From 99b054e243c9ed5ee86ef2aa2cc97a7e72fbac79 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sat, 11 Jul 2020 14:32:20 +0200 Subject: [PATCH 01/19] Removed preprocessing on Gateways, added default for numeric values in openvpn_server_uservalue --- pfsense_zbx.php | 31 +++- template_pfsense_active.xml | 29 +-- template_pfsense_active_ovpn_user.xml | 250 +++++++++++++------------- 3 files changed, 158 insertions(+), 152 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index afdc73c..82b3dcd 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -191,7 +191,7 @@ function pfz_openvpn_server_userdiscovery(){ } // Get OpenVPN User Connected Value -function pfz_openvpn_server_uservalue($unique_id, $valuekey){ +function pfz_openvpn_server_uservalue($unique_id, $valuekey, $default=""){ $atpos=strpos($unique_id,'+'); $server_id = substr($unique_id,0,$atpos); @@ -202,12 +202,12 @@ function pfz_openvpn_server_uservalue($unique_id, $valuekey){ if($server['vpnid']==$server_id) { foreach($server['conns'] as $conn) { if ($conn['common_name']==$user_id){ - $value = $conn[$valuekey]; + $value = $conn[$valuekey]; } } } } - + if ($value=="") $value = $default; echo $value; } // OpenVPN Client Discovery @@ -230,7 +230,7 @@ function pfz_openvpn_clientdiscovery() { } -function pfz_openvpn_clientvalue($client_id, $valuekey){ +function pfz_openvpn_clientvalue($client_id, $valuekey, $default="none"){ $clients = openvpn_get_active_clients(); foreach($clients as $client) { if($client['vpnid']==$client_id) @@ -245,7 +245,7 @@ function pfz_openvpn_clientvalue($client_id, $valuekey){ } - if ($value=="") $value="none"; + if ($value=="") $value=$default; echo $value; } @@ -370,8 +370,12 @@ function pfz_gw_discovery() { function pfz_gw_value($gw, $valuekey) { $gws = return_gateways_status(true); - if(array_key_exists($gw,$gws)) - echo $gws[$gw][$valuekey]; + if(array_key_exists($gw,$gws)) { + $value = $gws[$gw][$valuekey]; + if ($valuekey=="status") + $value = pfz_valuemap("gateway.status", $value); + echo $value; + } } @@ -469,6 +473,16 @@ function pfz_valuemap($valuename, $value){ "server_tls" => "3", "server_user" => "4", "server_tls_user" => "5"); + break; + + case "gateway.status": + $valuemap = array( + "none" => "0", + "loss" => "1", + "highdelay" => "2", + "highloss" => "3", + "force_down" => "4", + "down" => "5"); break; } @@ -519,6 +533,9 @@ switch (strtolower($argv[1])){ case "openvpn_server_uservalue": pfz_openvpn_server_uservalue($argv[2],$argv[3]); break; + case "openvpn_server_uservalue_numeric": + pfz_openvpn_server_uservalue($argv[2],$argv[3],"0"); + break; case "openvpn_clientvalue": pfz_openvpn_clientvalue($argv[2],$argv[3]); break; diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index 6fa7822..0be60a2 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,10 +1,10 @@ 4.0 - 2020-04-28T07:21:17Z + 2020-07-11T12:27:03Z - Templates + Templates/Network Devices @@ -17,7 +17,7 @@ Version 1.0.1 https://github.com/rbicelli/pfsense-zabbix-template - Templates + Templates/Network Devices @@ -3240,18 +3240,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfSense Gateway Status - - - 5 - (.*) -\1:none=0:loss=1:highdelay=2:highloss=3:force_down=4:down=5 - - - 5 - (none|loss|highdelay|highloss|force_down|down)(?=.*:\1=(\d)) -\2 - - + 3s @@ -3425,8 +3414,8 @@ https://github.com/rbicelli/pfsense-zabbix-template Gateway {#GATEWAY} Availability - 640 - 480 + 900 + 200 0.0000 100.0000 1 @@ -3469,8 +3458,8 @@ https://github.com/rbicelli/pfsense-zabbix-template Gateway {#GATEWAY} Status - 640 - 480 + 900 + 200 0.0000 5.0000 1 @@ -5180,7 +5169,7 @@ or {Template pfSense Active:pfsense.value[system,new_version_available].last()}=1 0 - New verson of pfSense Available on {HOST.NAME} + New Version of pfSense Available on {HOST.NAME} 0 diff --git a/template_pfsense_active_ovpn_user.xml b/template_pfsense_active_ovpn_user.xml index ffe4052..81ace63 100644 --- a/template_pfsense_active_ovpn_user.xml +++ b/template_pfsense_active_ovpn_user.xml @@ -1,10 +1,10 @@ 4.0 - 2020-04-28T07:22:36Z + 2020-07-11T12:27:51Z - Templates + Templates/Network devices @@ -20,7 +20,7 @@ Version 1.0.1 https://github.com/rbicelli/pfsense-zabbix-template - Templates + Templates/Network devices @@ -182,66 +182,6 @@ https://github.com/rbicelli/pfsense-zabbix-template - - OpenVPN Server {#SERVERNAME}, Client {#USERID}: Client ID - 7 - - - pfsense.value[openvpn_server_uservalue,{#UNIQUEID},client_id] - 120s - 0 - 0 - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - Client ID - 0 - - - OpenVPN Server Clients - - - - - - - 3s - - - - 200 - 1 - 0 - - - 0 - 0 - 0 - 0 - - - - 0 - 0 - - - OpenVPN Server {#SERVERNAME}, Client {#USERID}: Connection Time 7 @@ -302,66 +242,6 @@ https://github.com/rbicelli/pfsense-zabbix-template - - OpenVPN Server {#SERVERNAME}, Client {#USERID}: Peer ID - 7 - - - pfsense.value[openvpn_server_uservalue,{#UNIQUEID},peer_id] - 60s - 0 - 0 - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - Peer ID - 0 - - - OpenVPN Server Clients - - - - - - - 3s - - - - 200 - 1 - 0 - - - 0 - 0 - 0 - 0 - - - - 0 - 0 - - - OpenVPN Server {#SERVERNAME}, Client {#USERID}: Remote Host 7 @@ -488,7 +368,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},virtual_addr6] - 180s + 60s 90d 0 0 @@ -548,7 +428,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},virtual_addr] - 30s + 60s 180d 0 0 @@ -602,6 +482,126 @@ https://github.com/rbicelli/pfsense-zabbix-template + + OpenVPN Server {#SERVERNAME}, Client {#USERID}: Client ID + 7 + + + pfsense.value[openvpn_server_uservalue_numeric,{#UNIQUEID},client_id] + 120s + 0 + 0 + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + Client ID + 0 + + + OpenVPN Server Clients + + + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + + + + OpenVPN Server {#SERVERNAME}, Client {#USERID}: Peer ID + 7 + + + pfsense.value[openvpn_server_uservalue_numeric,{#UNIQUEID},peer_id] + 60s + 0 + 0 + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + Peer ID + 0 + + + OpenVPN Server Clients + + + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + + From e6569ecf9738168db3fe78e8c556b2a2c777a41a Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sat, 11 Jul 2020 18:26:35 +0200 Subject: [PATCH 02/19] Setting up correct trend for OpenVPN clients --- README.md | 4 +- template_pfsense_active.xml | 6201 +++-------------------------------- 2 files changed, 402 insertions(+), 5803 deletions(-) diff --git a/README.md b/README.md index 1c7d2ab..d76ab86 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ This is a pfSense active template for Zabbix, based on Standard Agent and a php script using pfSense functions library for monitoring specific data. -Tested with pfSense 2.4.x and Zabbix 4.0 +Tested with pfSense 2.4.x, Zabbix 4.0, Zabbix 5.0 ## What it does @@ -22,7 +22,7 @@ Tested with pfSense 2.4.x and Zabbix 4.0 **Template pfSense Active: OpenVPN Server User Auth** - Discovery of OpenVPN Clients connected to OpenVPN Servers in user auth mode - - Monitoring of Client Parameters (Bytes sent/received, Connection Time...) + - Monitoring of Client Parameters (Bytes sent/received, Connection Time...) ## Configuration diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index 0be60a2..f38be9a 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,3050 +1,41 @@ 4.0 - 2020-07-11T12:27:03Z + 2020-07-11T16:22:40Z - Templates/Network Devices + Templates/Network devices - - - {Template pfSense Active:vfs.file.cksum[/etc/passwd].diff(0)}>0 - 0 - - /etc/passwd has been changed on {HOST.NAME} - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:pfsense.value[carp_status].last()}>2 - 0 - - CARP Problems on {HOST.NAME} - 0 - - - 0 - 4 - CARP Problems - 0 - 0 - - - - - {Template pfSense Active:pfsense.expected_carp_status.last()}<>0 and {Template pfSense Active:pfsense.value[carp_status].last()}<>{$EXPECTED_CARP_STATUS} - 0 - - CARP Status not Expected on {HOST.NAME} - 0 - - - 0 - 4 - pfSense CARP is not in the state Expected. This means that a failover could be in process. - 0 - 0 - - - - - {Template pfSense Active:kernel.maxfiles.last(0)}<1024 - 0 - - Configured max number of opened files is too low on {HOST.NAME} - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template pfSense Active:kernel.maxproc.last(0)}<256 - 0 - - Configured max number of processes is too low on {HOST.NAME} - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template pfSense Active:system.uname.diff(0)}>0 - 0 - - Host information was changed on {HOST.NAME} - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template pfSense Active:system.hostname.diff(0)}>0 - 0 - - Hostname was changed on {HOST.NAME} - 0 - - - 0 - 1 - - 0 - 0 - - - - - {Template pfSense Active:vm.memory.size[available].last(0)}<20M - 0 - - Lack of available memory on server {HOST.NAME} - 0 - - - 0 - 3 - - 0 - 0 - - - - - {Template pfSense Active:system.swap.size[,pfree].last(0)}<50 - 0 - - Lack of free swap space on {HOST.NAME} - 0 - - - 0 - 2 - It probably means that the systems requires more physical memory. - 0 - 0 - - - - - {Template pfSense Active:pfsense.mbuf.ptotal.last()}>80 - 0 - - MBUF used at 80% - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:pfsense.mbuf.ptotal.last()}>90 - 0 - - MBUF used at 90% - 0 - - - 0 - 4 - - 0 - 0 - - - - - ({Template pfSense Active:pfsense.value[system,version].last()}<>{Template pfSense Active:pfsense.value[system,installed_version].last()})=1 - 0 - - New Version Available on {HOST.NAME} - 0 - - - 0 - 1 - Noify of new version of pfsense available - 0 - 0 - - - - - {Template pfSense Active:pfsense.value[system,new_version_available].last()}=1 - 0 - - New Version of pfSense Available on {HOST.NAME} - 0 - - - 0 - 1 - A new version of pfSense is available for update. - 0 - 1 - - - - - {Template pfSense Active:pfsense.value[gw_status].diff()}>0 - 1 - {Template pfSense Active:pfsense.value[gw_status].diff()}=0 - pfSense Gateway Status Changed on {HOST.NAME} - 0 - - - 0 - 3 - Gateway Status Change, for use with an acion Script (e.g. update DNS record) - 0 - 1 - - - - - {Template pfSense Active:system.cpu.load[percpu,avg1].avg(5m)}>5 - 0 - - Processor load is too high on {HOST.NAME} - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:pfsense.states.pused.last()}>80 - 0 - - State Table used at 80% - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:pfsense.states.pused.last()}>90 - 0 - - State Table used at 90% - 0 - - - 0 - 4 - - 0 - 0 - - - - - {Template pfSense Active:proc.num[].avg(5m)}>300 - 0 - - Too many processes on {HOST.NAME} - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:proc.num[,,run].avg(5m)}>30 - 0 - - Too many processes running on {HOST.NAME} - 0 - - - 0 - 2 - - 0 - 0 - - - - - {Template pfSense Active:system.uptime.change(0)}<0 - 0 - - {HOST.NAME} has just been restarted - 0 - - - 0 - 1 - - 0 - 0 - - - - - - - Active Connections - 900 - 200 - 0.0000 - 100.0000 - 1 - 0 - 0 - 1 - 0 - 0.0000 - 0.0000 - 1 - 2 - 0 - - Template pfSense Active - pfsense.states.max - - - - 0 - 5 - FF2C27 - 0 - 2 - 0 - - Template pfSense Active - pfsense.states.current - - - - - - Active Connections (pie) - 600 - 340 - 0.0000 - 0.0000 - 0 - 0 - 2 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 0 - 5B5B5B - 0 - 2 - 2 - - Template pfSense Active - pfsense.states.max - - - - 1 - 5 - FF2C27 - 0 - 2 - 0 - - Template pfSense Active - pfsense.states.current - - - - - - CPU jumps - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 0 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 