DumbMonit
IT
GitHub Demo dal vivo

Monitor

Apparati di rete

Switch, router, access point e VPN: qualsiasi dispositivo SNMP, MikroTik, UniFi, Tailscale e OpenVPN.

Le descrizioni dei monitor e i testi delle regole di avviso sono in inglese, come nel prodotto. Le etichette della pagina seguono la tua lingua.

SNMP device

snmp

Switches, routers, UPS, printers, access points: anything that answers SNMP.

Esempi

  • Switch
  • Router
  • NAS
  • UPS
  • Printer

Cosa serve

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Porta predefinita: 161

Regole di avviso incluse 9

  • AvvisoHigh CPUCPU load sustained above 90%, averaged per monitor across SNMP, Proxmox and agent sources; clears below 85 %.
  • InfoUnusual CPUCPU load noticeably different from the usual at this time and day of the week (seasonal baseline).
  • AvvisoDisk almost fullFilesystem 90% full or more, per mount point (SNMP, Proxmox storages and root filesystems); clears below 88 %.
  • AvvisoFilesystem almost fullAt this rate, the filesystem will be full within four days.
  • AllarmeUPS on batteryThe UPS is powering the load from battery.
  • AllarmeUPS battery lowThe UPS battery is low or depleted.
Mostra altre 3
  • AvvisoPort accumulating errorsA network port logged more than fifty errors in the last hour: usually a failing cable, a dirty fibre or a duplex mismatch (increase_prometheus(dumbmonit_if_errors_in[1h]) + increase_prometheus(dumbmonit_if_errors_out[1h]); nothing fires during the first hour of a new monitor, so errors counted before it was added are not reported as new).
  • AvvisoPort flappingA network port went down and up again more than twice in thirty minutes (changes_prometheus(dumbmonit_if_oper_status[30m])). A port disabled on purpose has no series and never fires.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Enable SNMP on the device

  1. Open the device's web interface and find its SNMP settings, often under Network, Services or Administration.

  2. Enable SNMP v2c and note the read-only community (public on many devices).

  3. If the device filters by address, allow this server's address.

  4. In DumbMonit, enter the address and the community: the rest is detected automatically.

Attenzione. A community is not encrypted on the network: on a shared network, prefer SNMP v3, which authenticates and encrypts.

Documentazione

SNMP value (single OID)

snmp_oid

Reads one SNMP object and checks its value against a range or a text.

Esempi

  • A temperature or humidity sensor
  • A UPS status or battery level
  • A version string or a firmware flag
  • A counter exposed by a Net-SNMP extend script

Cosa serve

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Porta predefinita: 161

Regole di avviso incluse 1

  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Monitor a single SNMP value

  1. On the device, enable SNMP and check that the community or the v3 user may read the object (the SNMP view must grant its branch).

  2. In DumbMonit, enter the device address, then the community or the v3 user.

  3. Fill in the object (OID) with its instance suffix, for example 1.3.6.1.2.1.1.3.0.

  4. Optional: set a minimum and a maximum, or an expected text, to be warned when the value drifts.

Attenzione. An object the agent does not know, or that its SNMP view hides, is reported down with the reason not_found.

Documentazione

MikroTik RouterOS

mikrotik

RouterOS and RouterBOOT versions behind, CPU, memory, temperatures, fans and power supplies, and errors and link losses on every interface.

Esempi

  • hAP
  • RB5009
  • CCR
  • CRS switch
  • Cloud Hosted Router

Cosa serve

  • Read-only userThe dumbmonit user created above, in the dumbmonit-read group. Sent as HTTP basic authentication.

Porta predefinita: 443

Regole di avviso incluse 2

  • AvvisoMikroTik CPU highThe router's CPU has stayed above 90 %: routing, the firewall or a script is saturating it. Clears below 80 %.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a read-only user on the router

  1. WinBox or WebFig → System → Users → Groups → Add: name the group as follows and tick only the policies listed below.

    dumbmonit-read

  2. System → Users → Add: create the user dumbmonit in that group, with a long random password.

    dumbmonit

  3. IP → Services: enable www-ssl and pick a certificate (create one under System → Certificates).

  4. Optional, to hear about new RouterOS versions: System → Scheduler → Add, interval 1d, start time startup, with this On Event script.

