DumbMonit
RU
GitHub Живое демо

Мониторы

DNS, почта и безопасность

Pi-hole, AdGuard Home, CrowdSec, а также почтовые серверы и шлюзы: SMTP, MDaemon, SecurityGateway и Proxmox Mail Gateway. Проверка чёрных списков для почтового сервера или диапазона IP.

Описания мониторов и тексты правил оповещений на английском, как в самом продукте. Подписи на странице соответствуют вашему языку.

Pi-hole

pihole

The DNS ad blocker: blocking on or paused, queries and share blocked, blocklist age, upstream failures, updates and its own diagnosis messages.

Примеры

  • Pi-hole v6 on a Raspberry Pi
  • Pi-hole in Docker

Что понадобится

  • App password (recommended)Generated under Settings → Web interface / API in expert mode. It cannot change Pi-hole's settings.

Учётная запись не нужна.

Порт по умолчанию: 80

Встроенные правила оповещений 5

  • ПредупреждениеPi-hole blocking disabledBlocking is off, paused or failed. The hold lets a five-minute pause from the web interface go by.
  • ПредупреждениеPi-hole blocklists staleThe blocklists (gravity) have not been rebuilt for more than eight days: the weekly update fails.
  • ИнфоPi-hole update availableA newer version is available: the image in Docker, core, web interface or FTL otherwise. Pi-hole checks once a day.
  • ИнфоPi-hole diagnosis messagesPi-hole lists messages on its diagnosis page: a blocklist that failed to download, a rate-limited client, an overloaded host.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create an app password in Pi-hole

  1. In Pi-hole's web interface, open Settings → Web interface / API and switch the page from Basic to Expert.

  2. Click Configure app password, copy the password shown, then click Enable new app password.

  3. Check that Settings → All settings → Webserver and API → webserver.api.app_sudo is off, its default.

  4. In DumbMonit, enter Pi-hole's address and paste the app password, or pick No password if the web interface has none.

Обратите внимание. Pi-hole v6 or later is required; the app password can still pause blocking and edit lists through the API, so keep it for DumbMonit only.

Документация

AdGuard Home

adguard

The DNS filter: protection on or paused, queries and blocks, filter lists that stopped updating, upstream servers that fail, updates.

Примеры

  • AdGuard Home
  • AdGuard Home on OpenWrt or a NAS

Что понадобится

  • User name / passwordThe dedicated user added to AdGuardHome.yaml, sent as HTTP basic authentication.

Учётная запись не нужна.

Порт по умолчанию: 80

Встроенные правила оповещений 6

  • ПредупреждениеAdGuard Home protection offProtection disabled, or paused and not back yet.
  • ТревогаAdGuard Home DNS not runningThe web interface answers but the DNS server is stopped.
  • ПредупреждениеAdGuard Home upstream failingAn upstream DNS server fails AdGuard Home's own test, or stays silent 4 seconds.
  • ПредупреждениеAdGuard Home filter lists staleThe oldest update of an enabled filter list is more than three days old.
  • ИнфоAdGuard Home update availableA newer version is announced by AdGuard Home's own version check; never fires when that check is disabled, as in the official Docker image.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Add a user for DumbMonit to AdGuard Home

  1. Make a bcrypt hash of a long random password (htpasswd comes with apache2-utils or httpd-tools).

    htpasswd -B -C 10 -n -b dumbmonit 'LONG-RANDOM-PASSWORD'

  2. Stop AdGuard Home, add this line under users: in AdGuardHome.yaml with HASH replaced by the printed hash, then start it again.

    - { name: dumbmonit, password: "HASH" }

  3. In DumbMonit, enter the address of the AdGuard Home web interface, then the user dumbmonit and its password.

Обратите внимание. AdGuard Home has no read-only user, so dumbmonit can change every setting: keep its password to DumbMonit alone, and turn on HTTPS in Settings → Encryption settings across an untrusted network.

Документация

CrowdSec

crowdsec

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

Примеры

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

Что понадобится

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

Учётная запись не нужна.

Порт по умолчанию: 6060

Встроенные правила оповещений 4

  • ТревогаCrowdSec Local API downThe Local API does not answer /health.
  • ПредупреждениеCrowdSec bouncer stopped pullingA bouncer's requests did not change in 30 minutes (changes_prometheus(dumbmonit_crowdsec_bouncer_requests_total[30m])).
  • ПредупреждениеCrowdSec reads no logsNot a single log line read in six hours (increase_prometheus(dumbmonit_crowdsec_lines_read_total[6h])).
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

Обратите внимание. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

Документация

Mail relay (SMTP)

smtp

A mail server greets, offers STARTTLS and accepts a login, like a real client.