5 - 009900 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.switches - - - - 1 - 5 - 000099 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.intr - - - - - - CPU load - 900 - 200 - 0.0000 - 100.0000 - 1 - 1 - 1 - 1 - 0 - 0.0000 - 0.0000 - 1 - 0 - 0 - 0 - - - 0 - 0 - FFA619 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.load[percpu,avg1] - - - - 1 - 0 - E86E30 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.load[percpu,avg5] - - - - 2 - 0 - FF2F26 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.load[percpu,avg15] - - - - - - CPU utilization (Line) - 900 - 200 - 0.0000 - 100.0000 - 1 - 0 - 0 - 1 - 0 - 0.0000 - 0.0000 - 1 - 1 - 0 - 0 - - - 0 - 5 - FFE819 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.util[,interrupt] - - - - 1 - 5 - E85D17 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.util[,nice] - - - - 2 - 5 - DF26FF - 0 - 2 - 0 - - Template pfSense Active - system.cpu.util[,system] - - - - 3 - 5 - 1775E8 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.util[,user] - - - - 4 - 0 - 03D933 - 0 - 2 - 0 - - Template pfSense Active - system.cpu.util[,idle] - - - - - - Memory Available details (pie) - 600 - 340 - 0.0000 - 0.0000 - 0 - 0 - 2 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 0 - 003300 - 0 - 2 - 2 - - Template pfSense Active - vm.memory.size[available] - - - - 1 - 0 - 005500 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[free] - - - - 2 - 0 - 007700 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[cached] - - - - 3 - 0 - 009900 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[inactive] - - - - - - Memory usage - 900 - 200 - 0.0000 - 100.0000 - 1 - 0 - 1 - 1 - 0 - 0.0000 - 0.0000 - 1 - 2 - 0 - - Template pfSense Active - vm.memory.size[total] - - - - 0 - 0 - 00EE00 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[wired] - - - - 1 - 0 - 00CC00 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[active] - - - - 2 - 0 - 007700 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[inactive] - - - - 3 - 0 - 005500 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[cached] - - - - 4 - 0 - 003300 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[free] - - - - - - Memory Usage simple (pie) - 600 - 340 - 0.0000 - 0.0000 - 0 - 0 - 2 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 0 - 003300 - 0 - 2 - 0 - - Template pfSense Active - vm.memory.size[available] - - - - 1 - 0 - 00DD00 - 0 - 2 - 0 - - Template pfSense Active - kt.mem.used - - - - - - Network Memory Buffer - 900 - 200 - 0.0000 - 100.0000 - 1 - 0 - 1 - 1 - 0 - 0.0000 - 0.0000 - 1 - 2 - 0 - - Template pfSense Active - pfsense.mbuf.max - - - - 0 - 0 - B26E16 - 0 - 2 - 0 - - Template pfSense Active - pfsense.mbuf.current - - - - 1 - 0 - FFCE8E - 0 - 2 - 0 - - Template pfSense Active - pfsense.mbuf.cache - - - - - - Network Memory Buffer (pie) - 600 - 340 - 0.0000 - 0.0000 - 0 - 0 - 2 - 1 - 0 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 0 - 5B5B5B - 0 - 2 - 2 - - Template pfSense Active - pfsense.mbuf.max - - - - 1 - 0 - FFCE8E - 0 - 2 - 0 - - Template pfSense Active - pfsense.mbuf.cache - - - - 2 - 0 - B26E16 - 0 - 2 - 0 - - Template pfSense Active - pfsense.mbuf.current - - - - - - Swap usage - 600 - 340 - 0.0000 - 0.0000 - 0 - 0 - 2 - 1 - 1 - 0.0000 - 0.0000 - 0 - 0 - 0 - 0 - - - 0 - 0 - 5B5B5B - 0 - 2 - 2 - - Template pfSense Active - system.swap.size[,total] - - - - 1 - 0 - FFFF33 - 0 - 2 - 0 - - Template pfSense Active - system.swap.size[,used] - - - - - - - - Generic YesNo - - - 0 - No - - - 1 - Yes - - - - - pfSense CARP Status - - - 0 - Disabled - - - 1 - Master - - - 2 - Backup - - - 3 - Inconsistent - - - 4 - Problem - - - - - pfSense Gateway Status - - - 0 - Up - - - 1 - Packet Loss - - - 2 - High Delay - - - 3 - High Packet Loss - - - 4 - Forced Down - - - 5 - Down - - - - - pfSense OpenVPN Interface Status - - - 0 - Down - - - 1 - Up - - - 2 - None - - - 3 - Reconnecting - - - 4 - Waiting - - - 5 - Up/Listening - - - - - pfSense OpenVPN Mode - - - 1 - Peer to Peer (SSL/TLS) - - - 2 - P2P Shared Key - - - 3 - Remote Access (SSL/TLS) - - - 4 - Remote Access (User Auth) - - - 5 - Remote Access 8SSL/TLS + User Auth) - - - - - Service state - - - 0 - Down - - - 1 - Up - - - - From e8da73b12656acdaa4ce1ca69a0e8cf9f52a434a Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sun, 12 Jul 2020 08:41:39 +0200 Subject: [PATCH 03/19] Replaced OpenVPN Template --- template_pfsense_active_ovpn_user.xml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/template_pfsense_active_ovpn_user.xml b/template_pfsense_active_ovpn_user.xml index 81ace63..5257ba1 100644 --- a/template_pfsense_active_ovpn_user.xml +++ b/template_pfsense_active_ovpn_user.xml @@ -1,7 +1,7 @@ 4.0 - 2020-07-11T12:27:51Z + 2020-07-12T06:37:29Z Templates/Network devices @@ -189,7 +189,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},connect_time_unix] 60s - 180d + 90d 0 0 3 @@ -249,7 +249,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},remote_host] 60s - 0 + 90d 0 0 4 @@ -309,7 +309,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},user_name] 60s - 0 + 90d 0 0 4 @@ -429,7 +429,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue,{#UNIQUEID},virtual_addr] 60s - 180d + 90d 0 0 4 @@ -488,8 +488,8 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue_numeric,{#UNIQUEID},client_id] - 120s - 0 + 60s + 90d 0 0 3 @@ -549,7 +549,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_server_uservalue_numeric,{#UNIQUEID},peer_id] 60s - 0 + 90d 0 0 3 From c557ceb30b0ea207c18b3840d595e6e410fb8c5f Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sun, 12 Jul 2020 22:17:23 +0200 Subject: [PATCH 04/19] Re-uploaded correct pfSense template --- template_pfsense_active.xml | 6201 ++++++++++++++++++++++++++++++++--- 1 file changed, 5801 insertions(+), 400 deletions(-) diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index f38be9a..0428a27 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,41 +1,3050 @@ 4.0 - 2020-07-11T16:22:40Z + 2020-07-12T20:15:44Z - Templates/Network devices + Templates/Network Devices + + + {Template pfSense Active:vfs.file.cksum[/etc/passwd].diff(0)}>0 + 0 + + /etc/passwd has been changed on {HOST.NAME} + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:pfsense.value[carp_status].last()}>2 + 0 + + CARP Problems on {HOST.NAME} + 0 + + + 0 + 4 + CARP Problems + 0 + 0 + + + + + {Template pfSense Active:pfsense.expected_carp_status.last()}<>0 and {Template pfSense Active:pfsense.value[carp_status].last()}<>{$EXPECTED_CARP_STATUS} + 0 + + CARP Status not Expected on {HOST.NAME} + 0 + + + 0 + 4 + pfSense CARP is not in the state Expected. This means that a failover could be in process. + 0 + 0 + + + + + {Template pfSense Active:kernel.maxfiles.last(0)}<1024 + 0 + + Configured max number of opened files is too low on {HOST.NAME} + 0 + + + 0 + 1 + + 0 + 0 + + + + + {Template pfSense Active:kernel.maxproc.last(0)}<256 + 0 + + Configured max number of processes is too low on {HOST.NAME} + 0 + + + 0 + 1 + + 0 + 0 + + + + + {Template pfSense Active:system.uname.diff(0)}>0 + 0 + + Host information was changed on {HOST.NAME} + 0 + + + 0 + 1 + + 0 + 0 + + + + + {Template pfSense Active:system.hostname.diff(0)}>0 + 0 + + Hostname was changed on {HOST.NAME} + 0 + + + 0 + 1 + + 0 + 0 + + + + + {Template pfSense Active:vm.memory.size[available].last(0)}<20M + 0 + + Lack of available memory on server {HOST.NAME} + 0 + + + 0 + 3 + + 0 + 0 + + + + + {Template pfSense Active:system.swap.size[,pfree].last(0)}<50 + 0 + + Lack of free swap space on {HOST.NAME} + 0 + + + 0 + 2 + It probably means that the systems requires more physical memory. + 0 + 0 + + + + + {Template pfSense Active:pfsense.mbuf.ptotal.last()}>80 + 0 + + MBUF used at 80% + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:pfsense.mbuf.ptotal.last()}>90 + 0 + + MBUF used at 90% + 0 + + + 0 + 4 + + 0 + 0 + + + + + ({Template pfSense Active:pfsense.value[system,version].last()}<>{Template pfSense Active:pfsense.value[system,installed_version].last()})=1 + 0 + + New Version Available on {HOST.NAME} + 0 + + + 0 + 1 + Noify of new version of pfsense available + 0 + 0 + + + + + {Template pfSense Active:pfsense.value[system,new_version_available].last()}=1 + 0 + + New Version of pfSense Available on {HOST.NAME} + 0 + + + 0 + 1 + A new version of pfSense is available for update. + 0 + 1 + + + + + {Template pfSense Active:pfsense.value[gw_status].diff()}>0 + 1 + {Template pfSense Active:pfsense.value[gw_status].diff()}=0 + pfSense Gateway Status Changed on {HOST.NAME} + 0 + + + 0 + 3 + Gateway Status Change, for use with an acion Script (e.g. update DNS record) + 0 + 1 + + + + + {Template pfSense Active:system.cpu.load[percpu,avg1].avg(5m)}>5 + 0 + + Processor load is too high on {HOST.NAME} + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:pfsense.states.pused.last()}>80 + 0 + + State Table used at 80% + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:pfsense.states.pused.last()}>90 + 0 + + State Table used at 90% + 0 + + + 0 + 4 + + 0 + 0 + + + + + {Template pfSense Active:proc.num[].avg(5m)}>300 + 0 + + Too many processes on {HOST.NAME} + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:proc.num[,,run].avg(5m)}>30 + 0 + + Too many processes running on {HOST.NAME} + 0 + + + 0 + 2 + + 0 + 0 + + + + + {Template pfSense Active:system.uptime.change(0)}<0 + 0 + + {HOST.NAME} has just been restarted + 0 + + + 0 + 1 + + 0 + 0 + + + + + + + Active Connections + 900 + 200 + 0.0000 + 100.0000 + 1 + 0 + 0 + 1 + 0 + 0.0000 + 0.0000 + 1 + 2 + 0 + + Template pfSense Active + pfsense.states.max + + + + 0 + 5 + FF2C27 + 0 + 2 + 0 + + Template pfSense Active + pfsense.states.current + + + + + + Active Connections (pie) + 600 + 340 + 0.0000 + 0.0000 + 0 + 0 + 2 + 1 + 0 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 0 + 5B5B5B + 0 + 2 + 2 + + Template pfSense Active + pfsense.states.max + + + + 1 + 5 + FF2C27 + 0 + 2 + 0 + + Template pfSense Active + pfsense.states.current + + + + + + CPU jumps + 900 + 200 + 0.0000 + 100.0000 + 1 + 1 + 0 + 1 + 0 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 5 + 009900 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.switches + + + + 1 + 5 + 000099 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.intr + + + + + + CPU load + 900 + 200 + 0.0000 + 100.0000 + 1 + 1 + 1 + 1 + 0 + 0.0000 + 0.0000 + 1 + 0 + 0 + 0 + + + 0 + 0 + FFA619 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.load[percpu,avg1] + + + + 1 + 0 + E86E30 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.load[percpu,avg5] + + + + 2 + 0 + FF2F26 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.load[percpu,avg15] + + + + + + CPU utilization (Line) + 900 + 200 + 0.0000 + 100.0000 + 1 + 0 + 0 + 1 + 0 + 0.0000 + 0.0000 + 1 + 1 + 0 + 0 + + + 0 + 5 + FFE819 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.util[,interrupt] + + + + 1 + 5 + E85D17 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.util[,nice] + + + + 2 + 5 + DF26FF + 0 + 2 + 0 + + Template pfSense Active + system.cpu.util[,system] + + + + 3 + 5 + 1775E8 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.util[,user] + + + + 4 + 0 + 03D933 + 0 + 2 + 0 + + Template pfSense Active + system.cpu.util[,idle] + + + + + + Memory Available details (pie) + 600 + 340 + 0.0000 + 0.0000 + 0 + 0 + 2 + 1 + 0 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 0 + 003300 + 0 + 2 + 2 + + Template pfSense Active + vm.memory.size[available] + + + + 1 + 