    /system package update check-for-updates once

  5. In DumbMonit, enter the router's address (192.168.88.1) with that user name and password.

Attenzione. RouterOS 7.1 or later is required (RouterOS 6 has no REST API); with a self-signed certificate, tick "Accept an unverifiable certificate" in the options.

Documentazione

UniFi Network

unifi

The UniFi network and what it manages: gateways, switches and access points offline or waiting for adoption, firmware updates, WAN and Internet status, clients and alarms, and the last connection of the clients you mark as worth watching.

Esempi

  • UniFi OS console (Dream Machine, Cloud Gateway, Cloud Key)
  • UniFi Network Server (self-hosted)

Cosa serve

  • API key (UniFi OS console)Reads devices, their load and the client count through the official Integration API. Created in Settings → Control Plane → Integrations.
  • View Only accountA local account with the View Only role. Also reads the WAN, Internet and alarm status, and works on a self-hosted server.

Porta predefinita: 443

Regole di avviso incluse 8

  • AvvisoUniFi device offlineA UniFi device adopted by the controller is offline, isolated or failed to adopt.
  • AllarmeUniFi Internet downThe UniFi gateway reports no Internet connection. Without a UniFi gateway the series does not exist and the rule stays silent.
  • AvvisoUniFi WAN link downA WAN link of the UniFi gateway is down: with two links, redundancy is lost while nothing seems broken. A disabled port has no series.
  • AvvisoUniFi gateway CPU highThe UniFi gateway's processor has been above 90% for fifteen minutes; clears below 80 %.
  • InfoUniFi device waiting for adoptionA device appeared on the network and waits to be adopted in UniFi.
  • InfoUniFi firmware update availableA firmware update is available for UniFi devices.
Mostra altre 2
  • AvvisoUniFi alarmsUniFi logged critical events or raised alarms in the last 24 hours. Only read with a View Only account.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a read-only access in UniFi Network

  1. For an API key on a UniFi OS console: UniFi Network → Settings → Control Plane → Integrations → Create API Key. Name it DumbMonit and copy it: it is shown once.

  2. Or create a local account (needed for WAN and alarm status, and on a self-hosted server): Settings → Admins & Users → Create New, local access only.

    dumbmonit

  3. Set that account's UniFi Network role to View Only.

  4. In DumbMonit, enter the address (unifi.lan, or unifi.lan:8443 for a self-hosted server) and paste the key or the account.

  5. If the network is not the default site, set the Site option to the short name shown after /manage/ or /network/ in the address bar.

Attenzione. Use a local account, never the owner or a UI.com cloud account, and accept the console's self-signed certificate in the options unless you installed your own.

Documentazione

Cisco Meraki

Betameraki

A Cisco Meraki organization through the Dashboard API: devices offline, Internet uplinks that failed, license out of compliance or expiring, clients per network.

Esempi

  • Meraki MX / MS / MR
  • Cisco Meraki cloud dashboard

Cosa serve

  • API keyThe key of the read-only administrator created for DumbMonit, sent as a bearer token.

Porta predefinita: 443

Regole di avviso incluse 5

  • AvvisoMeraki device offlineA Cisco Meraki device has been offline (out of reach of the cloud dashboard) for ten minutes. Dormant devices, unseen for a long time, are left out.
  • AvvisoMeraki uplink failedA Meraki router lost the Internet access of a configured uplink (the wired and cellular sockets without a cable are not counted).
  • AvvisoMeraki license problemThe Meraki license is not in compliance (expired, missing or out of compliance): the dashboard may stop managing the devices.
  • AvvisoMeraki license expiringA Meraki license expires in less than 30 days.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a read-only API key for DumbMonit

  1. In the Meraki dashboard, open Organization → Settings and tick Enable access to the Cisco Meraki Dashboard API.

  2. Open Organization → Administrators → Add admin and create an administrator dedicated to DumbMonit, with Organization access set to Read-only.

    [email protected]

  3. Sign in as that administrator, open My profile → API access and click Generate new API key. Copy it: the dashboard shows it only once.

  4. In DumbMonit, enter api.meraki.com as the address and paste the key as API key. Leave Organization empty to read the first organization the key sees.

