Add OPNsense by REST API - #807
Closed
Garfieldttt wants to merge 2 commits into
Closed
Conversation
A second OPNsense template next to OPNsense by HTTP-JSON, derived from it
and considerably wider. It carries its own name and its own uuids, so both
can be linked to the same host and importing one does not touch the other.
Compared with the template it grew out of it adds, measured against a live
OPNsense 26.7 with a restricted monitoring key:
* processor utilisation split into user, system and interrupt, core count
and load per core derived from it
* the packet filter in depth: state and source tracking tables with their
limits, pf counters, table entries against the configured ceiling, and
the loaded ruleset with size, fingerprint, evaluation rate and unmatched
rules
* kernel network memory and mbuf clusters, netisr queue drops per
protocol, IP and TCP protocol error rates
* clock synchronisation with offset, stratum and reachable peers
* service run state, swap per device and temperature per sensor, each
discovered
* inbound errors and link state per interface, and the blocked share of
the firewall log
* a dashboard of eight pages in place of three
Three defects of the original are fixed here rather than carried over. Two
urls used camelCase where the privilege pattern is exact and ACL.php matches
it case sensitively, so a monitoring key got HTTP 403 on the firewall state
and all memory items. IPsec phase 2 asked with a GET although
searchPhase2Action reads its connection from getPost('id'), so it could only
ever return an empty row set; it is an item prototype inside the phase 1
rule now, posting one request per connection. A gateway without a monitor
address had 9999 written into round trip time, loss and deviation, which
landed in history and made the gateway graphs unreadable; the reading is
discarded instead.
The export declares format 7.0 rather than 7.4, so it imports into Zabbix
7.0 and everything above. Every widget type it uses exists in 7.0.
The privileges the monitoring user needs are listed in the README with their
internal ids, measured with a restricted key. Eight of the ten are read
only, and the README says what the other two permit and how to do without
them.
Four areas read from a live OPNsense 26.7 with a restricted monitoring key, none of which needs a privilege beyond the ten the README already lists. Unbound, from `unbound/diagnostics/stats`: query, cache hit, cache miss, prefetch and rate limited rates, average recursion time, the request queue and its overflows, and a calculated cache hit ratio. On most installations the firewall is also the resolver for the network behind it, which made this the widest gap. Certificates, from `trust/cert/search`: every row carries `valid_to` as a Unix timestamp, so an expiring web interface, VPN or ACME certificate is visible before it takes a service down. Discovered per certificate, expired at average and expiring at warning, the second depending on the first. System status, from `core/system/status`: the panel the web interface shows about itself. A firewall with nothing pending answers 2 and "No pending messages". The other codes were not observed, so the trigger fires on anything other than 2 rather than claiming to know them, and the message is carried next to it as text. DHCP leases, from `kea/leases4/search` and `kea/leases6/search`, without a trigger on purpose: a network that addresses everything statically runs at zero leases forever, and the meaningful threshold is the size of the pool, which is a local decision. No JavaScript in any of it. Each master cuts its response down with a native step and the dependent items read the result with plain JSONPath. The trigger `Battey low` inherited from the template this one grew out of is spelled `Battery low`, and trigger names carry no product prefix, following the Zabbix guidelines: the host name is already in front of the trigger. The dashboard gains a ninth page for the resolver, the certificates and the leases. 127 items now, 15 discovery rules with 71 item prototypes, 58 triggers and 41 macros.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OPNsense by REST API
A second OPNsense template next to
OPNsense by HTTP-JSON, derived from it and considerablywider. It carries its own name and its own uuids, so both can be linked to the same host and
importing one does not touch the other.
Everything below was measured against a live OPNsense 26.7 with a restricted monitoring key,
not taken from the documentation.
What it adds over the template it grew out of
table entries against the configured ceiling, and the loaded ruleset with size, fingerprint,
evaluation rate and unmatched rules
protocol error rates
107 items, 14 discovery rules with 70 item prototypes, 52 triggers, 36 macros.
Three defects of the original are fixed here rather than carried over
diagnostics/firewall/pfStatesanddiagnostics/system/systemResourcespf_statesandsystem_resources, exact rather than wildcards, andACL.phpmatches them withpreg_matchwithout theimodifier. An administrator key never notices, a monitoring key gets HTTP 403 on the firewall state items, the state table utilization and all memory itemssearchPhase2Actionreads its connection fromgetPost('id')and the template asked with a plain GET, so phase 2 could only ever return an empty row set. It is an item prototype inside the phase 1 rule now, posting one request per connectionCompatibility
The export declares format 7.0 rather than 7.4, so it imports into Zabbix 7.0 and every
later release. Every widget type it uses (gauge, honeycomb, item, svggraph) exists in 7.0.
Privileges
The README lists the ten privileges the monitoring user needs with their internal ids. Eight
are read only. It also says what the other two permit and how to do without them.
Licensing
Derived from
OPNsense by HTTP-JSONin this repository, MIT, Copyright (c) 2021 Zabbix. Thenotice travels with it, in the template description and in the README.
Maintained at https://github.com/Garfieldttt/opnsense-zabbix-template.