0 + 005500 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[free] + + + + 2 + 0 + 007700 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[cached] + + + + 3 + 0 + 009900 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[inactive] + + + + + + Memory usage + 900 + 200 + 0.0000 + 100.0000 + 1 + 0 + 1 + 1 + 0 + 0.0000 + 0.0000 + 1 + 2 + 0 + + Template pfSense Active + vm.memory.size[total] + + + + 0 + 0 + 00EE00 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[wired] + + + + 1 + 0 + 00CC00 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[active] + + + + 2 + 0 + 007700 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[inactive] + + + + 3 + 0 + 005500 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[cached] + + + + 4 + 0 + 003300 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[free] + + + + + + Memory Usage simple (pie) + 600 + 340 + 0.0000 + 0.0000 + 0 + 0 + 2 + 1 + 0 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 0 + 003300 + 0 + 2 + 0 + + Template pfSense Active + vm.memory.size[available] + + + + 1 + 0 + 00DD00 + 0 + 2 + 0 + + Template pfSense Active + kt.mem.used + + + + + + Network Memory Buffer + 900 + 200 + 0.0000 + 100.0000 + 1 + 0 + 1 + 1 + 0 + 0.0000 + 0.0000 + 1 + 2 + 0 + + Template pfSense Active + pfsense.mbuf.max + + + + 0 + 0 + B26E16 + 0 + 2 + 0 + + Template pfSense Active + pfsense.mbuf.current + + + + 1 + 0 + FFCE8E + 0 + 2 + 0 + + Template pfSense Active + pfsense.mbuf.cache + + + + + + Network Memory Buffer (pie) + 600 + 340 + 0.0000 + 0.0000 + 0 + 0 + 2 + 1 + 0 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 0 + 5B5B5B + 0 + 2 + 2 + + Template pfSense Active + pfsense.mbuf.max + + + + 1 + 0 + FFCE8E + 0 + 2 + 0 + + Template pfSense Active + pfsense.mbuf.cache + + + + 2 + 0 + B26E16 + 0 + 2 + 0 + + Template pfSense Active + pfsense.mbuf.current + + + + + + Swap usage + 600 + 340 + 0.0000 + 0.0000 + 0 + 0 + 2 + 1 + 1 + 0.0000 + 0.0000 + 0 + 0 + 0 + 0 + + + 0 + 0 + 5B5B5B + 0 + 2 + 2 + + Template pfSense Active + system.swap.size[,total] + + + + 1 + 0 + FFFF33 + 0 + 2 + 0 + + Template pfSense Active + system.swap.size[,used] + + + + + + + + Generic YesNo + + + 0 + No + + + 1 + Yes + + + + + pfSense CARP Status + + + 0 + Disabled + + + 1 + Master + + + 2 + Backup + + + 3 + Inconsistent + + + 4 + Problem + + + + + pfSense Gateway Status + + + 0 + Up + + + 1 + Packet Loss + + + 2 + High Delay + + + 3 + High Packet Loss + + + 4 + Forced Down + + + 5 + Down + + + + + pfSense OpenVPN Interface Status + + + 0 + Down + + + 1 + Up + + + 2 + None + + + 3 + Reconnecting + + + 4 + Waiting + + + 5 + Up/Listening + + + + + pfSense OpenVPN Mode + + + 1 + Peer to Peer (SSL/TLS) + + + 2 + P2P Shared Key + + + 3 + Remote Access (SSL/TLS) + + + 4 + Remote Access (User Auth) + + + 5 + Remote Access 8SSL/TLS + User Auth) + + + + + Service state + + + 0 + Down + + + 1 + Up + + + + From a31687e2cb373b8a58723c74744afe8b4369a7a0 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 27 Jul 2020 20:36:33 +0200 Subject: [PATCH 05/19] Fixed Trigger on gateways --- template_pfsense_active.xml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index 0428a27..de2628d 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -3331,7 +3331,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last(#3)}=5 + {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last()}=5 0 Gateway {#GATEWAY} is down @@ -3347,7 +3347,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last(#3)}=4 + {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last()}=4 0 Gateway {#GATEWAY} is forced down @@ -3363,7 +3363,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last(#3)}=2 + {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last()}=2 0 High Delay on gateway {#GATEWAY} @@ -3379,7 +3379,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last(#3)}=3 + {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last()}=3 0 High packet Loss on {#GATEWAY} @@ -3395,7 +3395,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last(#3)}=1 + {Template pfSense Active:pfsense.value[gw_value,{#GATEWAY},status].last()}=1 0 Packet Loss on {#GATEWAY} From a38c08bb1a41589adcb646b03dd65a1ac9fb0681 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 28 Sep 2020 13:30:41 +0200 Subject: [PATCH 06/19] Corrected issue #49 --- pfsense_zbx.php | 8 +++++--- template_pfsense_active_ovpn_user.xml | 4 ++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 82b3dcd..807f026 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -283,17 +283,19 @@ function pfz_services_discovery(){ // Get service value // 2020-03-27: Added space replace in service name for issue #12 +// 2020-09-28: Corrected Space Replace function pfz_service_value($name,$value){ $services = get_services(); - + $name = str_replace("__"," ",$name); + //List of service which are stopped on CARP Slave. //For now this is the best way i found for filtering out the triggers //Waiting for a way in Zabbix to use Global Regexp in triggers with items discovery $stopped_on_carp_slave = array("haproxy","openvpn.","openvpn"); foreach ($services as $service){ - $namecfr=str_replace("__"," ",$service["name"]); - $carpcfr=str_replace("__"," ",$service["name"]); + $namecfr = $service["name"]; + $carpcfr = $service["name"]; //OpenVPN if (!empty($service['id'])) { diff --git a/template_pfsense_active_ovpn_user.xml b/template_pfsense_active_ovpn_user.xml index 5257ba1..639f41f 100644 --- a/template_pfsense_active_ovpn_user.xml +++ b/template_pfsense_active_ovpn_user.xml @@ -4,7 +4,7 @@ 2020-07-12T06:37:29Z - Templates/Network devices + Templates/Network Devices @@ -20,7 +20,7 @@ Version 1.0.1 https://github.com/rbicelli/pfsense-zabbix-template - Templates/Network devices + Templates/Network