Attenzione. A dormant device (not seen for a long time) is counted but never reported as down, and a WAN socket without a cable is not a failed uplink: only an uplink that lost its Internet access is.

Documentazione

TP-Link Omada

Betaomada

A TP-Link Omada controller through its OpenAPI: devices disconnected, CPU and memory saturated, firmware updates offered, clients per site.

Esempi

  • Omada software controller
  • OC200 / OC300 hardware controller
  • EAP access points, TL-SG switches, ER gateways

Cosa serve

  • OpenAPI clientThe client created for DumbMonit under Open API, in Client mode with the Viewer role.

Porta predefinita: 8043

Regole di avviso incluse 5

  • AvvisoOmada device offlineAn Omada access point, switch or gateway has been disconnected from the controller for ten minutes.
  • AvvisoOmada device CPU highAn Omada device has had its CPU above 90 % for fifteen minutes.
  • AvvisoOmada device memory highAn Omada device has had its memory above 90 % for fifteen minutes.
  • InfoOmada firmware updateThe Omada controller offers a firmware update for a device.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a read-only OpenAPI client for DumbMonit

  1. In the Omada controller, open Global View → Settings → Platform Integration → Open API and click Add New App.

  2. Name the app as follows, choose the Client access mode and give it the Viewer role on the sites to read.

    dumbmonit

  3. Click Apply: the controller shows the Omada ID, the Client ID and the Client Secret. Copy them: the secret is shown once.

  4. In DumbMonit, enter the controller address (omada.lan) and the port (8043, or 443 for a hardware controller), then paste the Client ID and the Client secret.

Attenzione. The Omada controller ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own. The OpenAPI exists from controller version 5.9.

Documentazione

Aruba Central

Betaarubacentral

The Wi-Fi access points, switches and gateways of an HPE Aruba Networking Central account through its cloud API: devices offline, active critical alerts, devices in poor health, and the number of connected clients.

Esempi

  • Aruba access points
  • Aruba CX switches
  • Aruba gateways

Cosa serve

  • API clientRecommended: DumbMonit exchanges the client for an access token and renews it by itself.
  • Access tokenWorks for a test, but expires after two hours and DumbMonit cannot renew it.

Porta predefinita: 443

Regole di avviso incluse 4

  • AvvisoAruba Central device offlineAruba Central reports an access point, switch or gateway offline.
  • AvvisoAruba Central critical alertAruba Central has at least one active critical alert.
  • InfoAruba Central devices in poor healthAruba Central rates at least one device in poor health for an hour.
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a personal API client for DumbMonit

  1. Sign in to HPE GreenLake (common.cloud.hpe.com) and open Manage Workspace → Personal API clients.

  2. Click Create personal API client, name it as follows and choose your Central instance as the service.

    dumbmonit

  3. Copy the client ID and the client secret: the secret is shown once, and HPE keeps no copy.

  4. In Central, open the API gateway page (Menu → API Gateway → REST API) and note the base URL of your region.

  5. In DumbMonit, enter that base URL as the address (for example us1.api.central.arubanetworks.com) and paste the client ID and the client secret.

Attenzione. Beta: written from HPE's published API reference, not yet tested on a real Central account. It reads the new Central API with Central credentials; credentials scoped to the GreenLake platform and classic Central are not supported.

Documentazione

Tailscale

tailscale

The devices of a tailnet through the Tailscale API: servers offline, node keys about to expire, devices awaiting approval, clients to update, and each device's last connection.

Esempi

  • Tailscale tailnet
  • Subnet routers
  • Exit nodes

Cosa serve

  • OAuth clientRecommended: a client limited to the devices:core:read scope, which can change nothing.
  • API access tokenWorks too, but carries every right of the user who created it and expires after 90 days at most.

