DumbMonit
IntegraçõesSegurança e identidade
Monitorar CrowdSec com o DumbMonit
The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.
DocumentaçãoSite oficial: CrowdSec
As descrições estão em inglês, como no produto. Os rótulos da página seguem o seu idioma.
O que o DumbMonit vigia
The security engine: active decisions and where they come from, alerts, bouncers that stopped pulling, log lines read and those no parser recognised, and whether the Local API answers.
Uso típico. Security engine: decisions, alerts, bouncers that stopped pulling, log reading
Exemplos
- CrowdSec on a Linux host
- CrowdSec in Docker
- CrowdSec on OPNsense or pfSense
Como se conecta
O que você precisa
- Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
- Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.
Não é preciso nenhuma conta.
Portas de rede a abrir
6060/TCPPrometheus metrics (default)8080/TCPOnly with the Local API check option (on by default)
Etapas de configuração: Let DumbMonit read CrowdSec's metrics
Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.
sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml sudo systemctl restart crowdsecCheck from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.
curl -s http://crowdsec.lan:6060/metrics | grep cs_infoDumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.
Optional: create a bouncer key and paste it as Bouncer API key below.
sudo cscli bouncers add dumbmonitOr, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.
sudo cscli machines add dumbmonit --password 'a-long-password'In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".
Atenção. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.