DumbMonit
中文
GitHub 在线演示

监控项

DNS、邮件与安全

Pi-hole、AdGuard Home、CrowdSec，以及邮件服务器和网关：SMTP、MDaemon、SecurityGateway 和 Proxmox Mail Gateway。邮件服务器或 IP 段的黑名单检查。

监控项描述和告警规则文本为英文，与产品一致。页面标签使用您的语言。

Pi-hole

pihole

The DNS ad blocker: blocking on or paused, queries and share blocked, blocklist age, upstream failures, updates and its own diagnosis messages.

示例

  • Pi-hole v6 on a Raspberry Pi
  • Pi-hole in Docker

您需要准备

  • App password (recommended)Generated under Settings → Web interface / API in expert mode. It cannot change Pi-hole's settings.

无需账户。

默认端口: 80

内置告警规则 5

  • 提示Pi-hole blocking disabledBlocking is off, paused or failed. The hold lets a five-minute pause from the web interface go by.
  • 提示Pi-hole blocklists staleThe blocklists (gravity) have not been rebuilt for more than eight days: the weekly update fails.
  • 信息Pi-hole update availableA newer version is available: the image in Docker, core, web interface or FTL otherwise. Pi-hole checks once a day.
  • 信息Pi-hole diagnosis messagesPi-hole lists messages on its diagnosis page: a blocklist that failed to download, a rate-limited client, an overloaded host.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create an app password in Pi-hole

  1. In Pi-hole's web interface, open Settings → Web interface / API and switch the page from Basic to Expert.

  2. Click Configure app password, copy the password shown, then click Enable new app password.

  3. Check that Settings → All settings → Webserver and API → webserver.api.app_sudo is off, its default.

  4. In DumbMonit, enter Pi-hole's address and paste the app password, or pick No password if the web interface has none.

注意. Pi-hole v6 or later is required; the app password can still pause blocking and edit lists through the API, so keep it for DumbMonit only.

文档

AdGuard Home

adguard

The DNS filter: protection on or paused, queries and blocks, filter lists that stopped updating, upstream servers that fail, updates.

示例

  • AdGuard Home
  • AdGuard Home on OpenWrt or a NAS

您需要准备

  • User name / passwordThe dedicated user added to AdGuardHome.yaml, sent as HTTP basic authentication.

无需账户。

默认端口: 80

内置告警规则 6

  • 提示AdGuard Home protection offProtection disabled, or paused and not back yet.
  • 警告AdGuard Home DNS not runningThe web interface answers but the DNS server is stopped.
  • 提示AdGuard Home upstream failingAn upstream DNS server fails AdGuard Home's own test, or stays silent 4 seconds.
  • 提示AdGuard Home filter lists staleThe oldest update of an enabled filter list is more than three days old.
  • 信息AdGuard Home update availableA newer version is announced by AdGuard Home's own version check; never fires when that check is disabled, as in the official Docker image.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Add a user for DumbMonit to AdGuard Home

  1. Make a bcrypt hash of a long random password (htpasswd comes with apache2-utils or httpd-tools).

    htpasswd -B -C 10 -n -b dumbmonit 'LONG-RANDOM-PASSWORD'

  2. Stop AdGuard Home, add this line under users: in AdGuardHome.yaml with HASH replaced by the printed hash, then start it again.

    - { name: dumbmonit, password: "HASH" }

  3. In DumbMonit, enter the address of the AdGuard Home web interface, then the user dumbmonit and its password.

注意. AdGuard Home has no read-only user, so dumbmonit can change every setting: keep its password to DumbMonit alone, and turn on HTTPS in Settings → Encryption settings across an untrusted network.

文档

CrowdSec

crowdsec

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

示例

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

您需要准备

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

无需账户。

默认端口: 6060

内置告警规则 4

  • 警告CrowdSec Local API downThe Local API does not answer /health.
  • 提示CrowdSec bouncer stopped pullingA bouncer's requests did not change in 30 minutes (changes_prometheus(dumbmonit_crowdsec_bouncer_requests_total[30m])).
  • 提示CrowdSec reads no logsNot a single log line read in six hours (increase_prometheus(dumbmonit_crowdsec_lines_read_total[6h])).
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

注意. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

文档

Mail relay (SMTP)

smtp

A mail server greets, offers STARTTLS and accepts a login, like a real client.

示例

  • Your provider's SMTP relay
  • A local Postfix or msmtp
  • Proxmox Mail Gateway
  • The submission port of a mail server

您需要准备

  • Username / passwordSent once the connection is encrypted, never before.

