DumbMonit
ИнтеграцииБезопасность и учётные записи
Мониторинг CrowdSec в DumbMonit
The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.
ДокументацияОфициальный сайт: CrowdSec
Описания на английском, как в самом продукте. Подписи на странице — на вашем языке.
Что проверяет DumbMonit
The security engine: active decisions and where they come from, alerts, bouncers that stopped pulling, log lines read and those no parser recognised, and whether the Local API answers.
Типичное применение. Security engine: decisions, alerts, bouncers that stopped pulling, log reading
Примеры
- CrowdSec on a Linux host
- CrowdSec in Docker
- CrowdSec on OPNsense or pfSense
Как подключается
Что понадобится
- Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
- Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.
Учётная запись не нужна.
Сетевые порты, которые нужно открыть
6060/TCPPrometheus metrics (default)8080/TCPOnly with the Local API check option (on by default)
Шаги настройки: Let DumbMonit read CrowdSec's metrics
Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.
sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml sudo systemctl restart crowdsecCheck from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.
curl -s http://crowdsec.lan:6060/metrics | grep cs_infoDumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.
Optional: create a bouncer key and paste it as Bouncer API key below.
sudo cscli bouncers add dumbmonitOr, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.
sudo cscli machines add dumbmonit --password 'a-long-password'In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".
Обратите внимание. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.