DumbMonit
PT-BR
GitHub Demo ao vivo

Monitores

DNS, correio e segurança

Pi-hole, AdGuard Home, CrowdSec, e os servidores e gateways de correio: SMTP, MDaemon, SecurityGateway e Proxmox Mail Gateway. Listas de bloqueio para um servidor de e-mail ou uma faixa de IP.

As descrições dos monitores e os textos das regras de alerta estão em inglês, como no produto. As etiquetas da página seguem o seu idioma.

Pi-hole

pihole

The DNS ad blocker: blocking on or paused, queries and share blocked, blocklist age, upstream failures, updates and its own diagnosis messages.

Exemplos

  • Pi-hole v6 on a Raspberry Pi
  • Pi-hole in Docker

O que você precisa

  • App password (recommended)Generated under Settings → Web interface / API in expert mode. It cannot change Pi-hole's settings.

Não é preciso nenhuma conta.

Porta padrão: 80

Regras de alerta incluídas 5

  • AvisoPi-hole blocking disabledBlocking is off, paused or failed. The hold lets a five-minute pause from the web interface go by.
  • AvisoPi-hole blocklists staleThe blocklists (gravity) have not been rebuilt for more than eight days: the weekly update fails.
  • InfoPi-hole update availableA newer version is available: the image in Docker, core, web interface or FTL otherwise. Pi-hole checks once a day.
  • InfoPi-hole diagnosis messagesPi-hole lists messages on its diagnosis page: a blocklist that failed to download, a rate-limited client, an overloaded host.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create an app password in Pi-hole

  1. In Pi-hole's web interface, open Settings → Web interface / API and switch the page from Basic to Expert.

  2. Click Configure app password, copy the password shown, then click Enable new app password.

  3. Check that Settings → All settings → Webserver and API → webserver.api.app_sudo is off, its default.

  4. In DumbMonit, enter Pi-hole's address and paste the app password, or pick No password if the web interface has none.

Atenção. Pi-hole v6 or later is required; the app password can still pause blocking and edit lists through the API, so keep it for DumbMonit only.

Documentação

AdGuard Home

adguard

The DNS filter: protection on or paused, queries and blocks, filter lists that stopped updating, upstream servers that fail, updates.

Exemplos

  • AdGuard Home
  • AdGuard Home on OpenWrt or a NAS

O que você precisa

  • User name / passwordThe dedicated user added to AdGuardHome.yaml, sent as HTTP basic authentication.

Não é preciso nenhuma conta.

Porta padrão: 80

Regras de alerta incluídas 6

  • AvisoAdGuard Home protection offProtection disabled, or paused and not back yet.
  • AlertaAdGuard Home DNS not runningThe web interface answers but the DNS server is stopped.
  • AvisoAdGuard Home upstream failingAn upstream DNS server fails AdGuard Home's own test, or stays silent 4 seconds.
  • AvisoAdGuard Home filter lists staleThe oldest update of an enabled filter list is more than three days old.
  • InfoAdGuard Home update availableA newer version is announced by AdGuard Home's own version check; never fires when that check is disabled, as in the official Docker image.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Add a user for DumbMonit to AdGuard Home

  1. Make a bcrypt hash of a long random password (htpasswd comes with apache2-utils or httpd-tools).

    htpasswd -B -C 10 -n -b dumbmonit 'LONG-RANDOM-PASSWORD'

  2. Stop AdGuard Home, add this line under users: in AdGuardHome.yaml with HASH replaced by the printed hash, then start it again.

    - { name: dumbmonit, password: "HASH" }

  3. In DumbMonit, enter the address of the AdGuard Home web interface, then the user dumbmonit and its password.

Atenção. AdGuard Home has no read-only user, so dumbmonit can change every setting: keep its password to DumbMonit alone, and turn on HTTPS in Settings → Encryption settings across an untrusted network.

Documentação

CrowdSec

crowdsec

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

Exemplos

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

O que você precisa

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

Não é preciso nenhuma conta.

Porta padrão: 6060

Regras de alerta incluídas 4

  • AlertaCrowdSec Local API downThe Local API does not answer /health.
  • AvisoCrowdSec bouncer stopped pullingA bouncer's requests did not change in 30 minutes (changes_prometheus(dumbmonit_crowdsec_bouncer_requests_total[30m])).
  • AvisoCrowdSec reads no logsNot a single log line read in six hours (increase_prometheus(dumbmonit_crowdsec_lines_read_total[6h])).
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

Atenção. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

Documentação

Mail relay (SMTP)

smtp

A mail server greets, offers STARTTLS and accepts a login, like a real client.

