DumbMonit
EN
GitHub Live demo

Monitors

DNS, mail and security

Pi-hole, AdGuard Home, CrowdSec, and the mail servers and gateways: SMTP, MDaemon, SecurityGateway and Proxmox Mail Gateway. Blocklist monitors for a mail server or an IP range.

Monitor descriptions and alert rule texts are in English, as in the product. The page labels follow your language.

Pi-hole

pihole

The DNS ad blocker: blocking on or paused, queries and share blocked, blocklist age, upstream failures, updates and its own diagnosis messages.

Examples

  • Pi-hole v6 on a Raspberry Pi
  • Pi-hole in Docker

What you need

  • App password (recommended)Generated under Settings → Web interface / API in expert mode. It cannot change Pi-hole's settings.

No account needed.

Default port: 80

Built-in alert rules 5

  • AdvisoryPi-hole blocking disabledBlocking is off, paused or failed. The hold lets a five-minute pause from the web interface go by.
  • AdvisoryPi-hole blocklists staleThe blocklists (gravity) have not been rebuilt for more than eight days: the weekly update fails.
  • InfoPi-hole update availableA newer version is available: the image in Docker, core, web interface or FTL otherwise. Pi-hole checks once a day.
  • InfoPi-hole diagnosis messagesPi-hole lists messages on its diagnosis page: a blocklist that failed to download, a rate-limited client, an overloaded host.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Create an app password in Pi-hole

  1. In Pi-hole's web interface, open Settings → Web interface / API and switch the page from Basic to Expert.

  2. Click Configure app password, copy the password shown, then click Enable new app password.

  3. Check that Settings → All settings → Webserver and API → webserver.api.app_sudo is off, its default.

  4. In DumbMonit, enter Pi-hole's address and paste the app password, or pick No password if the web interface has none.

Heads-up. Pi-hole v6 or later is required; the app password can still pause blocking and edit lists through the API, so keep it for DumbMonit only.

Documentation

AdGuard Home

adguard

The DNS filter: protection on or paused, queries and blocks, filter lists that stopped updating, upstream servers that fail, updates.

Examples

  • AdGuard Home
  • AdGuard Home on OpenWrt or a NAS

What you need

  • User name / passwordThe dedicated user added to AdGuardHome.yaml, sent as HTTP basic authentication.

No account needed.

Default port: 80

Built-in alert rules 6

  • AdvisoryAdGuard Home protection offProtection disabled, or paused and not back yet.
  • WarningAdGuard Home DNS not runningThe web interface answers but the DNS server is stopped.
  • AdvisoryAdGuard Home upstream failingAn upstream DNS server fails AdGuard Home's own test, or stays silent 4 seconds.
  • AdvisoryAdGuard Home filter lists staleThe oldest update of an enabled filter list is more than three days old.
  • InfoAdGuard Home update availableA newer version is announced by AdGuard Home's own version check; never fires when that check is disabled, as in the official Docker image.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Add a user for DumbMonit to AdGuard Home

  1. Make a bcrypt hash of a long random password (htpasswd comes with apache2-utils or httpd-tools).

    htpasswd -B -C 10 -n -b dumbmonit 'LONG-RANDOM-PASSWORD'

  2. Stop AdGuard Home, add this line under users: in AdGuardHome.yaml with HASH replaced by the printed hash, then start it again.

    - { name: dumbmonit, password: "HASH" }

  3. In DumbMonit, enter the address of the AdGuard Home web interface, then the user dumbmonit and its password.

Heads-up. AdGuard Home has no read-only user, so dumbmonit can change every setting: keep its password to DumbMonit alone, and turn on HTTPS in Settings → Encryption settings across an untrusted network.

Documentation

CrowdSec

crowdsec

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

Examples

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

What you need

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

No account needed.

Default port: 6060

Built-in alert rules 4

  • WarningCrowdSec Local API downThe Local API does not answer /health.
  • AdvisoryCrowdSec bouncer stopped pullingA bouncer's requests did not change in 30 minutes (changes_prometheus(dumbmonit_crowdsec_bouncer_requests_total[30m])).
  • AdvisoryCrowdSec reads no logsNot a single log line read in six hours (increase_prometheus(dumbmonit_crowdsec_lines_read_total[6h])).
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

Heads-up. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

Documentation

Mail relay (SMTP)

smtp

A mail server greets, offers STARTTLS and accepts a login, like a real client.

