DumbMonit
PT-BR
GitHub Demo ao vivo

Monitores

Firewalls

OPNsense, pfSense, FortiGate e Sophos: gateways, túneis, interfaces, alta disponibilidade e licenças.

As descrições dos monitores e os textos das regras de alerta estão em inglês, como no produto. As etiquetas da página seguem o seu idioma.

OPNsense

opnsense

Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.

Exemplos

  • OPNsense firewall
  • Home router
  • Multi-WAN edge

O que você precisa

  • API key and secretThe two lines of the file OPNsense downloads when the key is created.

Porta padrão: 443

Regras de alerta incluídas 12

  • AlertaInternet gateway downdpinger no longer gets an answer from a gateway. On a multi-WAN firewall the traffic has already moved to another link, quietly. loss and delay are warnings, not failures, and do not fire this rule.
  • AvisoGateway losing packetsA gateway is losing more than a fifth of the packets sent to it: the link answers, badly. Clears below 10 %.
  • InfoGateway slowA gateway's round-trip time has stayed above 300 ms. Three hundred milliseconds leaves a mobile backup link alone.
  • AvisoFirewall state table filling uppf is tracking more than 80 % of the connections it is allowed. Past the limit the firewall drops new connections with no other symptom.
  • AvisoFirewall network buffers exhaustedMore than 90 % of the FreeBSD network buffers are in use. A firewall that runs out stops forwarding with the CPU still idle.
  • AvisoVPN tunnel downA configured VPN tunnel has had no session for ten minutes. A plugin that is not installed, or a connection that is disabled, has no series and cannot fire.
Mostrar mais 6
  • AvisoFirewall resolver stoppedUnbound has stopped answering. The firewall still routes; the machines behind it no longer resolve. Turn this rule off if your firewall resolves with something else.
  • AlertaFirewall core service stoppeddpinger, which watches the gateways, or configd, which runs everything else, is stopped. Only those two, because a service switched off on purpose is not a failure.
  • AvisoFirewall too hotA sensor reads above 85 °C: the fanless box in the cupboard is about to start throttling. Clears at 78 °C.
  • InfoFirewall left in CARP maintenance modeCARP has been left in persistent maintenance mode: this firewall handed its virtual addresses to its partner and will not take them back on its own.
  • InfoFirewall reboot pendingAn update is installed but needs a reboot to take effect.
  • InfoFirewall updates pendingThe firewall has packages waiting to be updated. It is the most exposed machine on the network.
Etapas de configuração: Create a read-only API key in OPNsense

  1. System → Access → Groups → Add: name the group as follows.

    dumbmonit

  2. In that group, under Assigned Privileges, add the privileges listed below.

  3. System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.

    dumbmonit

  4. Edit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.

  5. In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.

Atenção. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.

Documentação

pfSense

pfsense

A pfSense firewall through its REST API package: gateways down or losing packets, interfaces without link, stopped services, CPU, memory and disk.

Exemplos

  • pfSense CE
  • pfSense Plus
  • Netgate appliance

O que você precisa

  • REST API keyThe key created for the dumbmonit user: it carries only that user's read privileges.

Porta padrão: 443

Regras de alerta incluídas 7

  • AlertapfSense gateway downA pfSense gateway is down: its monitor address no longer answers, and the traffic it carries stops or fails over.
  • AvisopfSense gateway losing packetsA pfSense gateway loses more than 10 % of the probes to its monitor address: the line is degraded (dumbmonit_pfsense_gateway_loss_percent unless on (target, gateway) dumbmonit_pfsense_gateway_up == 0).
  • AvisopfSense gateway slowThe round trip to a pfSense gateway's monitor address has stayed above 500 ms for fifteen minutes.
  • AvisopfSense interface without linkAn enabled pfSense interface has no link: cable, switch port or network card.
  • AvisopfSense service stoppedA pfSense service that is enabled is not running: DNS resolver, VPN, NTP….
  • AvisopfSense disk nearly fullThe pfSense disk is more than 90 % full: logs, reports and package updates stop being written.
Mostrar mais 1
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create a read-only REST API key for DumbMonit

