 8

  • HinweisUniFi device offlineA UniFi device adopted by the controller is offline, isolated or failed to adopt.
  • WarnungUniFi Internet downThe UniFi gateway reports no Internet connection. Without a UniFi gateway the series does not exist and the rule stays silent.
  • HinweisUniFi WAN link downA WAN link of the UniFi gateway is down: with two links, redundancy is lost while nothing seems broken. A disabled port has no series.
  • HinweisUniFi gateway CPU highThe UniFi gateway's processor has been above 90% for fifteen minutes; clears below 80 %.
  • InfoUniFi device waiting for adoptionA device appeared on the network and waits to be adopted in UniFi.
  • InfoUniFi firmware update availableA firmware update is available for UniFi devices.
2 weitere anzeigen
  • HinweisUniFi alarmsUniFi logged critical events or raised alarms in the last 24 hours. Only read with a View Only account.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only access in UniFi Network

  1. For an API key on a UniFi OS console: UniFi Network → Settings → Control Plane → Integrations → Create API Key. Name it DumbMonit and copy it: it is shown once.

  2. Or create a local account (needed for WAN and alarm status, and on a self-hosted server): Settings → Admins & Users → Create New, local access only.

    dumbmonit

  3. Set that account's UniFi Network role to View Only.

  4. In DumbMonit, enter the address (unifi.lan, or unifi.lan:8443 for a self-hosted server) and paste the key or the account.

  5. If the network is not the default site, set the Site option to the short name shown after /manage/ or /network/ in the address bar.

Hinweis. Use a local account, never the owner or a UI.com cloud account, and accept the console's self-signed certificate in the options unless you installed your own.

Dokumentation

Cisco Meraki

Betameraki

A Cisco Meraki organization through the Dashboard API: devices offline, Internet uplinks that failed, license out of compliance or expiring, clients per network.

Beispiele

  • Meraki MX / MS / MR
  • Cisco Meraki cloud dashboard

Was Sie brauchen

  • API keyThe key of the read-only administrator created for DumbMonit, sent as a bearer token.

Standardport: 443

Mitgelieferte Alarmregeln 5

  • HinweisMeraki device offlineA Cisco Meraki device has been offline (out of reach of the cloud dashboard) for ten minutes. Dormant devices, unseen for a long time, are left out.
  • HinweisMeraki uplink failedA Meraki router lost the Internet access of a configured uplink (the wired and cellular sockets without a cable are not counted).
  • HinweisMeraki license problemThe Meraki license is not in compliance (expired, missing or out of compliance): the dashboard may stop managing the devices.
  • HinweisMeraki license expiringA Meraki license expires in less than 30 days.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only API key for DumbMonit

  1. In the Meraki dashboard, open Organization → Settings and tick Enable access to the Cisco Meraki Dashboard API.

  2. Open Organization → Administrators → Add admin and create an administrator dedicated to DumbMonit, with Organization access set to Read-only.

    [email protected]

  3. Sign in as that administrator, open My profile → API access and click Generate new API key. Copy it: the dashboard shows it only once.

  4. In DumbMonit, enter api.meraki.com as the address and paste the key as API key. Leave Organization empty to read the first organization the key sees.

Hinweis. A dormant device (not seen for a long time) is counted but never reported as down, and a WAN socket without a cable is not a failed uplink: only an uplink that lost its Internet access is.

Dokumentation

TP-Link Omada

Betaomada

A TP-Link Omada controller through its OpenAPI: devices disconnected, CPU and memory saturated, firmware updates offered, clients per site.

Beispiele

  • Omada software controller
  • OC200 / OC300 hardware controller
  • EAP access points, TL-SG switches, ER gateways

Was Sie brauchen

  • OpenAPI clientThe client created for DumbMonit under Open API, in Client mode with the Viewer role.

Standardport: 8043

Mitgelieferte Alarmregeln 5

  • HinweisOmada device offlineAn Omada access point, switch or gateway has been disconnected from the controller for ten minutes.
  • HinweisOmada device CPU highAn Omada device has had its CPU above 90 % for fifteen minutes.
  • HinweisOmada device memory highAn Omada device has had its memory above 90 % for fifteen minutes.
  • InfoOmada firmware updateThe Omada controller offers a firmware update for a device.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only OpenAPI client for DumbMonit

  1. In the Omada controller, open Global View → Settings → Platform Integration → Open API and click Add New App.

  2. Name the app as follows, choose the Client access mode and give it the Viewer role on the sites to read.

    dumbmonit

  3. Click Apply: the controller shows the Omada ID, the Client ID and the Client Secret. Copy them: the secret is shown once.

  4. In DumbMonit, enter the controller address (omada.lan) and the port (8043, or 443 for a hardware controller), then paste the Client ID and the Client secret.

Hinweis. The Omada controller ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own. The OpenAPI exists from controller version 5.9.

Dokumentation

Aruba Central

Betaarubacentral

The Wi-Fi access points, switches and gateways of an HPE Aruba Networking Central account through its cloud API: devices offline, active critical alerts, devices in poor health, and the number of connected clients.

Beispiele

  • Aruba access points
  • Aruba CX switches
  • Aruba gateways

Was Sie brauchen

  • API clientRecommended: DumbMonit exchanges the client for an access token and renews it by itself.
  • Access tokenWorks for a test, but expires after two hours and DumbMonit cannot renew it.

