Servers and hardware

1. In DumbMonit, add a monitor and pick Server with the agent, then choose how the machine reaches the server: directly, or through the relay of a remote site behind a firewall.

2. An enrollment token (its secret starts with dmon_; the token is listed as tok_… afterwards) is shown once, with the install command ready to copy for Linux/macOS, Windows and Docker.

3. Run that install command on the machine, with elevated rights (sudo on Linux and macOS, an elevated PowerShell on Windows).

4. The page waits for the first report (a few seconds), then lets you name the machine, file it in a folder and place it at a site, on the spot.

5. Optional, for Docker: if the agent runs under a dedicated user, add that user to the "docker" group and restart the agent.

   usermod -aG docker dumbmonit

6. For a fleet (a playbook, a machine image), tick Several machines with this command; a whole Windows domain goes through the Active Directory kit, offered on the same page.

Heads-up. The agent contacts the server, never the other way round: no port needs to be opened on the monitored machine.

1. On the server, in an elevated PowerShell, enable WinRM.

   Enable-PSRemoting -SkipNetworkProfileCheck -Force

2. Create the HTTPS listener with a certificate named after the server (use your own certificate instead of this self-signed one if you have one), then open its port.

   $cert = New-SelfSignedCertificate -DnsName "srv01.corp.example.com" -CertStoreLocation Cert:\LocalMachine\My
   New-Item -Path WSMan:\LocalHost\Listener -Transport HTTPS -Address * -CertificateThumbPrint $cert.Thumbprint -Force
   New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow

3. Create the account with a long random password, then add it to the groups listed below.

   net user dumbmonit * /add
   net localgroup "Remote Management Users" dumbmonit /add
   net localgroup "Performance Monitor Users" dumbmonit /add
   net localgroup "Event Log Readers" dumbmonit /add

4. Give the account access to the WMI namespace: wmimgmt.msc → right-click WMI Control → Properties → Security → Root → CIMV2 → Security, add it and tick Enable Account and Remote Enable.

5. In DumbMonit, enter the server name as its certificate names it (srv01.corp.example.com) and log in as dumbmonit, or DOMAIN\dumbmonit for a domain account.

Heads-up. The account runs no command on the server, it only reads WMI. NTLM and Basic (HTTPS only) are supported, Kerberos is not. Pending Windows updates cannot be read this way. A self-signed certificate needs the option Accept an unverifiable certificate.

1. Open the web interface of the management controller (BMC), not the operating system of the server.

2. Create a local user named as follows, with a long password used nowhere else.

   dumbmonit

3. Give it the read-only right of your vendor, listed below.

4. In DumbMonit, enter the controller address (bmc.lan or 10.0.0.50) with that user name and password.

Heads-up. Do not reuse the controller's factory account, which can power the server off and reflash the firmware; a self-signed certificate needs "Accept an unverifiable certificate" ticked.

1. On a plain NUT install, add this line to upsd.conf and restart upsd.

   LISTEN 0.0.0.0 3493

2. Open TCP port 3493 in the firewall for the DumbMonit host.

3. On a NAS, enable its network UPS server instead: Synology DSM → Control Panel → Hardware & Power → UPS, then add the DumbMonit host under Permitted DiskStation Devices.

4. Optional, to name this client: add a user without actions or instcmds to upsd.users, with a long random password, and restart upsd.

   [dumbmonit]
   password = a-long-random-password

5. In DumbMonit, enter the NUT server's address (nas.lan): every UPS it publishes is watched.

Heads-up. DumbMonit watches the UPS; it shuts nothing down: the machines it powers still need their own NUT client (upsmon) to shut down cleanly.

1. Active Directory Users and Computers → your domain → Users → New → User: name it as follows, set a long random password and add it to no group.

   svc-dumbmonit

2. On its Account tab, tick Password never expires, or the bind fails the day the password does.

3. Optional, to see inbound replication status: grant the account the right listed below on the domain object.

   dsacls "DC=corp,DC=example,DC=com" /G "CORP\svc-dumbmonit:CA;Monitor active directory replication"

4. For LDAPS, export your certification authority's certificate as Base-64 encoded X.509 and paste it as CA certificate below.

5. In DumbMonit, enter a domain controller's name as its certificate names it (dc1.corp.example.com) and log in as [email protected].

Heads-up. Plain LDAP on port 389 sends the password in clear and is refused by default: use LDAPS, or StartTLS on port 389.

1. Check that the exporter answers from the DumbMonit host.

   curl http://server.lan:9100/metrics

2. In DumbMonit, enter the host and pick the exporter, or leave custom and give the port.

3. Optional: restrict what is stored with Keep only or Ignore, to keep a large exporter within the series limit.

4. Optional: if the exporter is on another site, choose a relay agent to read it from there.

Heads-up. Metrics pages are usually unauthenticated: filter the port so that only the DumbMonit host reaches it.

1. In Settings, API & assistants, create a token with the write scope. Restrict it to the network of your collector.

2. Save this source, then note its number: it ends the address of its page, /devices/<number>.

3. In the otlphttp exporter of your collector, set the endpoint to this server followed by /api/otlp, then add two headers: Authorization with the token, and X-DumbMonit-Target with the number of this source.

   https://monit.example.com/api/otlp

4. Make sure counters and histograms use cumulative temporality (the default); for delta, add the deltatocumulative processor.

5. Optional: logs sent to /api/otlp/v1/logs are stored in VictoriaLogs when it is enabled in Settings, Storage.

Heads-up. OTLP over gRPC is not supported: configure the otlphttp exporter, not otlp. The token can write to the whole API: keep it in the collector's secrets.