  1. Install the pfSense-pkg-RESTAPI package (version 2) from Diagnostics → Command Prompt, with the file matching your pfSense version (2.7.2 below).

    pkg-static add https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.7.2-pkg-RESTAPI.pkg

  2. System → REST API → Settings: tick both BasicAuth and Key among the authentication methods.

  3. System → User Manager → Users → Add: create the user dumbmonit with a long random password.

  4. Edit the user and, under Assigned Privileges, add the privileges listed below.

  5. Create the key as dumbmonit, copy the key value of the answer, then remove the POST privilege again.

    curl -k -u dumbmonit -X POST -H 'Content-Type: application/json' -d '{"descr":"DumbMonit"}' https://pfsense.lan/api/v2/auth/key

  6. In DumbMonit, enter the pfSense address (pfsense.lan) and paste the key as API key.

Atenção. The REST API package is a community project, not part of pfSense: reinstall it after each pfSense upgrade. pfSense ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you replaced it.

Documentação

FortiGate

fortigate

A Fortinet firewall through the FortiOS REST API: IPsec tunnels down, interfaces without link, HA out of sync, memory near conserve mode, FortiGuard licences expiring.

Exemplos

  • FortiGate 40F / 60F / 100F
  • FortiGate VM
  • FortiOS 7.x

O que você precisa

  • API tokenThe token of the dumbmonit REST API user, sent as a bearer token.

Porta padrão: 443

Regras de alerta incluídas 9

  • AlertaFortiGate IPsec tunnel downNo phase 2 of a FortiGate site-to-site IPsec tunnel is up: the site behind it is cut off.
  • AvisoFortiGate interface without linkAn enabled FortiGate interface with an address has no link: cable, transceiver or the device in front.
  • AvisoFortiGate HA out of syncThe members of a FortiGate HA cluster no longer have the same configuration checksum: a failover would run another configuration.
  • AlertaFortiGate HA member lostA FortiGate HA cluster has fewer members than in the last 24 hours: there is no standby any more (max_over_time(dumbmonit_fortigate_ha_members[1d]) - dumbmonit_fortigate_ha_members).
  • AvisoFortiGate memory near conserve modeFortiGate memory has stayed above 85 % for ten minutes: at 88 % (by default) it enters conserve mode and stops inspecting new sessions.
  • AvisoFortiGate CPU highFortiGate CPU has stayed above 90 % for fifteen minutes.
Mostrar mais 3
  • AvisoFortiGate licence expiringA FortiGuard or FortiCare licence of the FortiGate expires in less than 30 days, or has expired.
  • InfoFortiGate firmware updateFortiGuard offers a newer patch release of the FortiOS branch the FortiGate runs.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create a read-only REST API user for DumbMonit

  1. System → Admin Profiles → Create New: name the profile as follows and set the access permissions listed below, everything else None.

    dumbmonit-ro

  2. System → Administrators → Create New → REST API Admin: name it as follows and pick that profile.

    dumbmonit

  3. Under Trusted Hosts, enter the DumbMonit server's address with a /32 mask: FortiGate refuses 0.0.0.0/0.

  4. Click OK: FortiGate shows the API token once. Copy it.

  5. In DumbMonit, enter the FortiGate address (fw.lan) and paste the token as API token.

Atenção. FortiGate ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentação

Sophos Firewall

sophos

A Sophos Firewall (SFOS) through its XML API: the link of every interface in a zone, and which IPsec connections are activated. Its live tunnel, HA and licence state are not in that API.

Exemplos

  • Sophos XGS
  • Sophos Firewall virtual appliance
  • SFOS 19 to 21

O que você precisa

  • User name and passwordThe dumbmonit user, whose device access profile is read-only everywhere.

