DumbMonit
PT
GitHub Demo ao vivo

Monitores

Equipamento de rede

Switches, routers, pontos de acesso e VPN: qualquer dispositivo SNMP, MikroTik, UniFi, Tailscale e OpenVPN.

As descrições dos monitores e os textos das regras de alerta estão em inglês, como no produto. As etiquetas da página seguem o seu idioma.

SNMP device

snmp

Switches, routers, UPS, printers, access points: anything that answers SNMP.

Exemplos

  • Switch
  • Router
  • NAS
  • UPS
  • Printer

O que precisa

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Porta por omissão: 161

Regras de alerta incluídas 9

  • AvisoHigh CPUCPU load sustained above 90%, averaged per monitor across SNMP, Proxmox and agent sources; clears below 85 %.
  • InfoUnusual CPUCPU load noticeably different from the usual at this time and day of the week (seasonal baseline).
  • AvisoDisk almost fullFilesystem 90% full or more, per mount point (SNMP, Proxmox storages and root filesystems); clears below 88 %.
  • AvisoFilesystem almost fullAt this rate, the filesystem will be full within four days.
  • AlertaUPS on batteryThe UPS is powering the load from battery.
  • AlertaUPS battery lowThe UPS battery is low or depleted.
Mostrar mais 3
  • AvisoPort accumulating errorsA network port logged more than fifty errors in the last hour: usually a failing cable, a dirty fibre or a duplex mismatch (increase_prometheus(dumbmonit_if_errors_in[1h]) + increase_prometheus(dumbmonit_if_errors_out[1h]); nothing fires during the first hour of a new monitor, so errors counted before it was added are not reported as new).
  • AvisoPort flappingA network port went down and up again more than twice in thirty minutes (changes_prometheus(dumbmonit_if_oper_status[30m])). A port disabled on purpose has no series and never fires.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Enable SNMP on the device

  1. Open the device's web interface and find its SNMP settings, often under Network, Services or Administration.

  2. Enable SNMP v2c and note the read-only community (public on many devices).

  3. If the device filters by address, allow this server's address.

  4. In DumbMonit, enter the address and the community: the rest is detected automatically.

Atenção. A community is not encrypted on the network: on a shared network, prefer SNMP v3, which authenticates and encrypts.

Documentação

SNMP value (single OID)

snmp_oid

Reads one SNMP object and checks its value against a range or a text.

Exemplos

  • A temperature or humidity sensor
  • A UPS status or battery level
  • A version string or a firmware flag
  • A counter exposed by a Net-SNMP extend script

O que precisa

  • SNMP v1 / v2c (community)The simplest form: one shared word, sent unencrypted.
  • SNMP v3 (user, authentication, privacy)Authenticated and encrypted. Needs a USM user on the device.

Porta por omissão: 161

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Monitor a single SNMP value

  1. On the device, enable SNMP and check that the community or the v3 user may read the object (the SNMP view must grant its branch).

  2. In DumbMonit, enter the device address, then the community or the v3 user.

  3. Fill in the object (OID) with its instance suffix, for example 1.3.6.1.2.1.1.3.0.

  4. Optional: set a minimum and a maximum, or an expected text, to be warned when the value drifts.

Atenção. An object the agent does not know, or that its SNMP view hides, is reported down with the reason not_found.

Documentação

MikroTik RouterOS

mikrotik

RouterOS and RouterBOOT versions behind, CPU, memory, temperatures, fans and power supplies, and errors and link losses on every interface.

Exemplos

  • hAP
  • RB5009
  • CCR
  • CRS switch
  • Cloud Hosted Router

O que precisa

  • Read-only userThe dumbmonit user created above, in the dumbmonit-read group. Sent as HTTP basic authentication.

Porta por omissão: 443

Regras de alerta incluídas 2

  • AvisoMikroTik CPU highThe router's CPU has stayed above 90 %: routing, the firewall or a script is saturating it. Clears below 80 %.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a read-only user on the router

  1. WinBox or WebFig → System → Users → Groups → Add: name the group as follows and tick only the policies listed below.

    dumbmonit-read

  2. System → Users → Add: create the user dumbmonit in that group, with a long random password.

    dumbmonit

  3. IP → Services: enable www-ssl and pick a certificate (create one under System → Certificates).

  4. Optional, to hear about new RouterOS versions: System → Scheduler → Add, interval 1d, start time startup, with this On Event script.