Examples

  • Your provider's SMTP relay
  • A local Postfix or msmtp
  • Proxmox Mail Gateway
  • The submission port of a mail server

What you need

  • Username / passwordSent once the connection is encrypted, never before.

No account needed.

Default port: 587

Built-in alert rules 5

  • WarningService downThe service has not responded correctly for three minutes.
  • AdvisoryService flappingThe service changed state more than six times in thirty minutes (changes(dumbmonit_probe_success{probe!="push"}[30m])).
  • AdvisorySlow serviceThe service takes more than three seconds to respond; failed checks are left out.
  • AdvisoryCertificate expiring soonThe certificate expires in less than fourteen days.
  • WarningCertificate expiredThe certificate has expired.
Setup steps: Monitor a mail relay

  1. In DumbMonit, enter the mail server, for example smtp.example.com:2525 (the usual port for the encryption by default).

  2. Pick the encryption: STARTTLS for port 587, TLS for port 465, None for a relay on your own network on port 25.

  3. Optional: fill in an account, to check that the relay still accepts it (a refused password is not reported as an outage).

  4. Optional: name an Expected extension, such as STARTTLS, to be warned when the relay stops advertising it.

Heads-up. An accepted session does not prove mail leaves: watch the relay's queues for that.

Documentation

Mailbox (IMAP)

imap

An IMAP server greets, offers TLS and accepts a login, like a real mail client.

Examples

  • Dovecot
  • Your provider's IMAP server
  • A mailbox behind Mailcow or Mailu
  • Proxmox Mail Gateway's mail host

What you need

  • Username / passwordSent once the connection is encrypted, never before.

No account needed.

Default port: 993

Built-in alert rules 1

  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Monitor an IMAP server

  1. In DumbMonit, enter the mail server, for example imap.example.com:1993 (port 993 with the default encryption).

  2. Pick the encryption: TLS for port 993, STARTTLS for port 143, None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Heads-up. The check never opens a mailbox: a server that logs in but cannot read its storage answers perfectly here.

Documentation

Mailbox (POP3)

pop3

A POP3 server greets, offers TLS and accepts a login, like a real mail client.

Examples

  • Dovecot
  • Your provider's POP3 server
  • An old mail server that only speaks POP3

What you need

  • Username / passwordSent once the connection is encrypted, never before.

No account needed.

Default port: 995

Built-in alert rules 1

  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Monitor a POP3 server

  1. In DumbMonit, enter the mail server, for example pop.example.com:1995 (port 995 with the default encryption).

  2. Pick the encryption: TLS for port 995, STARTTLS for port 110 (STLS command), None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Heads-up. The check never lists or reads messages: it logs in, then says goodbye.

Documentation

MDaemon Email Server

Via agentmdaemon

Needs the agent on the Windows server: mail queues, sessions, Windows services and disk space, plus the mail ports answering and, optionally, the XML API.

Examples

  • MDaemon Email Server

What you need

  • XML API account (optional, version only)Also reads the version through the XML API. Leave the credential empty to watch the mail services only.

No account needed.

Default port: 25

Built-in alert rules 9

  • WarningMDaemon mail service downA watched mail service of the MDaemon server does not answer, or greets to refuse service. Only the services listed on the monitor have a series. The notification names the service and its port.
  • AdvisoryMDaemon XML API not answeringThe XML API has stopped answering while the mail services still do: Remote Administration is probably stopped. Only a monitor with an account has the series.
  • AdvisoryMDaemon mail queue growingThe inbound, local or remote queue has grown by more than a hundred messages in two hours (delta(dumbmonit_mdaemon_queue_messages{queue=~"inbound\|local\|remote"}[2h])): MDaemon has stopped delivering from it. Read by the [agent](../devices/agent.md#windows-performance-counters) on the MDaemon server, so the alert is on the agent's monitor.
  • AdvisoryMDaemon Bad queue not emptyMessages are waiting in the Bad queue: MDaemon could neither deliver nor bounce them, and they stay there until an administrator releases or deletes them.
  • AdvisoryMDaemon Retry queue highMore than fifty messages wait in the Retry queue: remote servers keep refusing mail temporarily.
  • WarningMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
Show 3 more
  • AdvisoryMail queue stuckThe oldest message of an inbound, local or remote queue has been waiting for more than two hours: the queue is frozen or delivery is blocked. Counted from the queue folders by the agent on the mail server.
  • AdvisoryMDaemon queue frozenMDaemon reports one of its queues as frozen: it no longer processes it. Read from the performance counters by the agent on the mail server.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Install the agent on the MDaemon server, then add this monitor

  1. On the Windows server that runs MDaemon, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds MDaemon by itself.

  2. Back here, enter the server address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Leave the credential on Services only: the agent already brings the queues, sessions, Windows services and disk space, and the mail ports are checked from DumbMonit.