Exemplos

  • Your provider's SMTP relay
  • A local Postfix or msmtp
  • Proxmox Mail Gateway
  • The submission port of a mail server

O que você precisa

  • Username / passwordSent once the connection is encrypted, never before.

Não é preciso nenhuma conta.

Porta padrão: 587

Regras de alerta incluídas 5

  • AlertaService downThe service has not responded correctly for three minutes.
  • AvisoService flappingThe service changed state more than six times in thirty minutes (changes(dumbmonit_probe_success{probe!="push"}[30m])).
  • AvisoSlow serviceThe service takes more than three seconds to respond; failed checks are left out.
  • AvisoCertificate expiring soonThe certificate expires in less than fourteen days.
  • AlertaCertificate expiredThe certificate has expired.
Etapas de configuração: Monitor a mail relay

  1. In DumbMonit, enter the mail server, for example smtp.example.com:2525 (the usual port for the encryption by default).

  2. Pick the encryption: STARTTLS for port 587, TLS for port 465, None for a relay on your own network on port 25.

  3. Optional: fill in an account, to check that the relay still accepts it (a refused password is not reported as an outage).

  4. Optional: name an Expected extension, such as STARTTLS, to be warned when the relay stops advertising it.

Atenção. An accepted session does not prove mail leaves: watch the relay's queues for that.

Documentação

Mailbox (IMAP)

imap

An IMAP server greets, offers TLS and accepts a login, like a real mail client.

Exemplos

  • Dovecot
  • Your provider's IMAP server
  • A mailbox behind Mailcow or Mailu
  • Proxmox Mail Gateway's mail host

O que você precisa

  • Username / passwordSent once the connection is encrypted, never before.

Não é preciso nenhuma conta.

Porta padrão: 993

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Monitor an IMAP server

  1. In DumbMonit, enter the mail server, for example imap.example.com:1993 (port 993 with the default encryption).

  2. Pick the encryption: TLS for port 993, STARTTLS for port 143, None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Atenção. The check never opens a mailbox: a server that logs in but cannot read its storage answers perfectly here.

Documentação

Mailbox (POP3)

pop3

A POP3 server greets, offers TLS and accepts a login, like a real mail client.

Exemplos

  • Dovecot
  • Your provider's POP3 server
  • An old mail server that only speaks POP3

O que você precisa

  • Username / passwordSent once the connection is encrypted, never before.

Não é preciso nenhuma conta.

Porta padrão: 995

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Monitor a POP3 server

  1. In DumbMonit, enter the mail server, for example pop.example.com:1995 (port 995 with the default encryption).

  2. Pick the encryption: TLS for port 995, STARTTLS for port 110 (STLS command), None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Atenção. The check never lists or reads messages: it logs in, then says goodbye.

Documentação

MDaemon Email Server

Via agentemdaemon

Needs the agent on the Windows server: mail queues, sessions, Windows services and disk space, plus the mail ports answering and, optionally, the XML API.

Exemplos

  • MDaemon Email Server

O que você precisa

  • XML API account (optional, version only)Also reads the version through the XML API. Leave the credential empty to watch the mail services only.

Não é preciso nenhuma conta.

Porta padrão: 25

Regras de alerta incluídas 9

  • AlertaMDaemon mail service downA watched mail service of the MDaemon server does not answer, or greets to refuse service. Only the services listed on the monitor have a series. The notification names the service and its port.
  • AvisoMDaemon XML API not answeringThe XML API has stopped answering while the mail services still do: Remote Administration is probably stopped. Only a monitor with an account has the series.
  • AvisoMDaemon mail queue growingThe inbound, local or remote queue has grown by more than a hundred messages in two hours (delta(dumbmonit_mdaemon_queue_messages{queue=~"inbound\|local\|remote"}[2h])): MDaemon has stopped delivering from it. Read by the [agent](../devices/agent.md#windows-performance-counters) on the MDaemon server, so the alert is on the agent's monitor.
  • AvisoMDaemon Bad queue not emptyMessages are waiting in the Bad queue: MDaemon could neither deliver nor bounce them, and they stay there until an administrator releases or deletes them.
  • AvisoMDaemon Retry queue highMore than fifty messages wait in the Retry queue: remote servers keep refusing mail temporarily.
  • AlertaMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
Mostrar mais 3
  • AvisoMail queue stuckThe oldest message of an inbound, local or remote queue has been waiting for more than two hours: the queue is frozen or delivery is blocked. Counted from the queue folders by the agent on the mail server.
  • AvisoMDaemon queue frozenMDaemon reports one of its queues as frozen: it no longer processes it. Read from the performance counters by the agent on the mail server.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Install the agent on the MDaemon server, then add this monitor

  1. On the Windows server that runs MDaemon, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds MDaemon by itself.

  2. Back here, enter the server address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Leave the credential on Services only: the agent already brings the queues, sessions, Windows services and disk space, and the mail ports are checked from DumbMonit.

