DumbMonit
用 DumbMonit 监控 CrowdSec
The security engine: active decisions, alerts, bouncers that stopped pulling, log lines read and not parsed, Local API health.
产品说明为英文，与产品内一致。页面标签使用您的语言。
DumbMonit 监控的内容
The security engine: active decisions and where they come from, alerts, bouncers that stopped pulling, log lines read and those no parser recognised, and whether the Local API answers.
典型用途. Security engine: decisions, alerts, bouncers that stopped pulling, log reading
示例
- CrowdSec on a Linux host
- CrowdSec in Docker
- CrowdSec on OPNsense or pfSense
连接方式
您需要准备
- Bouncer API keyAlso proves the Local API answers decision queries. A bouncer key can only read decisions.
- Machine loginAlso reads the alerts of the last 24 hours, counted by country for the threat map. Addresses are never kept.
无需账户。
需要开放的网络端口
6060/TCPPrometheus metrics (default)8080/TCPOnly with the Local API check option (on by default)
设置步骤: Let DumbMonit read CrowdSec's metrics
Make the metrics reachable: set listen_addr in the prometheus section of /etc/crowdsec/config.yaml to an address DumbMonit can reach, then restart CrowdSec.
sudo sed -i 's/listen_addr: 127.0.0.1/listen_addr: 0.0.0.0/' /etc/crowdsec/config.yaml sudo systemctl restart crowdsecCheck from the DumbMonit host that the metrics answer on port 6060, and filter that port so only the DumbMonit host reaches it.
curl -s http://crowdsec.lan:6060/metrics | grep cs_infoDumbMonit also checks the Local API on port 8080 of the same host: untick Check the Local API for a host that only runs an agent.
Optional: create a bouncer key and paste it as Bouncer API key below.
sudo cscli bouncers add dumbmonitOr, for the threat map of the Security page: create a machine login and choose Machine login below. Only the country of each alert is kept.
sudo cscli machines add dumbmonit --password 'a-long-password'In DumbMonit, enter the CrowdSec host, for example "crowdsec.lan".
注意. A bouncer that stops pulling keeps enforcing a frozen list: DumbMonit warns when a bouncer's requests stop for 30 minutes.