Porta predefinita: 443

Regole di avviso incluse 5

  • AvvisoTailscale device offlineA Tailscale device that must stay online (a tagged device by default) has been disconnected for more than 15 minutes (dumbmonit_tailscale_device_offline_seconds and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • AvvisoTailscale node key expiringA Tailscale device's node key expires in less than 14 days: it will leave the tailnet until someone signs it in again.
  • AvvisoTailscale device awaiting approvalA device joined the tailnet and awaits approval: approve it if it is expected, remove it otherwise.
  • InfoTailscale client updateA Tailscale device that must stay online runs a client with an update available (dumbmonit_tailscale_device_update_available and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Create a read-only OAuth client for DumbMonit

  1. In the Tailscale console (login.tailscale.com), open Settings → Trust credentials → Credential → OAuth.

  2. Tick only the read scope listed below, then click Generate credential.

  3. Copy the client ID and the client secret (tskey-client-...): the secret is shown once.

  4. In DumbMonit, enter api.tailscale.com as address and paste them as Client ID and Client secret; leave the Tailnet option empty.

Attenzione. Only tagged devices (servers, subnet routers, exit nodes) are expected to stay online: name the ones to watch in the Devices to keep online option, or enter all.

Documentazione

OpenVPN server

openvpn

An OpenVPN server through its management interface: version, whether it reports itself connected, and every client currently in session with its addresses and traffic.

Esempi

  • OpenVPN Access Server
  • A plain openvpn --server on Linux
  • pfSense or OPNsense OpenVPN (management enabled)

Cosa serve

  • Management passwordThe shared password set by the third argument of the server's "management" directive.

Nessun account necessario.

Porta predefinita: 7505

Regole di avviso incluse 1

  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Turn on the management interface

  1. Add this line to the server's configuration (server.conf, or as.conf on OpenVPN Access Server) and restart OpenVPN.

    management 0.0.0.0 7505

  2. Recommended: protect it with a password, put in a file readable by the OpenVPN process alone and added as a third argument.

    management 0.0.0.0 7505 /etc/openvpn/management-password

  3. In DumbMonit, enter the server's address (vpn.lan, port 7505) and the management password if one is set.

Attenzione. Anyone who reaches the management port and knows the password can disconnect clients and reconfigure the running server: allow only the DumbMonit host in the firewall and set a password.

Documentazione

RADIUS server

radius

Authenticates a test account (Access-Request): catches a server that is up but no longer accepts logins.

Esempi

  • FreeRADIUS
  • Windows NPS
  • The RADIUS behind a WPA-Enterprise Wi-Fi
  • The RADIUS behind a VPN or a 802.1X switch

Cosa serve

  • Shared secret and test accountThe secret defined for this host on the RADIUS server, and an account created for monitoring.

Porta predefinita: 1812

Regole di avviso incluse 1

  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Monitor a RADIUS server

  1. On the RADIUS server, declare the DumbMonit host as a client, with a shared secret (clients.conf on FreeRADIUS, RADIUS Clients on Windows NPS).

  2. Create a test account without a second factor, and note its name and password.

  3. In DumbMonit, enter the server (UDP port 1812 by default), the shared secret and the test account.

  4. Optional: change the NAS identifier if the server filters requests by it.

Attenzione. A wrong shared secret, or a host not declared as a client, usually makes the server stay silent: the check then reports a timeout.

Documentazione

Network configuration backup

netconfig

Keep every version of a switch, router or firewall configuration, see what changed line by line, and be told when it changes.

Esempi

  • Cisco switch or router
  • Juniper router
  • FortiGate or pfSense firewall
  • MikroTik router
  • Aruba switch

Cosa serve

  • SSH loginA read-only account is enough on most devices. Stored encrypted, never shown again.
  • API key and secretOPNsense API profile: the key and secret of an API user allowed to download backups.
  • API keyPAN-OS API profile: the API key of a read-only role, sent in the X-PAN-KEY header.

Porta predefinita: 22

Regole di avviso incluse 1

  • AllarmeMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passaggi di configurazione: Back up a device configuration

  1. Choose the device model in "Device model": it decides the commands sent, and nothing else is ever run on the device.

  2. Create a read-only account on the device that may log in over SSH and show the running configuration.

  3. For OPNsense through its API, create an API key for a user allowed to download backups; for PAN-OS, generate the API key of a read-only role.

  4. The first SSH connection remembers the device's host key: if it ever changes, backups stop and an alert asks you to check it.

Attenzione. Configurations hold secrets: they are stored encrypted, shown with their secrets masked, and only an administrator signed in can reveal or download them.

Documentazione

Altre famiglie