  4. Optional, only to read the exact version: open Accounts → Account Manager → New account and create the account below, with a long unique password.

    [email protected]

  5. Allow the address DumbMonit connects from in Setup → XML API Service → Address Restrictions (Setup → XML API Management on MDaemon 26), then enter the account's full email address and its password.

  6. To check more ports than SMTP, IMAP and webmail, set the Services option to a list like this one.

    smtp,msa,imap,pop3,imaps,webmail

Atenção. The queues, sessions and Windows services of MDaemon can only be read on the server itself: without the agent, DumbMonit sees the mail ports and nothing else. The XML API account is optional and only brings the version; MDaemon has no read-only role for it, so never reuse your own account, and use a password found nowhere else, as repeated failures can get DumbMonit blocked.

Documentação

SecurityGateway for Email Servers

Via agentesecuritygateway

Needs the agent on the Windows server: Windows services, mail queue folders and disk space, plus the gateway ports answering and the REST API counters (12.5 and later).

Exemplos

  • SecurityGateway for Email Servers

O que você precisa

  • API key (12.5 and later, recommended)Also reads the version and the performance counters through the REST API. Leave the credential empty to watch the services only.

Não é preciso nenhuma conta.

Porta padrão: 25

Regras de alerta incluídas 5

  • AlertaMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
  • AlertaSecurityGateway service downA watched service of the gateway does not answer, or greets to refuse service.
  • AvisoSecurityGateway API not answeringThe REST API has stopped answering while the services still do. Only a monitor with an API key has the series.
  • AvisoSecurityGateway delivery queue growingThe delivery queue has grown by more than a hundred messages in two hours (delta(dumbmonit_securitygateway_counter{counter=~".*(delivery_queue\|queued_for_delivery).*"}[2h])): the mail server behind the gateway is probably refusing mail. The counter names come from the API as they are; if your version names the queue differently, adjust the matcher.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Install the agent on the gateway server, then add this monitor

  1. On the Windows server that runs SecurityGateway, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds SecurityGateway by itself.

  2. Back here, enter the gateway address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Recommended, for the performance counters: in SecurityGateway 12.5 or later, open Setup/Users → Accounts → Administrators → New and create the account below, with a long unique password.

    dumbmonit

  4. Give the account the role listed below, and restrict it to the DumbMonit address in IP Restriction Options.

  5. Sign in as that account, open Setup/Users → Accounts → API Keys and create a key with an expiry date, then paste the key in DumbMonit.

  6. To check more ports than SMTP and the web interface, set the Services option to a list like this one.

    smtp,web_https

Atenção. The Windows services, mail queue folders and disk space of SecurityGateway can only be read on the server itself: without the agent, DumbMonit sees the gateway ports and, with a key, the REST API counters. SecurityGateway has no read-only role or narrower key: create the key from the dedicated account, never your own, and give it an expiry date.

Documentação

Proxmox Mail Gateway

pmg

Mail queues and stuck mail, spam and virus traffic, quarantine, signature age.

Exemplos

  • Proxmox Mail Gateway

O que você precisa

  • Username / password (recommended)Opens a two-hour session, renewed automatically. Proxmox Mail Gateway does not issue API tokens: this is its normal way in.
  • API tokenOnly if your gateway offers API tokens: Proxmox Mail Gateway 9 and earlier do not create any. Use the username and password instead.