Devices From f4c5f4c15112041276a31b47876c6a3295024b47 Mon Sep 17 00:00:00 2001 From: Marco Hofmann Date: Thu, 3 Dec 2020 15:10:41 +0100 Subject: [PATCH 07/19] Update README.md {$EXPECTED_CARP_STATUS} should be a user macro and not a LLD macro --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d76ab86..9dd2b87 100644 --- a/README.md +++ b/README.md @@ -57,7 +57,7 @@ Also increase the **Timeout** value at least to **5**, otherwise some checks wil Then import xml templates in Zabbix and add your pfSense hosts. -If you are running a redundant CARP setup you should adjust the macro {#EXPECTED_CARP_STATUS} to a value representing what is CARP expected status on monitored box. +If you are running a redundant CARP setup you should adjust the macro {$EXPECTED_CARP_STATUS} to a value representing what is CARP expected status on monitored box. Possible values are: From af39fd39edf4d1a6b205ab081c3c5798716f0674 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 18 Jan 2021 16:04:27 +0100 Subject: [PATCH 08/19] Added IPsec Template, Detecting Package Update --- README.md | 7 + pfsense_zbx.php | 342 +++++++- template_pfsense_active.xml | 241 +++++- template_pfsense_active_ipsec.xml | 1080 +++++++++++++++++++++++++ template_pfsense_active_ovpn_user.xml | 6 +- 5 files changed, 1648 insertions(+), 28 deletions(-) create mode 100644 template_pfsense_active_ipsec.xml diff --git a/README.md b/README.md index 9dd2b87..0566f15 100644 --- a/README.md +++ b/README.md @@ -18,12 +18,19 @@ Tested with pfSense 2.4.x, Zabbix 4.0, Zabbix 5.0 - CARP Monitoring (Global CARP State) - Basic Service Discovery and Monitoring (Service Status) - pfSense Version/Update Available + - Packages Update Available **Template pfSense Active: OpenVPN Server User Auth** - Discovery of OpenVPN Clients connected to OpenVPN Servers in user auth mode - Monitoring of Client Parameters (Bytes sent/received, Connection Time...) +**Template pfSense Active: IPsec** + + - Discovery of IPsec Site-to-Site tunnels + - Monitoring tunnel status (Phase 1 and Phase 2) + + ## Configuration First copy the file pfsense_zbx.php to your pfsense box (e.g. to /root/scripts). diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 807f026..15837e1 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -1,7 +1,7 @@ This program is licensed under Apache 2.0 License @@ -24,6 +24,8 @@ require_once("service-utils.inc"); //For System require_once('pkg-utils.inc'); +//For DHCP + //Testing function, for template creating purpose function pfz_test(){ @@ -55,7 +57,34 @@ function pfz_test(){ echo "Services: \n"; print_r($services); echo $line; - + + echo "IPsec: \n"; + + require_once("ipsec.inc"); + global $config; + init_config_arr(array('ipsec', 'phase1')); + init_config_arr(array('ipsec', 'phase2')); + $a_phase2 = &$config['ipsec']['phase2']; + $status = ipsec_list_sa(); + echo "IPsec Status: \n"; + print_r($status); + + $a_phase1 = &$config['ipsec']['phase1']; + $a_phase2 = &$config['ipsec']['phase2']; + + echo "IPsec Config Phase 1: \n"; + print_r($a_phase1); + + echo "IPsec Config Phase 2: \n"; + print_r($a_phase2); + + echo $line; + + //Packages + echo "Packages: \n"; + require_once("pkg-utils.inc"); + $installed_packages = get_pkg_info('all', false, true); + print_r($installed_packages); } @@ -334,6 +363,7 @@ function pfz_service_value($name,$value){ echo 0; else echo 1; + break; default: echo $service[$value]; break; @@ -381,18 +411,207 @@ function pfz_gw_value($gw, $valuekey) { } -function pfz_carp_status(){ +// IPSEC Discovery +function pfz_ipsec_discovery_ph1(){ + + require_once("ipsec.inc"); + global $config; + init_config_arr(array('ipsec', 'phase1')); + $a_phase1 = &$config['ipsec']['phase1']; + + $json_string = '{"data":['; + + foreach ($a_phase1 as $data) { + $json_string .= '{"{#IKEID}":"' . $data['ikeid'] . '"'; + $json_string .= ',"{#NAME}":"' . $data['descr'] . '"'; + $json_string .= '},'; + } + + $json_string = rtrim($json_string,","); + $json_string .= "]}"; + + echo $json_string; + +} + + +function pfz_ipsec_ph1($ikeid,$valuekey){ + // Get Value from IPsec Phase 1 Configuration + // If Getting "disabled" value only check item presence in config array + + require_once("ipsec.inc"); + global $config; + init_config_arr(array('ipsec', 'phase1')); + $a_phase1 = &$config['ipsec']['phase1']; + + $value = ""; + switch ($valuekey) { + case 'status': + $value = pfz_ipsec_status($ikeid); + break; + case 'disabled': + $value = "0"; + default: + foreach ($a_phase1 as $data) { + if ($data['ikeid'] == $ikeid) { + if(array_key_exists($valuekey,$data)) { + if ($valuekey=='disabled') + $value = "1"; + else + $value = pfz_valuemap("ipsec." . $valuekey, $data[$valuekey], $data[$valuekey]); + break; + } + } + } + } + echo $value; +} + +function pfz_ipsec_discovery_ph2(){ + + require_once("ipsec.inc"); + + global $config; + init_config_arr(array('ipsec', 'phase2')); + $a_phase2 = &$config['ipsec']['phase2']; + + $json_string = '{"data":['; + + foreach ($a_phase2 as $data) { + $json_string .= '{"{#IKEID}":"' . $data['ikeid'] . '"'; + $json_string .= ',"{#NAME}":"' . $data['descr'] . '"'; + $json_string .= ',"{#UNIQID}":"' . $data['uniqid'] . '"'; + $json_string .= ',"{#REQID}":"' . $data['reqid'] . '"'; + $json_string .= ',"{#EXTID}":"' . $data['ikeid'] . '.' . $data['reqid'] . '"'; + $json_string .= '},'; + } + + $json_string = rtrim($json_string,","); + $json_string .