无需账户。

默认端口: 587

内置告警规则 5

  • 警告Service downThe service has not responded correctly for three minutes.
  • 提示Service flappingThe service changed state more than six times in thirty minutes (changes(dumbmonit_probe_success{probe!="push"}[30m])).
  • 提示Slow serviceThe service takes more than three seconds to respond; failed checks are left out.
  • 提示Certificate expiring soonThe certificate expires in less than fourteen days.
  • 警告Certificate expiredThe certificate has expired.
设置步骤: Monitor a mail relay

  1. In DumbMonit, enter the mail server, for example smtp.example.com:2525 (the usual port for the encryption by default).

  2. Pick the encryption: STARTTLS for port 587, TLS for port 465, None for a relay on your own network on port 25.

  3. Optional: fill in an account, to check that the relay still accepts it (a refused password is not reported as an outage).

  4. Optional: name an Expected extension, such as STARTTLS, to be warned when the relay stops advertising it.

注意. An accepted session does not prove mail leaves: watch the relay's queues for that.

文档

Mailbox (IMAP)

imap

An IMAP server greets, offers TLS and accepts a login, like a real mail client.

示例

  • Dovecot
  • Your provider's IMAP server
  • A mailbox behind Mailcow or Mailu
  • Proxmox Mail Gateway's mail host

您需要准备

  • Username / passwordSent once the connection is encrypted, never before.

无需账户。

默认端口: 993

内置告警规则 1

  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Monitor an IMAP server

  1. In DumbMonit, enter the mail server, for example imap.example.com:1993 (port 993 with the default encryption).

  2. Pick the encryption: TLS for port 993, STARTTLS for port 143, None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

注意. The check never opens a mailbox: a server that logs in but cannot read its storage answers perfectly here.

文档

Mailbox (POP3)

pop3

A POP3 server greets, offers TLS and accepts a login, like a real mail client.

示例

  • Dovecot
  • Your provider's POP3 server
  • An old mail server that only speaks POP3

您需要准备

  • Username / passwordSent once the connection is encrypted, never before.

无需账户。

默认端口: 995

内置告警规则 1

  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Monitor a POP3 server

  1. In DumbMonit, enter the mail server, for example pop.example.com:1995 (port 995 with the default encryption).

  2. Pick the encryption: TLS for port 995, STARTTLS for port 110 (STLS command), None for a server on your own network.

  3. Optional: fill in a mailbox account, to check that the server still accepts logins (a refused password is not reported as an outage).

注意. The check never lists or reads messages: it logs in, then says goodbye.

文档

MDaemon Email Server

通过代理mdaemon

Needs the agent on the Windows server: mail queues, sessions, Windows services and disk space, plus the mail ports answering and, optionally, the XML API.

示例

  • MDaemon Email Server

您需要准备

  • XML API account (optional, version only)Also reads the version through the XML API. Leave the credential empty to watch the mail services only.

无需账户。

默认端口: 25

内置告警规则 9

  • 警告MDaemon mail service downA watched mail service of the MDaemon server does not answer, or greets to refuse service. Only the services listed on the monitor have a series. The notification names the service and its port.
  • 提示MDaemon XML API not answeringThe XML API has stopped answering while the mail services still do: Remote Administration is probably stopped. Only a monitor with an account has the series.
  • 提示MDaemon mail queue growingThe inbound, local or remote queue has grown by more than a hundred messages in two hours (delta(dumbmonit_mdaemon_queue_messages{queue=~"inbound\|local\|remote"}[2h])): MDaemon has stopped delivering from it. Read by the [agent](../devices/agent.md#windows-performance-counters) on the MDaemon server, so the alert is on the agent's monitor.
  • 提示MDaemon Bad queue not emptyMessages are waiting in the Bad queue: MDaemon could neither deliver nor bounce them, and they stay there until an administrator releases or deletes them.
  • 提示MDaemon Retry queue highMore than fifty messages wait in the Retry queue: remote servers keep refusing mail temporarily.
  • 警告Mail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
再显示 3 条
  • 提示Mail queue stuckThe oldest message of an inbound, local or remote queue has been waiting for more than two hours: the queue is frozen or delivery is blocked. Counted from the queue folders by the agent on the mail server.
  • 提示MDaemon queue frozenMDaemon reports one of its queues as frozen: it no longer processes it. Read from the performance counters by the agent on the mail server.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Install the agent on the MDaemon server, then add this monitor

  1. On the Windows server that runs MDaemon, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds MDaemon by itself.

  2. Back here, enter the server address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Leave the credential on Services only: the agent already brings the queues, sessions, Windows services and disk space, and the mail ports are checked from DumbMonit.

  4. Optional, only to read the exact version: open Accounts → Account Manager → New account and create the account below, with a long unique password.

    [email protected]

  5. Allow the address DumbMonit connects from in Setup → XML API Service → Address Restrictions (Setup → XML API Management on MDaemon 26), then enter the account's full email address and its password.

