DumbMonit
中文
GitHub 在线演示

监控项

防火墙

OPNsense、pfSense、FortiGate 和 Sophos：网关、隧道、接口、高可用和许可证。

监控项描述和告警规则文本为英文，与产品一致。页面标签使用您的语言。

OPNsense

opnsense

Gateway latency and loss, VPN tunnels, DHCP leases, services and pending updates.

示例

  • OPNsense firewall
  • Home router
  • Multi-WAN edge

您需要准备

  • API key and secretThe two lines of the file OPNsense downloads when the key is created.

默认端口: 443

内置告警规则 12

  • 警告Internet gateway downdpinger no longer gets an answer from a gateway. On a multi-WAN firewall the traffic has already moved to another link, quietly. loss and delay are warnings, not failures, and do not fire this rule.
  • 提示Gateway losing packetsA gateway is losing more than a fifth of the packets sent to it: the link answers, badly. Clears below 10 %.
  • 信息Gateway slowA gateway's round-trip time has stayed above 300 ms. Three hundred milliseconds leaves a mobile backup link alone.
  • 提示Firewall state table filling uppf is tracking more than 80 % of the connections it is allowed. Past the limit the firewall drops new connections with no other symptom.
  • 提示Firewall network buffers exhaustedMore than 90 % of the FreeBSD network buffers are in use. A firewall that runs out stops forwarding with the CPU still idle.
  • 提示VPN tunnel downA configured VPN tunnel has had no session for ten minutes. A plugin that is not installed, or a connection that is disabled, has no series and cannot fire.
再显示 6 条
  • 提示Firewall resolver stoppedUnbound has stopped answering. The firewall still routes; the machines behind it no longer resolve. Turn this rule off if your firewall resolves with something else.
  • 警告Firewall core service stoppeddpinger, which watches the gateways, or configd, which runs everything else, is stopped. Only those two, because a service switched off on purpose is not a failure.
  • 提示Firewall too hotA sensor reads above 85 °C: the fanless box in the cupboard is about to start throttling. Clears at 78 °C.
  • 信息Firewall left in CARP maintenance modeCARP has been left in persistent maintenance mode: this firewall handed its virtual addresses to its partner and will not take them back on its own.
  • 信息Firewall reboot pendingAn update is installed but needs a reboot to take effect.
  • 信息Firewall updates pendingThe firewall has packages waiting to be updated. It is the most exposed machine on the network.
设置步骤: Create a read-only API key in OPNsense

  1. System → Access → Groups → Add: name the group as follows.

    dumbmonit

  2. In that group, under Assigned Privileges, add the privileges listed below.

  3. System → Access → Users → Add: name the user as follows, generate a password, and make it a member of that group.

    dumbmonit

  4. Edit the user, click + under API keys, and save the downloaded file: it holds the key and the secret, shown only once.

  5. In DumbMonit, enter the firewall address (192.168.1.1 or fw.lan:8443), the key as API key and the secret as API secret.

注意. An API key is a password that never expires: restrict the group's source networks to the DumbMonit host and never grant All pages. OPNsense ships a self-signed certificate: tick "Accept an unverifiable certificate" if the connection is refused.

文档

pfSense

pfsense

A pfSense firewall through its REST API package: gateways down or losing packets, interfaces without link, stopped services, CPU, memory and disk.

示例

  • pfSense CE
  • pfSense Plus
  • Netgate appliance

您需要准备

  • REST API keyThe key created for the dumbmonit user: it carries only that user's read privileges.

默认端口: 443

内置告警规则 7

  • 警告pfSense gateway downA pfSense gateway is down: its monitor address no longer answers, and the traffic it carries stops or fails over.
  • 提示pfSense gateway losing packetsA pfSense gateway loses more than 10 % of the probes to its monitor address: the line is degraded (dumbmonit_pfsense_gateway_loss_percent unless on (target, gateway) dumbmonit_pfsense_gateway_up == 0).
  • 提示pfSense gateway slowThe round trip to a pfSense gateway's monitor address has stayed above 500 ms for fifteen minutes.
  • 提示pfSense interface without linkAn enabled pfSense interface has no link: cable, switch port or network card.
  • 提示pfSense service stoppedA pfSense service that is enabled is not running: DNS resolver, VPN, NTP….
  • 提示pfSense disk nearly fullThe pfSense disk is more than 90 % full: logs, reports and package updates stop being written.
再显示 1 条
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create a read-only REST API key for DumbMonit