  4. Optional, only to read the exact version: open Accounts → Account Manager → New account and create the account below, with a long unique password.

    [email protected]

  5. Allow the address DumbMonit connects from in Setup → XML API Service → Address Restrictions (Setup → XML API Management on MDaemon 26), then enter the account's full email address and its password.

  6. To check more ports than SMTP, IMAP and webmail, set the Services option to a list like this one.

    smtp,msa,imap,pop3,imaps,webmail

Heads-up. The queues, sessions and Windows services of MDaemon can only be read on the server itself: without the agent, DumbMonit sees the mail ports and nothing else. The XML API account is optional and only brings the version; MDaemon has no read-only role for it, so never reuse your own account, and use a password found nowhere else, as repeated failures can get DumbMonit blocked.

Documentation

SecurityGateway for Email Servers

Via agentsecuritygateway

Needs the agent on the Windows server: Windows services, mail queue folders and disk space, plus the gateway ports answering and the REST API counters (12.5 and later).

Examples

  • SecurityGateway for Email Servers

What you need

  • API key (12.5 and later, recommended)Also reads the version and the performance counters through the REST API. Leave the credential empty to watch the services only.

No account needed.

Default port: 25

Built-in alert rules 5

  • WarningMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
  • WarningSecurityGateway service downA watched service of the gateway does not answer, or greets to refuse service.
  • AdvisorySecurityGateway API not answeringThe REST API has stopped answering while the services still do. Only a monitor with an API key has the series.
  • AdvisorySecurityGateway delivery queue growingThe delivery queue has grown by more than a hundred messages in two hours (delta(dumbmonit_securitygateway_counter{counter=~".*(delivery_queue\|queued_for_delivery).*"}[2h])): the mail server behind the gateway is probably refusing mail. The counter names come from the API as they are; if your version names the queue differently, adjust the matcher.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Install the agent on the gateway server, then add this monitor

  1. On the Windows server that runs SecurityGateway, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds SecurityGateway by itself.

  2. Back here, enter the gateway address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Recommended, for the performance counters: in SecurityGateway 12.5 or later, open Setup/Users → Accounts → Administrators → New and create the account below, with a long unique password.

    dumbmonit

  4. Give the account the role listed below, and restrict it to the DumbMonit address in IP Restriction Options.

  5. Sign in as that account, open Setup/Users → Accounts → API Keys and create a key with an expiry date, then paste the key in DumbMonit.

  6. To check more ports than SMTP and the web interface, set the Services option to a list like this one.

    smtp,web_https

Heads-up. The Windows services, mail queue folders and disk space of SecurityGateway can only be read on the server itself: without the agent, DumbMonit sees the gateway ports and, with a key, the REST API counters. SecurityGateway has no read-only role or narrower key: create the key from the dedicated account, never your own, and give it an expiry date.

Documentation

Proxmox Mail Gateway

pmg

Mail queues and stuck mail, spam and virus traffic, quarantine, signature age.

Examples

  • Proxmox Mail Gateway

What you need

  • Username / password (recommended)Opens a two-hour session, renewed automatically. Proxmox Mail Gateway does not issue API tokens: this is its normal way in.
  • API tokenOnly if your gateway offers API tokens: Proxmox Mail Gateway 9 and earlier do not create any. Use the username and password instead.