Porta padrão: 8006

Regras de alerta incluídas 9

  • AvisoMail queue growingThe deferred mail queue has grown by more than a hundred messages in two hours (delta(dumbmonit_pmg_queue_messages{queue="deferred"}[2h])): the next hop is probably refusing mail. Growth rather than size, because a busy gateway always keeps a few dozen deferred.
  • AlertaMail stuck in the queueA message has been waiting in a queue for more than four hours. The age is a lower bound — qshape reports brackets — so the rule fires late rather than early. The notification names the queue.
  • AlertaMail gateway service stoppedA service the gateway needs to accept and filter mail is stopped. A unit that is not installed has no series and cannot fire.
  • AvisoVirus signatures out of dateThe ClamAV daily virus signatures are more than two days old: freshclam has stopped updating them and the gateway keeps filtering with last week's list.
  • AvisoSpam rules out of dateThe SpamAssassin rules are more than eight days old. A channel that has never been updated has no date and no series.
  • AvisoQuarantine filling upThe spam quarantine has taken in more than a thousand messages in six hours (delta(dumbmonit_pmg_quarantine_messages{kind="spam"}[6h])): a campaign, or a rule that just put a legitimate domain in the bin.
Mostrar mais 3
  • AvisoMail gateway cluster degradedA gateway of the cluster is no longer in sync with the others: it filters with an out-of-date rule database. A standalone gateway has no series.
  • AvisoMail gateway certificate expiringA certificate of the mail gateway expires in less than fourteen days.
  • InfoMail gateway updates pendingMore than twenty package updates are pending on the mail gateway.
Etapas de configuração: Create a read-only user in Proxmox Mail Gateway

  1. Open Configuration → User Management → Users → Add, enter the user name below, a long password used nowhere else, and tick Enabled.

    dumbmonit@pmg

  2. Set its Role to Audit, then click Add.

  3. In DumbMonit, enter the gateway address (for example mail.lan:8006), then this user name, realm included, and its password.

Atenção. Proxmox Mail Gateway has no API tokens, so DumbMonit signs in with this password. It uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

Documentação

mailcow

Betamailcow

Stopped containers, Postfix queue size and age, mail volume, mailboxes near their quota.

Exemplos

  • mailcow: dockerized

O que você precisa

  • Read-only API keyThe read-only key of System → Configuration → Access → API, sent in the X-API-Key header.

Porta padrão: 443

Regras de alerta incluídas 5

  • Alertamailcow container downA mailcow container is not running. The notification names the container.
  • Avisomailcow mail queue stuckThe oldest message in Postfix's queue has waited more than four hours.
  • Avisomailcow mail volume almost fullThe volume holding the mailboxes is more than 90 % full; clears below 88 %.
  • Infomailcow mailbox near quotaA mailbox is at 90 % of its quota or more.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Create a read-only API key in mailcow

  1. In mailcow, open System → Configuration → Access → API and find the Read-only access section.

  2. Tick Activate API, add DumbMonit's IP address to the allowed addresses and save.

  3. Copy the read-only key, then enter mailcow's address in DumbMonit and paste it.

Atenção. mailcow only answers the addresses allowed on its API page: if DumbMonit reaches it through NAT or a relay agent, allow that address instead.

Documentação

Mail server reputation

mail_blacklist

A mail domain's MX, or a mail server's public address, checked against the major DNS blocklists (Spamhaus, Barracuda, SpamCop…) or the ones you pick, with reverse DNS, SPF and DMARC, and the delisting page of every list that lists it. No API key needed.

Exemplos

  • Your company's mail domain
  • The public address of a mail server
  • An outgoing relay

O que você precisa

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Não é preciso nenhuma conta.

Regras de alerta incluídas 5

  • AlertaListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • AvisoListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • AvisoMail server reverse DNS mismatchAn address of the mail server has no reverse DNS, or its name does not resolve back to it: Gmail, Outlook.com and Yahoo refuse or junk such mail.
  • AvisoSPF or DMARC missingThe domain has no SPF record (or several), or no DMARC record: Gmail and Yahoo require both from bulk senders.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Check a mail server against the blocklists

  1. Enter the domain you send mail for ("example.com"), or the public IP address the server sends from.

  2. No API key is needed: leave the credential on No key.

  3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Atenção. A blocklist that does not answer is shown as unknown, never as clean.

Documentação

IP range blocklist

ip_blacklist

Every address of a public IPv4 range, up to a /24, checked against the major DNS blocklists, or the ones you pick: how many are listed, on which lists, and the delisting page of each. No API key needed.

Exemplos

  • Your office's public addresses
  • The /24 your servers send from
  • A hosting provider's block

O que você precisa

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Não é preciso nenhuma conta.

Regras de alerta incluídas 3

  • AlertaListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • AvisoListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Etapas de configuração: Check a public IP range against the blocklists

  1. Enter an IPv4 address or a CIDR range up to /24, for example "198.51.100.0/24".

  2. No API key is needed: leave the credential on No key.

  3. Tick the address blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Atenção. Spamhaus PBL lists end-user ranges that should not send mail directly: a listing there only matters for an address that runs a mail server.

Documentação

Outras famílias