  1. Install the pfSense-pkg-RESTAPI package (version 2) from Diagnostics → Command Prompt, with the file matching your pfSense version (2.7.2 below).

    pkg-static add https://github.com/pfrest/pfSense-pkg-RESTAPI/releases/latest/download/pfSense-2.7.2-pkg-RESTAPI.pkg

  2. System → REST API → Settings: tick both BasicAuth and Key among the authentication methods.

  3. System → User Manager → Users → Add: create the user dumbmonit with a long random password.

  4. Edit the user and, under Assigned Privileges, add the privileges listed below.

  5. Create the key as dumbmonit, copy the key value of the answer, then remove the POST privilege again.

    curl -k -u dumbmonit -X POST -H 'Content-Type: application/json' -d '{"descr":"DumbMonit"}' https://pfsense.lan/api/v2/auth/key

  6. In DumbMonit, enter the pfSense address (pfsense.lan) and paste the key as API key.

注意. The REST API package is a community project, not part of pfSense: reinstall it after each pfSense upgrade. pfSense ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you replaced it.

文档

FortiGate

fortigate

A Fortinet firewall through the FortiOS REST API: IPsec tunnels down, interfaces without link, HA out of sync, memory near conserve mode, FortiGuard licences expiring.

示例

  • FortiGate 40F / 60F / 100F
  • FortiGate VM
  • FortiOS 7.x

您需要准备

  • API tokenThe token of the dumbmonit REST API user, sent as a bearer token.

默认端口: 443

内置告警规则 9

  • 警告FortiGate IPsec tunnel downNo phase 2 of a FortiGate site-to-site IPsec tunnel is up: the site behind it is cut off.
  • 提示FortiGate interface without linkAn enabled FortiGate interface with an address has no link: cable, transceiver or the device in front.
  • 提示FortiGate HA out of syncThe members of a FortiGate HA cluster no longer have the same configuration checksum: a failover would run another configuration.
  • 警告FortiGate HA member lostA FortiGate HA cluster has fewer members than in the last 24 hours: there is no standby any more (max_over_time(dumbmonit_fortigate_ha_members[1d]) - dumbmonit_fortigate_ha_members).
  • 提示FortiGate memory near conserve modeFortiGate memory has stayed above 85 % for ten minutes: at 88 % (by default) it enters conserve mode and stops inspecting new sessions.
  • 提示FortiGate CPU highFortiGate CPU has stayed above 90 % for fifteen minutes.
再显示 3 条
  • 提示FortiGate licence expiringA FortiGuard or FortiCare licence of the FortiGate expires in less than 30 days, or has expired.
  • 信息FortiGate firmware updateFortiGuard offers a newer patch release of the FortiOS branch the FortiGate runs.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create a read-only REST API user for DumbMonit

  1. System → Admin Profiles → Create New: name the profile as follows and set the access permissions listed below, everything else None.

    dumbmonit-ro

  2. System → Administrators → Create New → REST API Admin: name it as follows and pick that profile.

    dumbmonit

  3. Under Trusted Hosts, enter the DumbMonit server's address with a /32 mask: FortiGate refuses 0.0.0.0/0.

  4. Click OK: FortiGate shows the API token once. Copy it.

  5. In DumbMonit, enter the FortiGate address (fw.lan) and paste the token as API token.

注意. FortiGate ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

文档

Sophos Firewall

sophos

A Sophos Firewall (SFOS) through its XML API: the link of every interface in a zone, and which IPsec connections are activated. Its live tunnel, HA and licence state are not in that API.

示例

  • Sophos XGS
  • Sophos Firewall virtual appliance
  • SFOS 19 to 21

您需要准备

  • User name and passwordThe dumbmonit user, whose device access profile is read-only everywhere.