  6. To check more ports than SMTP, IMAP and webmail, set the Services option to a list like this one.

    smtp,msa,imap,pop3,imaps,webmail

注意. The queues, sessions and Windows services of MDaemon can only be read on the server itself: without the agent, DumbMonit sees the mail ports and nothing else. The XML API account is optional and only brings the version; MDaemon has no read-only role for it, so never reuse your own account, and use a password found nowhere else, as repeated failures can get DumbMonit blocked.

文档

SecurityGateway for Email Servers

通过代理securitygateway

Needs the agent on the Windows server: Windows services, mail queue folders and disk space, plus the gateway ports answering and the REST API counters (12.5 and later).

示例

  • SecurityGateway for Email Servers

您需要准备

  • API key (12.5 and later, recommended)Also reads the version and the performance counters through the REST API. Leave the credential empty to watch the services only.

无需账户。

默认端口: 25

内置告警规则 5

  • 警告Mail server Windows service stoppedA Windows service of MDaemon or SecurityGateway that starts automatically is not running. Read by the [agent](../devices/agent.md) on the mail server, so the alert is on the agent's monitor. Services set to manual start or disabled do not alert.
  • 警告SecurityGateway service downA watched service of the gateway does not answer, or greets to refuse service.
  • 提示SecurityGateway API not answeringThe REST API has stopped answering while the services still do. Only a monitor with an API key has the series.
  • 提示SecurityGateway delivery queue growingThe delivery queue has grown by more than a hundred messages in two hours (delta(dumbmonit_securitygateway_counter{counter=~".*(delivery_queue\|queued_for_delivery).*"}[2h])): the mail server behind the gateway is probably refusing mail. The counter names come from the API as they are; if your version names the queue differently, adjust the matcher.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Install the agent on the gateway server, then add this monitor

  1. On the Windows server that runs SecurityGateway, add a Server with agent monitor in DumbMonit and run its PowerShell command in an elevated PowerShell. The agent finds SecurityGateway by itself.

  2. Back here, enter the gateway address and choose that agent in Agent installed on this server. DumbMonit pre-selects the one with the same host name.

  3. Recommended, for the performance counters: in SecurityGateway 12.5 or later, open Setup/Users → Accounts → Administrators → New and create the account below, with a long unique password.

    dumbmonit

  4. Give the account the role listed below, and restrict it to the DumbMonit address in IP Restriction Options.

  5. Sign in as that account, open Setup/Users → Accounts → API Keys and create a key with an expiry date, then paste the key in DumbMonit.

  6. To check more ports than SMTP and the web interface, set the Services option to a list like this one.

    smtp,web_https

注意. The Windows services, mail queue folders and disk space of SecurityGateway can only be read on the server itself: without the agent, DumbMonit sees the gateway ports and, with a key, the REST API counters. SecurityGateway has no read-only role or narrower key: create the key from the dedicated account, never your own, and give it an expiry date.

文档

Proxmox Mail Gateway

pmg

Mail queues and stuck mail, spam and virus traffic, quarantine, signature age.

示例

  • Proxmox Mail Gateway

您需要准备

  • Username / password (recommended)Opens a two-hour session, renewed automatically. Proxmox Mail Gateway does not issue API tokens: this is its normal way in.
  • API tokenOnly if your gateway offers API tokens: Proxmox Mail Gateway 9 and earlier do not create any. Use the username and password instead.

默认端口: 8006

内置告警规则 9

  • 提示Mail queue growingThe deferred mail queue has grown by more than a hundred messages in two hours (delta(dumbmonit_pmg_queue_messages{queue="deferred"}[2h])): the next hop is probably refusing mail. Growth rather than size, because a busy gateway always keeps a few dozen deferred.
  • 警告Mail stuck in the queueA message has been waiting in a queue for more than four hours. The age is a lower bound — qshape reports brackets — so the rule fires late rather than early. The notification names the queue.
  • 警告Mail gateway service stoppedA service the gateway needs to accept and filter mail is stopped. A unit that is not installed has no series and cannot fire.
  • 提示Virus signatures out of dateThe ClamAV daily virus signatures are more than two days old: freshclam has stopped updating them and the gateway keeps filtering with last week's list.
  • 提示Spam rules out of dateThe SpamAssassin rules are more than eight days old. A channel that has never been updated has no date and no series.
  • 提示Quarantine filling upThe spam quarantine has taken in more than a thousand messages in six hours (delta(dumbmonit_pmg_quarantine_messages{kind="spam"}[6h])): a campaign, or a rule that just put a legitimate domain in the bin.
再显示 3 条
  • 提示Mail gateway cluster degradedA gateway of the cluster is no longer in sync with the others: it filters with an out-of-date rule database. A standalone gateway has no series.
  • 提示Mail gateway certificate expiringA certificate of the mail gateway expires in less than fourteen days.
  • 信息Mail gateway updates pendingMore than twenty package updates are pending on the mail gateway.
设置步骤: Create a read-only user in Proxmox Mail Gateway

  1. Open Configuration → User Management → Users → Add, enter the user name below, a long password used nowhere else, and tick Enabled.

    dumbmonit@pmg

  2. Set its Role to Audit, then click Add.

  3. In DumbMonit, enter the gateway address (for example mail.lan:8006), then this user name, realm included, and its password.