    /system package update check-for-updates once

  5. In DumbMonit, enter the router's address (192.168.88.1) with that user name and password.

Atenção. RouterOS 7.1 or later is required (RouterOS 6 has no REST API); with a self-signed certificate, tick "Accept an unverifiable certificate" in the options.

Documentação

UniFi Network

unifi

The UniFi network and what it manages: gateways, switches and access points offline or waiting for adoption, firmware updates, WAN and Internet status, clients and alarms, and the last connection of the clients you mark as worth watching.

Exemplos

  • UniFi OS console (Dream Machine, Cloud Gateway, Cloud Key)
  • UniFi Network Server (self-hosted)

O que precisa

  • API key (UniFi OS console)Reads devices, their load and the client count through the official Integration API. Created in Settings → Control Plane → Integrations.
  • View Only accountA local account with the View Only role. Also reads the WAN, Internet and alarm status, and works on a self-hosted server.

Porta por omissão: 443

Regras de alerta incluídas 8

  • AvisoUniFi device offlineA UniFi device adopted by the controller is offline, isolated or failed to adopt.
  • AlertaUniFi Internet downThe UniFi gateway reports no Internet connection. Without a UniFi gateway the series does not exist and the rule stays silent.
  • AvisoUniFi WAN link downA WAN link of the UniFi gateway is down: with two links, redundancy is lost while nothing seems broken. A disabled port has no series.
  • AvisoUniFi gateway CPU highThe UniFi gateway's processor has been above 90% for fifteen minutes; clears below 80 %.
  • InfoUniFi device waiting for adoptionA device appeared on the network and waits to be adopted in UniFi.
  • InfoUniFi firmware update availableA firmware update is available for UniFi devices.
Mostrar mais 2
  • AvisoUniFi alarmsUniFi logged critical events or raised alarms in the last 24 hours. Only read with a View Only account.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a read-only access in UniFi Network

  1. For an API key on a UniFi OS console: UniFi Network → Settings → Control Plane → Integrations → Create API Key. Name it DumbMonit and copy it: it is shown once.

  2. Or create a local account (needed for WAN and alarm status, and on a self-hosted server): Settings → Admins & Users → Create New, local access only.

    dumbmonit

  3. Set that account's UniFi Network role to View Only.

  4. In DumbMonit, enter the address (unifi.lan, or unifi.lan:8443 for a self-hosted server) and paste the key or the account.

  5. If the network is not the default site, set the Site option to the short name shown after /manage/ or /network/ in the address bar.

Atenção. Use a local account, never the owner or a UI.com cloud account, and accept the console's self-signed certificate in the options unless you installed your own.

Documentação

Cisco Meraki

Betameraki

A Cisco Meraki organization through the Dashboard API: devices offline, Internet uplinks that failed, license out of compliance or expiring, clients per network.

Exemplos

  • Meraki MX / MS / MR
  • Cisco Meraki cloud dashboard

O que precisa

  • API keyThe key of the read-only administrator created for DumbMonit, sent as a bearer token.

Porta por omissão: 443

Regras de alerta incluídas 5

  • AvisoMeraki device offlineA Cisco Meraki device has been offline (out of reach of the cloud dashboard) for ten minutes. Dormant devices, unseen for a long time, are left out.
  • AvisoMeraki uplink failedA Meraki router lost the Internet access of a configured uplink (the wired and cellular sockets without a cable are not counted).
  • AvisoMeraki license problemThe Meraki license is not in compliance (expired, missing or out of compliance): the dashboard may stop managing the devices.
  • AvisoMeraki license expiringA Meraki license expires in less than 30 days.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a read-only API key for DumbMonit

  1. In the Meraki dashboard, open Organization → Settings and tick Enable access to the Cisco Meraki Dashboard API.

  2. Open Organization → Administrators → Add admin and create an administrator dedicated to DumbMonit, with Organization access set to Read-only.

    [email protected]

  3. Sign in as that administrator, open My profile → API access and click Generate new API key. Copy it: the dashboard shows it only once.