Примеры

  • Your provider's SMTP relay
  • A local Postfix or msmtp
  • Proxmox Mail Gateway
  • The submission port of a mail server

Что понадобится

  • Username / passwordSent once the connection is encrypted, never before.

Учётная запись не нужна.

Порт по умолчанию: 587

Встроенные правила оповещений 5

  • ТревогаService downThe service has not responded correctly for three minutes.
  • ПредупреждениеService flappingThe service changed state more than six times in thirty minutes (changes(dumbmonit_probe_success{probe!="push"}[30m])).
  • ПредупреждениеSlow serviceThe service takes more than three seconds to respond; failed checks are left out.
  • ПредупреждениеCertificate expiring soonThe certificate expires in less than fourteen days.
  • ТревогаCertificate expiredThe certificate has expired.
Шаги настройки: Monitor a mail relay

  1. In DumbMonit, enter the mail server, for example smtp.example.com:2525 (the usual port for the encryption by default).

  2. Pick the encryption: STARTTLS for port 587, TLS for port 465, None for a relay on your own network on port 25.

  3. Optional: fill in an account, to check that the relay still accepts it (a refused password is not reported as an outage).

  4. Optional: name an Expected extension, such as STARTTLS, to be warned when the relay stops advertising it.

Обратите внимание. An accepted session does not prove mail leaves: watch the relay's queues for that.

Документация

Mailbox (IMAP)

imap

An IMAP server greets, offers TLS and accepts a login, like a real mail client.

Примеры

  • Dovecot
  • Your provider's IMAP server
  • A mailbox behind Mailcow or Mailu
  • Proxmox Mail Gateway's mail host

Что понадобится

  • Username / passwordSent once the connection is encrypted, never before.

Учётная запись не нужна.

Порт по умолчанию: 993

Встроенные правила оповещений 1

  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Monitor an IMAP server

  1. In DumbMonit, enter the mail server, for example imap.example.com:1993 (port 993 with the default encryption).

  2. Pick the encryption: TLS for port 993, STARTTLS for port 143, None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Обратите внимание. The check never opens a mailbox: a server that logs in but cannot read its storage answers perfectly here.

Документация

Mailbox (POP3)

pop3

A POP3 server greets, offers TLS and accepts a login, like a real mail client.

Примеры

  • Dovecot
  • Your provider's POP3 server
  • An old mail server that only speaks POP3

Что понадобится

  • Username / passwordSent once the connection is encrypted, never before.

Учётная запись не нужна.

Порт по умолчанию: 995

Встроенные правила оповещений 1

  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Monitor a POP3 server

  1. In DumbMonit, enter the mail server, for example pop.example.com:1995 (port 995 with the default encryption).

  2. Pick the encryption: TLS for port 995, STARTTLS for port 110 (STLS command), None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

Обратите внимание. The check never lists or reads messages: it logs in, then says goodbye.

Документация

MDaemon Email Server

Через агентmdaemon

Needs the agent on the Windows server: mail queues, sessions, Windows services and disk space, plus the mail ports answering and, optionally, the XML API.

Примеры

  • MDaemon Email Server

Что понадобится

  • XML API account (optional, version only)Also reads the version through the XML API. Leave the credential empty to watch the mail services only.

Учётная запись не нужна.

Порт по умолчанию: 25

Встроенные правила оповещений 9

  • ТревогаMDaemon mail service downA watched mail service of the MDaemon server does not answer, or greets to refuse service. Only the services listed on the monitor have a series. The notification names the service and its port.
  • ПредупреждениеMDaemon XML API not answeringThe XML API has stopped answering while the mail services still do: Remote Administration is probably stopped. Only a monitor with an account has the series.
  • ПредупреждениеMDaemon mail queue growingThe inbound, local or remote queue has grown by more than a hundred messages in two hours (delta(dumbmonit_mdaemon_queue_messages{queue=~"inbound\|local\|remote"}[2h])): MDaemon has stopped delivering from it. Read by the [agent](../devices/agent.md#windows-performance-counters) on the MDaemon server, so the alert is on the agent's monitor.
  • ПредупреждениеMDaemon Bad queue not emptyMessages are waiting in the Bad queue: MDaemon could neither deliver nor bounce them, and they stay there until an administrator releases or deletes them.
  • ПредупреждениеMDaemon Retry queue highMore than fifty messages wait in the Retry queue: remote servers keep refusing mail temporarily.
  • ТревогаMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
Показать ещё 3
  • ПредупреждениеMail queue stuckThe oldest message of an inbound, local or remote queue has been waiting for more than two hours: the queue is frozen or delivery is blocked. Counted from the queue folders by the agent on the mail server.
  • ПредупреждениеMDaemon queue frozenMDaemon reports one of its queues as frozen: it no longer processes it. Read from the performance counters by the agent on the mail server.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Install the agent on the MDaemon server, then add this monitor

  1. On the Windows server that runs MDaemon, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds MDaemon by itself.

  2. Back here, enter the server address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Leave the credential on Services only: the agent already brings the queues, sessions, Windows services and disk space, and the mail ports are checked from DumbMonit.

