DumbMonit
DE
GitHub Installieren

IntegrationenSicherheit und Identität

CrowdSec überwachen mit DumbMonit

The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.

DokumentationOffizielle Website: CrowdSec

Die Produktbeschreibungen sind englisch, wie im Produkt. Die Beschriftungen der Seite folgen Ihrer Sprache.

Was DumbMonit überwacht

The security engine: active decisions and where they come from, alerts, bouncers that stopped pulling, log lines read and those no parser recognised, and whether the Local API answers.

Typischer Einsatz. Security engine: decisions, alerts, bouncers that stopped pulling, log reading

Beispiele

  • CrowdSec on a Linux host
  • CrowdSec in Docker
  • CrowdSec on OPNsense or pfSense

Wie die Verbindung läuft

Was Sie brauchen

  • Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
  • Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.

Kein Konto nötig.

Zu öffnende Netzwerk-Ports

  • 6060/TCPPrometheus metrics (default)
  • 8080/TCPOnly with the Local API check option (on by default)
Einrichtungsschritte: Let DumbMonit read CrowdSec's metrics

  1. Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.

    sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml
sudo systemctl restart crowdsec

  2. Check from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.

    curl -s http://crowdsec.lan:6060/metrics | grep cs_info

  3. DumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.

  4. Optional: create a bouncer key and paste it as Bouncer API key below.

    sudo cscli bouncers add dumbmonit

  5. Or, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.

    sudo cscli machines add dumbmonit --password 'a-long-password'

  6. In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".

Hinweis. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.

Auch in Sicherheit und Identität