  4. In DumbMonit, enter api.meraki.com as the address and paste the key as API key. Leave Organization empty to read the first organization the key sees.

Atenção. A dormant device (not seen for a long time) is counted but never reported as down, and a WAN socket without a cable is not a failed uplink: only an uplink that lost its Internet access is.

Documentação

TP-Link Omada

Betaomada

A TP-Link Omada controller through its OpenAPI: devices disconnected, CPU and memory saturated, firmware updates offered, clients per site.

Exemplos

  • Omada software controller
  • OC200 / OC300 hardware controller
  • EAP access points, TL-SG switches, ER gateways

O que precisa

  • OpenAPI clientThe client created for DumbMonit under Open API, in Client mode with the Viewer role.

Porta por omissão: 8043

Regras de alerta incluídas 5

  • AvisoOmada device offlineAn Omada access point, switch or gateway has been disconnected from the controller for ten minutes.
  • AvisoOmada device CPU highAn Omada device has had its CPU above 90 % for fifteen minutes.
  • AvisoOmada device memory highAn Omada device has had its memory above 90 % for fifteen minutes.
  • InfoOmada firmware updateThe Omada controller offers a firmware update for a device.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a read-only OpenAPI client for DumbMonit

  1. In the Omada controller, open Global View → Settings → Platform Integration → Open API and click Add New App.

  2. Name the app as follows, choose the Client access mode and give it the Viewer role on the sites to read.

    dumbmonit

  3. Click Apply: the controller shows the Omada ID, the Client ID and the Client Secret. Copy them: the secret is shown once.

  4. In DumbMonit, enter the controller address (omada.lan) and the port (8043, or 443 for a hardware controller), then paste the Client ID and the Client secret.

Atenção. The Omada controller ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own. The OpenAPI exists from controller version 5.9.

Documentação

Aruba Central

Betaarubacentral

The Wi-Fi access points, switches and gateways of an HPE Aruba Networking Central account through its cloud API: devices offline, active critical alerts, devices in poor health, and the number of connected clients.

Exemplos

  • Aruba access points
  • Aruba CX switches
  • Aruba gateways

O que precisa

  • API clientRecommended: DumbMonit exchanges the client for an access token and renews it by itself.
  • Access tokenWorks for a test, but expires after two hours and DumbMonit cannot renew it.

Porta por omissão: 443

Regras de alerta incluídas 4

  • AvisoAruba Central device offlineAruba Central reports an access point, switch or gateway offline.
  • AvisoAruba Central critical alertAruba Central has at least one active critical alert.
  • InfoAruba Central devices in poor healthAruba Central rates at least one device in poor health for an hour.
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a personal API client for DumbMonit

  1. Sign in to HPE GreenLake (common.cloud.hpe.com) and open Manage Workspace → Personal API clients.

  2. Click Create personal API client, name it as follows and choose your Central instance as the service.

    dumbmonit

  3. Copy the client ID and the client secret: the secret is shown once, and HPE keeps no copy.

  4. In Central, open the API gateway page (Menu → API Gateway → REST API) and note the base URL of your region.

  5. In DumbMonit, enter that base URL as the address (for example us1.api.central.arubanetworks.com) and paste the client ID and the client secret.

Atenção. Beta: written from HPE's published API reference, not yet tested on a real Central account. It reads the new Central API with Central credentials; credentials scoped to the GreenLake platform and classic Central are not supported.

Documentação

Tailscale

tailscale

The devices of a tailnet through the Tailscale API: servers offline, node keys about to expire, devices awaiting approval, clients to update, and each device's last connection.

Exemplos

  • Tailscale tailnet
  • Subnet routers
  • Exit nodes

O que precisa

  • OAuth clientRecommended: a client limited to the devices:core:read scope, which can change nothing.
  • API access tokenWorks too, but carries every right of the user who created it and expires after 90 days at most.