Default port: 8006

Built-in alert rules 9

  • AdvisoryMail queue growingThe deferred mail queue has grown by more than a hundred messages in two hours (delta(dumbmonit_pmg_queue_messages{queue="deferred"}[2h])): the next hop is probably refusing mail. Growth rather than size, because a busy gateway always keeps a few dozen deferred.
  • WarningMail stuck in the queueA message has been waiting in a queue for more than four hours. The age is a lower bound — qshape reports brackets — so the rule fires late rather than early. The notification names the queue.
  • WarningMail gateway service stoppedA service the gateway needs to accept and filter mail is stopped. A unit that is not installed has no series and cannot fire.
  • AdvisoryVirus signatures out of dateThe ClamAV daily virus signatures are more than two days old: freshclam has stopped updating them and the gateway keeps filtering with last week's list.
  • AdvisorySpam rules out of dateThe SpamAssassin rules are more than eight days old. A channel that has never been updated has no date and no series.
  • AdvisoryQuarantine filling upThe spam quarantine has taken in more than a thousand messages in six hours (delta(dumbmonit_pmg_quarantine_messages{kind="spam"}[6h])): a campaign, or a rule that just put a legitimate domain in the bin.
Show 3 more
  • AdvisoryMail gateway cluster degradedA gateway of the cluster is no longer in sync with the others: it filters with an out-of-date rule database. A standalone gateway has no series.
  • AdvisoryMail gateway certificate expiringA certificate of the mail gateway expires in less than fourteen days.
  • InfoMail gateway updates pendingMore than twenty package updates are pending on the mail gateway.
Setup steps: Create a read-only user in Proxmox Mail Gateway

  1. Open Configuration → User Management → Users → Add, enter the user name below, a long password used nowhere else, and tick Enabled.

    dumbmonit@pmg

  2. Set its Role to Audit, then click Add.

  3. In DumbMonit, enter the gateway address (for example mail.lan:8006), then this user name, realm included, and its password.

Heads-up. Proxmox Mail Gateway has no API tokens, so DumbMonit signs in with this password. It uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

Documentation

mailcow

Betamailcow

Stopped containers, Postfix queue size and age, mail volume, mailboxes near their quota.

Examples

  • mailcow: dockerized

What you need

  • Read-only API keyThe read-only key of System → Configuration → Access → API, sent in the X-API-Key header.

Default port: 443

Built-in alert rules 5

  • Warningmailcow container downA mailcow container is not running. The notification names the container.
  • Advisorymailcow mail queue stuckThe oldest message in Postfix's queue has waited more than four hours.
  • Advisorymailcow mail volume almost fullThe volume holding the mailboxes is more than 90 % full; clears below 88 %.
  • Infomailcow mailbox near quotaA mailbox is at 90 % of its quota or more.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Create a read-only API key in mailcow

  1. In mailcow, open System → Configuration → Access → API and find the Read-only access section.

  2. Tick Activate API, add DumbMonit's IP address to the allowed addresses and save.

  3. Copy the read-only key, then enter mailcow's address in DumbMonit and paste it.

Heads-up. mailcow only answers the addresses allowed on its API page: if DumbMonit reaches it through NAT or a relay agent, allow that address instead.

Documentation

Mail server reputation

mail_blacklist

A mail domain's MX, or a mail server's public address, checked against the major DNS blocklists (Spamhaus, Barracuda, SpamCop…) or the ones you pick, with reverse DNS, SPF and DMARC, and the delisting page of every list that lists it. No API key needed.

Examples

  • Your company's mail domain
  • The public address of a mail server
  • An outgoing relay

What you need

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

No account needed.

Built-in alert rules 5

  • WarningListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • AdvisoryListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • AdvisoryMail server reverse DNS mismatchAn address of the mail server has no reverse DNS, or its name does not resolve back to it: Gmail, Outlook.com and Yahoo refuse or junk such mail.
  • AdvisorySPF or DMARC missingThe domain has no SPF record (or several), or no DMARC record: Gmail and Yahoo require both from bulk senders.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Check a mail server against the blocklists

  1. Enter the domain you send mail for ("example.com"), or the public IP address the server sends from.

  2. No API key is needed: leave the credential on No key.

  3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Heads-up. A blocklist that does not answer is shown as unknown, never as clean.

Documentation

IP range blocklist

ip_blacklist

Every address of a public IPv4 range, up to a /24, checked against the major DNS blocklists, or the ones you pick: how many are listed, on which lists, and the delisting page of each. No API key needed.

Examples

  • Your office's public addresses
  • The /24 your servers send from
  • A hosting provider's block

What you need

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

No account needed.

Built-in alert rules 3

  • WarningListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • AdvisoryListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • WarningMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Setup steps: Check a public IP range against the blocklists

  1. Enter an IPv4 address or a CIDR range up to /24, for example "198.51.100.0/24".

  2. No API key is needed: leave the credential on No key.

  3. Tick the address blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Heads-up. Spamhaus PBL lists end-user ranges that should not send mail directly: a listing there only matters for an address that runs a mail server.

Documentation

Other families