= "]}"; + + echo $json_string; + +} + +function pfz_ipsec_ph2($uniqid, $valuekey){ + require_once("ipsec.inc"); + global $config; + init_config_arr(array('ipsec', 'phase2')); + $a_phase2 = &$config['ipsec']['phase2']; + + $valuecfr = explode(".",$valuekey); + + switch ($valuecfr[0]) { + case 'status': + $idarr = explode(".", $uniqid); + $statuskey = "state"; + if (isset($valuecfr[1])) $statuskey = $valuecfr[1]; + $value = pfz_ipsec_status($idarr[0],$idarr[1],$statuskey); + break; + case 'disabled': + $value = "0"; + } + + foreach ($a_phase2 as $data) { + if ($data['uniqid'] == $uniqid) { + if(array_key_exists($valuekey,$data)) { + if ($valuekey=='disabled') + $value = "1"; + else + $value = pfz_valuemap("ipsec_ph2." . $valuekey, $data[$valuekey], $data[$valuekey]); + break; + } + } + } + echo $value; +} + +function pfz_ipsec_status($ikeid,$reqid=-1,$valuekey='state'){ + + require_once("ipsec.inc"); + global $config; + init_config_arr(array('ipsec', 'phase1')); + $a_phase1 = &$config['ipsec']['phase1']; + $status = ipsec_list_sa(); + $ipsecconnected = array(); + + $carp_status = pfz_carp_status(false); + + //Phase-Status match borrowed from status_ipsec.php + if (is_array($status)) { + foreach ($status as $l_ikeid=>$ikesa) { + + if(isset($ikesa['con-id'])){ + $con_id = substr($ikesa['con-id'], 3); + }else{ + $con_id = filter_var($l_ikeid, FILTER_SANITIZE_NUMBER_INT); + } + if ($ikesa['version'] == 1) { + $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00')); + $ipsecconnected[$ph1idx] = $ph1idx; + } else { + if (!ipsec_ikeid_used($con_id)) { + // probably a v2 with split connection then + $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00')); + $ipsecconnected[$ph1idx] = $ph1idx; + } else { + $ipsecconnected[$con_id] = $ph1idx = $con_id; + } + } + if ($ph1idx == $ikeid){ + if ($reqid!=-1) { + // Asking for Phase2 Status Value + foreach ($ikesa['child-sas'] as $childsas) { + if ($childsas['reqid']==$reqid) { + if ($childsas['state'] == 'REKEYED') { + //if state is rekeyed go on + $tmp_value = $childsas[$valuekey]; + } else { + $tmp_value = $childsas[$valuekey]; + break; + } + } + } + } else { + $tmp_value = $ikesa[$valuekey]; + } + + break; + } + } + } + switch($valuekey) { + case 'state': + $value = pfz_valuemap('ipsec.state', strtolower($tmp_value)); + $value = $value + (10 * ($carp_status-1)); + break; + default: + $value = $tmp_value; + break; + } +// print_r($ikesa); + return $value; +} + + + +function pfz_carp_status($echo = true){ //Detect CARP Status global $config; $status_return = 0; $status = get_carp_status(); $carp_detected_problems = get_single_sysctl("net.inet.carp.demotion"); + //CARP is disabled + $ret = 0; + if ($status != 0) { //CARP is enabled if ($carp_detected_problems != 0) { - echo 4; //There's some Major Problems with CARP - return true; + //There's some Major Problems with CARP + $ret = 4; + if ($echo == true) echo $ret; + return $ret; } $status_changed = false; @@ -410,19 +629,55 @@ function pfz_carp_status(){ } if ($status_changed) { //CARP Status is inconsistent across interfaces + $ret=3; echo 3; } else { if ($prev_status=="MASTER") - echo 1; + $ret = 1; else - echo 2; + $ret = 2; } - } else { - //CARP is Disabled - echo 0; } + + if ($echo == true) echo $ret; + return $ret; + } +function pfz_dhcpfailover_discovery(){ + //System functions regarding DHCP Leases will be available in the upcoming release of pfSense, so let's wait + require_once("system.inc"); + $leases = system_get_dhcpleases(); + + $json_string = '{"data":['; + + if (count($leases['failover']) > 0){ + foreach ($leases['failover'] as $data){ + $json_string .= '{"{#FAILOVER_GROUP}":"' . str_replace(" ", "__", $data['name']) . '"'; + } + } + + $json_string = rtrim($json_string,","); + $json_string .= "]}"; + + echo $json_string; +} + +//Packages +function pfz_packages_uptodate(){ + require_once("pkg-utils.inc"); + $installed_packages = get_pkg_info('all', false, true); + + $ret = 0; + + foreach ($installed_packages as $package){ + if ($package['version']!=$package['installed_version']){ + $ret ++; + } + } + + return $ret; +} //System Information function pfz_get_system_value($section){ @@ -440,13 +695,17 @@ function pfz_get_system_value($section){ else echo "1"; break; + case "packages_update": + echo pfz_packages_uptodate(); + break; } } + // Value mappings // Each value map is represented by an associative array -function pfz_valuemap($valuename, $value){ +function pfz_valuemap($valuename, $value, $default="0"){ switch ($valuename){ @@ -485,13 +744,55 @@ function pfz_valuemap($valuename, $value){ "highloss" => "3", "force_down" => "4", "down" => "5"); - break; + break; + + case "ipsec.iketype": + $valuemap = array ( + "auto" => 0, + "ikev1" => 1, + "ikev2" => 2); + break; + + case "ipsec.mode": + $valuemap = array ( + "main" => 0, + "aggressive" => 1); + break; + + case "ipsec.protocol": + $valuemap = array ( + "both" => 0, + "inet" => 1, + "inet6" => 2); + break; + + case "ipsec_ph2.mode": + $valuemap = array ( + "transport" => 0, + "tunnel" => 1, + "tunnel6" => 2); + break; + + case "ipsec_ph2.protocol": + $valuemap = array ( + "esp" => 1, + "ah" => 2); + break; + + case "ipsec.state": + $valuemap = array ( + "established" => 1, + "connecting" => 2, + "installed" => 1, + "rekeyed" => 2); + break; + } if (array_key_exists($value, $valuemap)) return $valuemap[$value]; - return "0"; + return $default; } //Argument parsers for Discovery @@ -515,6 +816,15 @@ function pfz_discovery($section){ case "interfaces": pfz_interface_discovery(); break; + case "ipsec_ph1": + pfz_ipsec_discovery_ph1(); + break; + case "ipsec_ph2": + pfz_ipsec_discovery_ph2(); + break; + case "dhcpfailover": + pfz_dhcpfailover_discovery(); + break; } } @@ -553,6 +863,12 @@ switch (strtolower($argv[1])){ case "system": pfz_get_system_value($argv[2]); break; + case "ipsec_ph1": + pfz_ipsec_ph1($argv[2],$argv[3]); + break; + case "ipsec_ph2": + pfz_ipsec_ph2($argv[2],$argv[3]); + break; default: pfz_test(); } diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index de2628d..036fd30 