Standardport: 443

Mitgelieferte Alarmregeln 4

  • HinweisAruba Central device offlineAruba Central reports an access point, switch or gateway offline.
  • HinweisAruba Central critical alertAruba Central has at least one active critical alert.
  • InfoAruba Central devices in poor healthAruba Central rates at least one device in poor health for an hour.
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a personal API client for DumbMonit

  1. Sign in to HPE GreenLake (common.cloud.hpe.com) and open Manage Workspace → Personal API clients.

  2. Click Create personal API client, name it as follows and choose your Central instance as the service.

    dumbmonit

  3. Copy the client ID and the client secret: the secret is shown once, and HPE keeps no copy.

  4. In Central, open the API gateway page (Menu → API Gateway → REST API) and note the base URL of your region.

  5. In DumbMonit, enter that base URL as the address (for example us1.api.central.arubanetworks.com) and paste the client ID and the client secret.

Hinweis. Beta: written from HPE's published API reference, not yet tested on a real Central account. It reads the new Central API with Central credentials; credentials scoped to the GreenLake platform and classic Central are not supported.

Dokumentation

Tailscale

tailscale

The devices of a tailnet through the Tailscale API: servers offline, node keys about to expire, devices awaiting approval, clients to update, and each device's last connection.

Beispiele

  • Tailscale tailnet
  • Subnet routers
  • Exit nodes

Was Sie brauchen

  • OAuth clientRecommended: a client limited to the devices:core:read scope, which can change nothing.
  • API access tokenWorks too, but carries every right of the user who created it and expires after 90 days at most.

Standardport: 443

Mitgelieferte Alarmregeln 5

  • HinweisTailscale device offlineA Tailscale device that must stay online (a tagged device by default) has been disconnected for more than 15 minutes (dumbmonit_tailscale_device_offline_seconds and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • HinweisTailscale node key expiringA Tailscale device's node key expires in less than 14 days: it will leave the tailnet until someone signs it in again.
  • HinweisTailscale device awaiting approvalA device joined the tailnet and awaits approval: approve it if it is expected, remove it otherwise.
  • InfoTailscale client updateA Tailscale device that must stay online runs a client with an update available (dumbmonit_tailscale_device_update_available and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Create a read-only OAuth client for DumbMonit

  1. In the Tailscale console (login.tailscale.com), open Settings → Trust credentials → Credential → OAuth.

  2. Tick only the read scope listed below, then click Generate credential.

  3. Copy the client ID and the client secret (tskey-client-...): the secret is shown once.

  4. In DumbMonit, enter api.tailscale.com as address and paste them as Client ID and Client secret; leave the Tailnet option empty.

Hinweis. Only tagged devices (servers, subnet routers, exit nodes) are expected to stay online: name the ones to watch in the Devices to keep online option, or enter all.

Dokumentation

OpenVPN server

openvpn

An OpenVPN server through its management interface: version, whether it reports itself connected, and every client currently in session with its addresses and traffic.

Beispiele

  • OpenVPN Access Server
  • A plain openvpn --server on Linux
  • pfSense or OPNsense OpenVPN (management enabled)

Was Sie brauchen

  • Management passwordThe shared password set by the third argument of the server's "management" directive.

Kein Konto nötig.

Standardport: 7505

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Turn on the management interface

  1. Add this line to the server's configuration (server.conf, or as.conf on OpenVPN Access Server) and restart OpenVPN.

    management 0.0.0.0 7505

  2. Recommended: protect it with a password, put in a file readable by the OpenVPN process alone and added as a third argument.

    management 0.0.0.0 7505 /etc/openvpn/management-password

  3. In DumbMonit, enter the server's address (vpn.lan, port 7505) and the management password if one is set.

Hinweis. Anyone who reaches the management port and knows the password can disconnect clients and reconfigure the running server: allow only the DumbMonit host in the firewall and set a password.

Dokumentation

RADIUS server

radius

Authenticates a test account (Access-Request): catches a server that is up but no longer accepts logins.

Beispiele

  • FreeRADIUS
  • Windows NPS
  • The RADIUS behind a WPA-Enterprise Wi-Fi
  • The RADIUS behind a VPN or a 802.1X switch

Was Sie brauchen

  • Shared secret and test accountThe secret defined for this host on the RADIUS server, and an account created for monitoring.

Standardport: 1812

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Monitor a RADIUS server

  1. On the RADIUS server, declare the DumbMonit host as a client, with a shared secret (clients.conf on FreeRADIUS, RADIUS Clients on Windows NPS).

  2. Create a test account without a second factor, and note its name and password.

  3. In DumbMonit, enter the server (UDP port 1812 by default), the shared secret and the test account.

  4. Optional: change the NAS identifier if the server filters requests by it.

Hinweis. A wrong shared secret, or a host not declared as a client, usually makes the server stay silent: the check then reports a timeout.

Dokumentation

Network configuration backup

netconfig

Keep every version of a switch, router or firewall configuration, see what changed line by line, and be told when it changes.

Beispiele

  • Cisco switch or router
  • Juniper router
  • FortiGate or pfSense firewall
  • MikroTik router
  • Aruba switch

Was Sie brauchen

  • SSH loginA read-only account is enough on most devices. Stored encrypted, never shown again.
  • API key and secretOPNsense API profile: the key and secret of an API user allowed to download backups.
  • API keyPAN-OS API profile: the API key of a read-only role, sent in the X-PAN-KEY header.

Standardport: 22

Mitgelieferte Alarmregeln 1

  • WarnungMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Einrichtungsschritte: Back up a device configuration

  1. Choose the device model in "Device model": it decides the commands sent, and nothing else is ever run on the device.

  2. Create a read-only account on the device that may log in over SSH and show the running configuration.

  3. For OPNsense through its API, create an API key for a user allowed to download backups; for PAN-OS, generate the API key of a read-only role.

  4. The first SSH connection remembers the device's host key: if it ever changes, backups stop and an alert asks you to check it.

Hinweis. Configurations hold secrets: they are stored encrypted, shown with their secrets masked, and only an administrator signed in can reveal or download them.

Dokumentation

Weitere Familien