  4. Optional, only to read the exact version: open Accounts → Account Manager → New account and create the account below, with a long unique password.

    [email protected]

  5. Allow the address DumbMonit connects from in Setup → XML API Service → Address Restrictions (Setup → XML API Management on MDaemon 26), then enter the account's full email address and its password.

  6. To check more ports than SMTP, IMAP and webmail, set the Services option to a list like this one.

    smtp,msa,imap,pop3,imaps,webmail

Обратите внимание. The queues, sessions and Windows services of MDaemon can only be read on the server itself: without the agent, DumbMonit sees the mail ports and nothing else. The XML API account is optional and only brings the version; MDaemon has no read-only role for it, so never reuse your own account, and use a password found nowhere else, as repeated failures can get DumbMonit blocked.

Документация

SecurityGateway for Email Servers

Через агентsecuritygateway

Needs the agent on the Windows server: Windows services, mail queue folders and disk space, plus the gateway ports answering and the REST API counters (12.5 and later).

Примеры

  • SecurityGateway for Email Servers

Что понадобится

  • API key (12.5 and later, recommended)Also reads the version and the performance counters through the REST API. Leave the credential empty to watch the services only.

Учётная запись не нужна.

Порт по умолчанию: 25

Встроенные правила оповещений 5

  • ТревогаMail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
  • ТревогаSecurityGateway service downA watched service of the gateway does not answer, or greets to refuse service.
  • ПредупреждениеSecurityGateway API not answeringThe REST API has stopped answering while the services still do. Only a monitor with an API key has the series.
  • ПредупреждениеSecurityGateway delivery queue growingThe delivery queue has grown by more than a hundred messages in two hours (delta(dumbmonit_securitygateway_counter{counter=~".*(delivery_queue\|queued_for_delivery).*"}[2h])): the mail server behind the gateway is probably refusing mail. The counter names come from the API as they are; if your version names the queue differently, adjust the matcher.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Install the agent on the gateway server, then add this monitor

  1. On the Windows server that runs SecurityGateway, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds SecurityGateway by itself.

  2. Back here, enter the gateway address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Recommended, for the performance counters: in SecurityGateway 12.5 or later, open Setup/Users → Accounts → Administrators → New and create the account below, with a long unique password.

    dumbmonit

  4. Give the account the role listed below, and restrict it to the DumbMonit address in IP Restriction Options.

  5. Sign in as that account, open Setup/Users → Accounts → API Keys and create a key with an expiry date, then paste the key in DumbMonit.

  6. To check more ports than SMTP and the web interface, set the Services option to a list like this one.

    smtp,web_https

Обратите внимание. The Windows services, mail queue folders and disk space of SecurityGateway can only be read on the server itself: without the agent, DumbMonit sees the gateway ports and, with a key, the REST API counters. SecurityGateway has no read-only role or narrower key: create the key from the dedicated account, never your own, and give it an expiry date.

Документация

Proxmox Mail Gateway

pmg

Mail queues and stuck mail, spam and virus traffic, quarantine, signature age.

Примеры

  • Proxmox Mail Gateway

Что понадобится

  • Username / password (recommended)Opens a two-hour session, renewed automatically. Proxmox Mail Gateway does not issue API tokens: this is its normal way in.
  • API tokenOnly if your gateway offers API tokens: Proxmox Mail Gateway 9 and earlier do not create any. Use the username and password instead.