Porta padrão: 4444

Regras de alerta incluídas 2

  • AvisoSophos interface without linkA Sophos Firewall interface that is switched on and bound to a zone has no link.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Allow DumbMonit to read the Sophos Firewall XML API

  1. Profiles → Device access: add a profile named DumbMonit read-only and set every permission to Read-only.

  2. Authentication → Users: add a user named dumbmonit, of type Administrator, with that profile and a long random password.

    dumbmonit

  3. Backup & firmware → API (Administration → API access from SFOS 22): turn on the API configuration and add the DumbMonit server's address to the allowed IP addresses.

  4. In DumbMonit, enter the firewall address (sophos.lan) with that user name and password.

Atenção. The API listens on the administration port (4444 by default) with a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentação

Palo Alto PAN-OS

Betapaloalto

A Palo Alto Networks firewall through the PAN-OS XML API: interfaces without link, HA peer lost or out of sync, session table filling up, management CPU and memory, licences expiring, failed commits.

Exemplos

  • PA-400 / PA-1400 series
  • VM-Series
  • PAN-OS 10.x and 11.x

O que você precisa

  • User name and passwordThe dumbmonit account: DumbMonit asks the firewall for an API key with it and keeps the key, the password only travels in a request body.
  • API keyA key already generated for the dumbmonit account, sent in the X-PAN-KEY header.

Porta padrão: 443

Regras de alerta incluídas 9

  • AvisoPalo Alto interface without linkA Palo Alto firewall interface bound to a zone has no link: cable, transceiver or the device in front.
  • AlertaPalo Alto HA peer lostThe peer of a Palo Alto HA pair is no longer active or passive, or the HA link to it is down: there is no standby any more.
  • AvisoPalo Alto HA out of syncThe running configuration of a Palo Alto HA pair is not synchronized: a failover would run another configuration.
  • AlertaPalo Alto HA member not functionalThis Palo Alto firewall reports its HA state as suspended or non-functional.
  • AvisoPalo Alto session table filling upThe session table of a Palo Alto firewall has stayed above 90 % of its capacity for ten minutes: new sessions will be refused when it is full.
  • AvisoPalo Alto management CPU highThe management plane CPU of a Palo Alto firewall has stayed above 90 % for fifteen minutes.
Mostrar mais 3
  • AvisoPalo Alto licence expiringA licence or subscription of a Palo Alto firewall expires in less than 30 days, or has expired.
  • InfoPalo Alto commit failedThe last configuration commit of a Palo Alto firewall failed: the running configuration is not the one that was saved.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create a read-only XML API account for DumbMonit

  1. Device → Admin Roles → Add: name the role as follows. On the XML API tab enable Operational Requests only; leave every other privilege, and the Web UI and Command Line tabs, disabled.

    dumbmonit-ro

  2. Device → Administrators → Add: name the account as follows, set Authentication to a password, the type to Role Based and the role to the one above.

    dumbmonit

  3. Click Commit: the role and the account exist only once committed.

  4. In DumbMonit, enter the firewall address (pa.lan) with that user name and password, or with an API key you generated for that account.

Atenção. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentação

SonicWall SonicOS

Betasonicwall

A SonicWall firewall through the SonicOS 7 API: the link of every interface bound to a zone. Kept minimal on purpose: only the API paths SonicWall publishes are read.

Exemplos

  • SonicWall TZ / NSa / NSsp
  • SonicWall NSv
  • SonicOS 7.x

O que você precisa

  • User name and passwordThe dumbmonit user, in a read-only group, sent as HTTP Basic.

Porta padrão: 443

Regras de alerta incluídas 2

  • AvisoSonicWall interface without linkA SonicWall interface bound to a zone has no link.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create a read-only user for the SonicOS API

  1. Device → Settings → Administration → Audit/SonicOS API: make sure HTTP Basic Access (RFC-2617) is on, then click Accept.

  2. Device → Users → Local Users & Groups → Add User: name it as follows, give it a long random password and add it to the group SonicWall Read-Only Admins.

    dumbmonit

  3. Allow HTTPS management on the interface DumbMonit reaches the firewall through (Device → Network → Interfaces → Configure → Management).

  4. In DumbMonit, enter the firewall address (sonicwall.lan) with that user name and password.

Atenção. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

Documentação

Outras famílias