注意. Proxmox Mail Gateway has no API tokens, so DumbMonit signs in with this password. It uses a self-signed certificate by default: tick "Accept an unverifiable certificate" in the options if the connection is refused.

文档

mailcow

测试版mailcow

Stopped containers, Postfix queue size and age, mail volume, mailboxes near their quota.

示例

  • mailcow: dockerized

您需要准备

  • Read-only API keyThe read-only key of System → Configuration → Access → API, sent in the X-API-Key header.

默认端口: 443

内置告警规则 5

  • 警告mailcow container downA mailcow container is not running. The notification names the container.
  • 提示mailcow mail queue stuckThe oldest message in Postfix's queue has waited more than four hours.
  • 提示mailcow mail volume almost fullThe volume holding the mailboxes is more than 90 % full; clears below 88 %.
  • 信息mailcow mailbox near quotaA mailbox is at 90 % of its quota or more.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Create a read-only API key in mailcow

  1. In mailcow, open System → Configuration → Access → API and find the Read-only access section.

  2. Tick Activate API, add DumbMonit's IP address to the allowed addresses and save.

  3. Copy the read-only key, then enter mailcow's address in DumbMonit and paste it.

注意. mailcow only answers the addresses allowed on its API page: if DumbMonit reaches it through NAT or a relay agent, allow that address instead.

文档

Mail server reputation

mail_blacklist

A mail domain's MX, or a mail server's public address, checked against the major DNS blocklists (Spamhaus, Barracuda, SpamCop…) or the ones you pick, with reverse DNS, SPF and DMARC, and the delisting page of every list that lists it. No API key needed.

示例

  • Your company's mail domain
  • The public address of a mail server
  • An outgoing relay

您需要准备

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

无需账户。

内置告警规则 5

  • 警告Listed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • 提示Listed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • 提示Mail server reverse DNS mismatchAn address of the mail server has no reverse DNS, or its name does not resolve back to it: Gmail, Outlook.com and Yahoo refuse or junk such mail.
  • 提示SPF or DMARC missingThe domain has no SPF record (or several), or no DMARC record: Gmail and Yahoo require both from bulk senders.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Check a mail server against the blocklists

  1. Enter the domain you send mail for ("example.com"), or the public IP address the server sends from.

  2. No API key is needed: leave the credential on No key.

  3. Tick the blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

注意. A blocklist that does not answer is shown as unknown, never as clean.

文档

IP range blocklist

ip_blacklist

Every address of a public IPv4 range, up to a /24, checked against the major DNS blocklists, or the ones you pick: how many are listed, on which lists, and the delisting page of each. No API key needed.

示例

  • Your office's public addresses
  • The /24 your servers send from
  • A hosting provider's block

您需要准备

  • Spamhaus DQS key (optional)Only useful if Spamhaus refuses your resolver. A free Spamhaus Data Query Service key (low, non-commercial volumes) makes Spamhaus answer through any resolver, public ones included. It changes nothing for the other lists.

无需账户。

内置告警规则 3

  • 警告Listed on a major blocklistAn address or the domain is on Spamhaus (ZEN or DBL), Barracuda or SpamCop: a large share of its mail is refused.
  • 提示Listed on a blocklistAn address or the domain is on a smaller list: Mailspike, UCEPROTECT, PSBL, SpamRATS, SURBL or URIBL.
  • 警告Monitor unreachableNo measurement received for more than three minutes. bottomk by (target) (1, time() - tlast_over_time(dumbmonit_up[7d]))
设置步骤: Check a public IP range against the blocklists

  1. Enter an IPv4 address or a CIDR range up to /24, for example "198.51.100.0/24".

  2. No API key is needed: leave the credential on No key.

  3. Tick the address blocklists to query under Blocklists, and add any other DNSBL zone under Custom lists.

  4. If the monitor shows "Spamhaus refuses this resolver", set "Resolver" to your own recursive resolver, or choose the free Spamhaus DQS key as the credential.

    https://www.spamhaus.com/data-access/free-data-query-service/

注意. Spamhaus PBL lists end-user ranges that should not send mail directly: a listing there only matters for an address that runs a mail server.

文档

其他系列