默认端口: 4444

内置告警规则 2

  • 提示Sophos interface without linkA Sophos Firewall interface that is switched on and bound to a zone has no link.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Allow DumbMonit to read the Sophos Firewall XML API

  1. Profiles → Device access: add a profile named DumbMonit read-only and set every permission to Read-only.

  2. Authentication → Users: add a user named dumbmonit, of type Administrator, with that profile and a long random password.

    dumbmonit

  3. Backup & firmware → API (Administration → API access from SFOS 22): turn on the API configuration and add the DumbMonit server's address to the allowed IP addresses.

  4. In DumbMonit, enter the firewall address (sophos.lan) with that user name and password.

注意. The API listens on the administration port (4444 by default) with a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

文档

Palo Alto PAN-OS

测试版paloalto

A Palo Alto Networks firewall through the PAN-OS XML API: interfaces without link, HA peer lost or out of sync, session table filling up, management CPU and memory, licences expiring, failed commits.

示例

  • PA-400 / PA-1400 series
  • VM-Series
  • PAN-OS 10.x and 11.x

您需要准备

  • User name and passwordThe dumbmonit account: DumbMonit asks the firewall for an API key with it and keeps the key, the password only travels in a request body.
  • API keyA key already generated for the dumbmonit account, sent in the X-PAN-KEY header.

默认端口: 443

内置告警规则 9

  • 提示Palo Alto interface without linkA Palo Alto firewall interface bound to a zone has no link: cable, transceiver or the device in front.
  • 警告Palo Alto HA peer lostThe peer of a Palo Alto HA pair is no longer active or passive, or the HA link to it is down: there is no standby any more.
  • 提示Palo Alto HA out of syncThe running configuration of a Palo Alto HA pair is not synchronized: a failover would run another configuration.
  • 警告Palo Alto HA member not functionalThis Palo Alto firewall reports its HA state as suspended or non-functional.
  • 提示Palo Alto session table filling upThe session table of a Palo Alto firewall has stayed above 90 % of its capacity for ten minutes: new sessions will be refused when it is full.
  • 提示Palo Alto management CPU highThe management plane CPU of a Palo Alto firewall has stayed above 90 % for fifteen minutes.
再显示 3 条
  • 提示Palo Alto licence expiringA licence or subscription of a Palo Alto firewall expires in less than 30 days, or has expired.
  • 信息Palo Alto commit failedThe last configuration commit of a Palo Alto firewall failed: the running configuration is not the one that was saved.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create a read-only XML API account for DumbMonit

  1. Device → Admin Roles → Add: name the role as follows. On the XML API tab enable Operational Requests only; leave every other privilege, and the Web UI and Command Line tabs, disabled.

    dumbmonit-ro

  2. Device → Administrators → Add: name the account as follows, set Authentication to a password, the type to Role Based and the role to the one above.

    dumbmonit

  3. Click Commit: the role and the account exist only once committed.

  4. In DumbMonit, enter the firewall address (pa.lan) with that user name and password, or with an API key you generated for that account.

注意. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

文档

SonicWall SonicOS

测试版sonicwall

A SonicWall firewall through the SonicOS 7 API: the link of every interface bound to a zone. Kept minimal on purpose: only the API paths SonicWall publishes are read.

示例

  • SonicWall TZ / NSa / NSsp
  • SonicWall NSv
  • SonicOS 7.x

您需要准备

  • User name and passwordThe dumbmonit user, in a read-only group, sent as HTTP Basic.

默认端口: 443

内置告警规则 2

  • 提示SonicWall interface without linkA SonicWall interface bound to a zone has no link.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create a read-only user for the SonicOS API

  1. Device → Settings → Administration → Audit/SonicOS API: make sure HTTP Basic Access (RFC-2617) is on, then click Accept.

  2. Device → Users → Local Users & Groups → Add User: name it as follows, give it a long random password and add it to the group SonicWall Read-Only Admins.

    dumbmonit

  3. Allow HTTPS management on the interface DumbMonit reaches the firewall through (Device → Network → Interfaces → Configure → Management).

  4. In DumbMonit, enter the firewall address (sonicwall.lan) with that user name and password.

注意. The management interface ships a self-signed certificate: tick "Accept an unverifiable certificate" unless you installed your own.

文档

其他系列