Порт по умолчанию: 8006

Встроенные правила оповещений 9

  • ПредупреждениеMail queue growingThe deferred mail queue has grown by more than a hundred messages in two hours (delta(dumbmonit_pmg_queue_messages{queue="deferred"}[2h])): the next hop is probably refusing mail. Growth rather than size, because a busy gateway always keeps a few dozen deferred.
  • ТревогаMail stuck in the queueA message has been waiting in a queue for more than four hours. The age is a lower bound — qshape reports brackets — so the rule fires late rather than early. The notification names the queue.
  • ТревогаMail gateway service stoppedA service the gateway needs to accept and filter mail is stopped. A unit that is not installed has no series and cannot fire.
  • ПредупреждениеVirus signatures out of dateThe ClamAV daily virus signatures are more than two days old: freshclam has stopped updating them and the gateway keeps filtering with last week's list.
  • ПредупреждениеSpam rules out of dateThe SpamAssassin rules are more than eight days old. A channel that has never been updated has no date and no series.
  • ПредупреждениеQuarantine filling upThe spam quarantine has taken in more than a thousand messages in six hours (delta(dumbmonit_pmg_quarantine_messages{kind="spam"}[6h])): a campaign, or a rule that just put a legitimate domain in the bin.
Показать ещё 3
  • ПредупреждениеMail gateway cluster degradedA gateway of the cluster is no longer in sync with the others: it filters with an out-of-date rule database. A standalone gateway has no series.
  • ПредупреждениеMail gateway certificate expiringA certificate of the mail gateway expires in less than fourteen days.
  • ИнфоMail gateway updates pendingMore than twenty package updates are pending on the mail gateway.
Шаги настройки: Create a read-only user in Proxmox Mail Gateway

  1. Open Configuration → User Management → Users → Add, enter the user name below, a long password used nowhere else, and tick Enabled.

    dumbmonit@pmg

  2. Set its Role to Audit, then click Add.

  3. In DumbMonit, enter the gateway address (for example mail.lan:8006), then this user name, realm included, and its password.

Обратите внимание. Proxmox Mail Gateway has no API tokens, so DumbMonit signs in with this password. It uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

Документация

mailcow

Бетаmailcow

Stopped containers, Postfix queue size and age, mail volume, mailboxes near their quota.

Примеры

  • mailcow: dockerized

Что понадобится

  • Read-only API keyThe read-only key of System → Configuration → Access → API, sent in the X-API-Key header.

Порт по умолчанию: 443

Встроенные правила оповещений 5

  • Тревогаmailcow container downA mailcow container is not running. The notification names the container.
  • Предупреждениеmailcow mail queue stuckThe oldest message in Postfix's queue has waited more than four hours.
  • Предупреждениеmailcow mail volume almost fullThe volume holding the mailboxes is more than 90 % full; clears below 88 %.
  • Инфоmailcow mailbox near quotaA mailbox is at 90 % of its quota or more.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Create a read-only API key in mailcow

  1. In mailcow, open System → Configuration → Access → API and find the Read-only access section.

  2. Tick Activate API, add DumbMonit's IP address to the allowed addresses and save.

  3. Copy the read-only key, then enter mailcow's address in DumbMonit and paste it.

Обратите внимание. mailcow only answers the addresses allowed on its API page: if DumbMonit reaches it through NAT or a relay agent, allow that address instead.

Документация

Mail server reputation

mail_blacklist

A mail domain's MX, or a mail server's public address, checked against the major DNS blocklists (Spamhaus, Barracuda, SpamCop…) or the ones you pick, with reverse DNS, SPF and DMARC, and the delisting page of every list that lists it. No API key needed.

Примеры

  • Your company's mail domain
  • The public address of a mail server
  • An outgoing relay

Что понадобится

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Учётная запись не нужна.

Встроенные правила оповещений 5

  • ТревогаListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • ПредупреждениеListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • ПредупреждениеMail server reverse DNS mismatchAn address of the mail server has no reverse DNS, or its name does not resolve back to it: Gmail, Outlook.com and Yahoo refuse or junk such mail.
  • ПредупреждениеSPF or DMARC missingThe domain has no SPF record (or several), or no DMARC record: Gmail and Yahoo require both from bulk senders.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Check a mail server against the blocklists

  1. Enter the domain you send mail for ("example.com"), or the public IP address the server sends from.

  2. No API key is needed: leave the credential on No key.

  3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Обратите внимание. A blocklist that does not answer is shown as unknown, never as clean.

Документация

IP range blocklist

ip_blacklist

Every address of a public IPv4 range, up to a /24, checked against the major DNS blocklists, or the ones you pick: how many are listed, on which lists, and the delisting page of each. No API key needed.

Примеры

  • Your office's public addresses
  • The /24 your servers send from
  • A hosting provider's block

Что понадобится

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

Учётная запись не нужна.

Встроенные правила оповещений 3

  • ТревогаListed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • ПредупреждениеListed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • ТревогаMonitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
Шаги настройки: Check a public IP range against the blocklists

  1. Enter an IPv4 address or a CIDR range up to /24, for example "198.51.100.0/24".

  2. No API key is needed: leave the credential on No key.

  3. Tick the address blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

Обратите внимание. Spamhaus PBL lists end-user ranges that should not send mail directly: a listing there only matters for an address that runs a mail server.

Документация

Другие семейства