Porta por omissão: 443

Regras de alerta incluídas 5

  • AvisoTailscale device offlineA Tailscale device that must stay online (a tagged device by default) has been disconnected for more than 15 minutes (dumbmonit_tailscale_device_offline_seconds and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • AvisoTailscale node key expiringA Tailscale device's node key expires in less than 14 days: it will leave the tailnet until someone signs it in again.
  • AvisoTailscale device awaiting approvalA device joined the tailnet and awaits approval: approve it if it is expected, remove it otherwise.
  • InfoTailscale client updateA Tailscale device that must stay online runs a client with an update available (dumbmonit_tailscale_device_update_available and on (target, device) dumbmonit_tailscale_device_watched > 0).
  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Create a read-only OAuth client for DumbMonit

  1. In the Tailscale console (login.tailscale.com), open Settings → Trust credentials → Credential → OAuth.

  2. Tick only the read scope listed below, then click Generate credential.

  3. Copy the client ID and the client secret (tskey-client-...): the secret is shown once.

  4. In DumbMonit, enter api.tailscale.com as address and paste them as Client ID and Client secret; leave the Tailnet option empty.

Atenção. Only tagged devices (servers, subnet routers, exit nodes) are expected to stay online: name the ones to watch in the Devices to keep online option, or enter all.

Documentação

OpenVPN server

openvpn

An OpenVPN server through its management interface: version, whether it reports itself connected, and every client currently in session with its addresses and traffic.

Exemplos

  • OpenVPN Access Server
  • A plain openvpn --server on Linux
  • pfSense or OPNsense OpenVPN (management enabled)

O que precisa

  • Management passwordThe shared password set by the third argument of the server's "management" directive.

Não é preciso nenhuma conta.

Porta por omissão: 7505

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Turn on the management interface

  1. Add this line to the server's configuration (server.conf, or as.conf on OpenVPN Access Server) and restart OpenVPN.

    management 0.0.0.0 7505

  2. Recommended: protect it with a password, put in a file readable by the OpenVPN process alone and added as a third argument.

    management 0.0.0.0 7505 /etc/openvpn/management-password

  3. In DumbMonit, enter the server's address (vpn.lan, port 7505) and the management password if one is set.

Atenção. Anyone who reaches the management port and knows the password can disconnect clients and reconfigure the running server: allow only the DumbMonit host in the firewall and set a password.

Documentação

RADIUS server

radius

Authenticates a test account (Access-Request): catches a server that is up but no longer accepts logins.

Exemplos

  • FreeRADIUS
  • Windows NPS
  • The RADIUS behind a WPA-Enterprise Wi-Fi
  • The RADIUS behind a VPN or a 802.1X switch

O que precisa

  • Shared secret and test accountThe secret defined for this host on the RADIUS server, and an account created for monitoring.

Porta por omissão: 1812

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Monitor a RADIUS server

  1. On the RADIUS server, declare the DumbMonit host as a client, with a shared secret (clients.conf on FreeRADIUS, RADIUS Clients on Windows NPS).

  2. Create a test account without a second factor, and note its name and password.

  3. In DumbMonit, enter the server (UDP port 1812 by default), the shared secret and the test account.

  4. Optional: change the NAS identifier if the server filters requests by it.

Atenção. A wrong shared secret, or a host not declared as a client, usually makes the server stay silent: the check then reports a timeout.

Documentação

Network configuration backup

netconfig

Keep every version of a switch, router or firewall configuration, see what changed line by line, and be told when it changes.

Exemplos

  • Cisco switch or router
  • Juniper router
  • FortiGate or pfSense firewall
  • MikroTik router
  • Aruba switch

O que precisa

  • SSH loginA read-only account is enough on most devices. Stored encrypted, never shown again.
  • API key and secretOPNsense API profile: the key and secret of an API user allowed to download backups.
  • API keyPAN-OS API profile: the API key of a read-only role, sent in the X-PAN-KEY header.

Porta por omissão: 22

Regras de alerta incluídas 1

  • AlertaMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Passos de configuração: Back up a device configuration

  1. Choose the device model in "Device model": it decides the commands sent, and nothing else is ever run on the device.

  2. Create a read-only account on the device that may log in over SSH and show the running configuration.

  3. For OPNsense through its API, create an API key for a user allowed to download backups; for PAN-OS, generate the API key of a read-only role.

  4. The first SSH connection remembers the device's host key: if it ever changes, backups stop and an alert asks you to check it.

Atenção. Configurations hold secrets: they are stored encrypted, shown with their secrets masked, and only an administrator signed in can reveal or download them.

Documentação

Outras famílias