DumbMonit
IntegracionesSeguridad e identidad
Monitorizar CrowdSec con DumbMonit
The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.
DocumentaciónSitio web oficial: CrowdSec
Las descripciones están en inglés, como en el producto. Las etiquetas de la página siguen su idioma.
Qué vigila DumbMonit
The security engine: active decisions and where they come from, alerts, bouncers that stopped pulling, log lines read and those no parser recognised, and whether the Local API answers.
Uso habitual. Security engine: decisions, alerts, bouncers that stopped pulling, log reading
Ejemplos
- CrowdSec on a Linux host
- CrowdSec in Docker
- CrowdSec on OPNsense or pfSense
Cómo se conecta
Qué necesita
- Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
- Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.
No hace falta ninguna cuenta.
Puertos de red que abrir
6060/TCPPrometheus metrics (default)8080/TCPOnly with the Local API check option (on by default)
Pasos de configuración: Let DumbMonit read CrowdSec's metrics
Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.
sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml sudo systemctl restart crowdsecCheck from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.
curl -s http://crowdsec.lan:6060/metrics | grep cs_infoDumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.
Optional: create a bouncer key and paste it as Bouncer API key below.
sudo cscli bouncers add dumbmonitOr, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.
sudo cscli machines add dumbmonit --password 'a-long-password'In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".
Ojo. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.