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,7 +1,7 @@ 4.0 - 2020-07-12T20:15:44Z + 2021-01-18T15:00:52Z Templates/Network Devices @@ -12,7 +12,7 @@ pfsense Active Active template for pfsense, requires pfsense_zbx.php installed to pfSense Box. -Version 1.0.1 +Version 1.0.2 https://github.com/rbicelli/pfsense-zabbix-template @@ -953,6 +953,65 @@ https://github.com/rbicelli/pfsense-zabbix-template 0 + + Packages Needing Update + 7 + + + pfsense.value[system,packages_update] + 1d + 90d + 365d + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + Number of packages needing update. + 0 + + + System + + + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + pfSense Available Version 7 @@ -3045,7 +3104,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.discovery[gw] - 30s + 300s 0 @@ -3077,7 +3136,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[gw_value,{#GATEWAY},delay] - 30s + 60s 90d 365d 0 @@ -3142,7 +3201,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[gw_value,{#GATEWAY},loss] - 30s + 60s 90d 365d 0 @@ -3207,7 +3266,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[gw_value,{#GATEWAY},status] - 30s + 60s 90d 365d 0 @@ -3269,7 +3328,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[gw_value,{#GATEWAY},stddev] - 30s + 60s 90d 365d 0 @@ -3548,6 +3607,71 @@ https://github.com/rbicelli/pfsense-zabbix-template 7d Discovery of network interfaces as defined in global regular expression "Network interfaces for discovery". + + Incoming Errors on {#IFDESCR} + 7 + + + net.if.in[{#IFNAME},errors] + 60 + 7d + 365d + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + + 0 + + + Network interfaces + + + + + + + 10 + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + + Incoming network traffic on {#IFDESCR} 7 @@ -3617,6 +3741,71 @@ https://github.com/rbicelli/pfsense-zabbix-template + + Outgoing errors on {#IFDESCR} + 7 + + + net.if.out[{#IFNAME},errors] + 60 + 7d + 365d + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + + 0 + + + Network interfaces + + + + + + + 10 + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + + Outgoing network traffic on {#IFDESCR} 7 @@ -3760,7 +3949,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.discovery[openvpn_client] - 30s + 300s 0 @@ -3792,7 +3981,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[openvpn_clientvalue,{#CLIENT},status] - 30s + 60s 90d 365d 0 @@ -3894,7 +4083,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.discovery[openvpn_server] - 30s + 300s 0 @@ -4210,7 +4399,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.discovery[services] - 30s + 300s 0 @@ -4304,7 +4493,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.value[service_value,{#SERVICE},status] - 30s + 60s 90d 365d 0 @@ -4867,6 +5056,18 @@ or + + {$CARP_SERVICES_STOPPED} + ^(haproxy|openvpn)$ + + + {$CARP_SLAVE_SERVICES:"haproxy"} + 0 + + + {$CARP_SLAVE_SERVICES:"openvpn"} + 0 + {$EXPECTED_CARP_STATUS} 0 @@ -5181,6 +5382,22 @@ or + + {Template pfSense Active:pfsense.value[system,packages_update].last()}>0 + 0 + + Packages Update Available on {HOST.NAME} + 0 + + + 0 + 1 + Notify of new version of packages are available + 0 + 0 + + + {Template pfSense Active:pfsense.value[gw_status].diff()}>0 1 diff --git a/template_pfsense_active_ipsec.xml b/template_pfsense_active_ipsec.xml new file mode 100644 index 0000000..30721a1 --- /dev/null +++ b/template_pfsense_active_ipsec.xml @@ -0,0 +1,1080 @@ + + + 4.0 + 2021-01-18T15:02:45Z + + + Templates/Network Devices + + + + + + + + pfSense IPsec Enabled + + + 0 + Yes + + + 1 + No + + + + + pfSense IPsec IKE Type + + + 0 + Auto + + + 1 + IKE v1 + + + 2 + IKE v2 + + + + + pfSense IPsec Phase 1 Status + + + 0 + Down + + + 1 + Established + + + 2 + Connecting + + + 10 + Down on CARP Secondary + + + + + pfSense IPsec Phase 2 Protocol + + + 1 + ESP + + + 2 + AH + + + + + pfSense IPsec Phase 2 Status + + + 0 + Down + + + 1 + Installed + + + 2 + Rekeyed + + + 10 + Down on CARP Secondary + + + + + pfSense IPsec Protocol + + + 0 + Dual Stack (IPv4 & IPv6) + + + 1 + IPv4 + + + 2 + IPv6 + + + + + pfSense IPsec Tunnel Mode + + + 0 + Main + + + 1 + Aggressive + + + + + diff --git a/template_pfsense_active_ovpn_user.xml b/template_pfsense_active_ovpn_user.xml index 639f41f..41106bf 100644 --- a/template_pfsense_active_ovpn_user.xml +++ b/template_pfsense_active_ovpn_user.xml @@ -1,7 +1,7 @@ 4.0 - 2020-07-12T06:37:29Z + 2021-01-18T15:02:06Z Templates/Network Devices @@ -15,7 +15,7 @@ Monitor client Connections of OpenVPN Server. Requires pfsense_zbx.php installed to pfSense Box. -Version 1.0.1 +Version 1.0.2 https://github.com/rbicelli/pfsense-zabbix-template @@ -36,7 +36,7 @@ https://github.com/rbicelli/pfsense-zabbix-template pfsense.discovery[openvpn_server_user] - 30s + 60s 0 From 9aa1b6c0d23d219f998806580858551fb82ae335 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 18 Jan 2021 16:58:38 +0100 Subject: [PATCH 09/19] Corrected issue #58 --- pfsense_zbx.php | 30 ++++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 15837e1..30218c1 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -202,12 +202,15 @@ function pfz_openvpn_server_userdiscovery(){ if (is_array($server['conns'])) { $name = trim(preg_replace('/\w{3}(\d)?\:\d{4,5}/i', '', $server['name'])); - foreach($server['conns'] as $conn) { - $json_string .= '{"{#SERVERID}":"' . $server['vpnid'] . '"'; - $json_string .= ',"{#SERVERNAME}":"' . $name . '"'; - $json_string .= ',"{#UNIQUEID}":"' . $server['vpnid'] . '+' . $conn['common_name'] . '"'; - $json_string .= ',"{#USERID}":"' . $conn['common_name'] . '"'; - $json_string .= '},'; + foreach($server['conns'] as $conn) { + + $common_name = pfz_replacespecialchars($conn['common_name']); + + $json_string .= '{"{#SERVERID}":"' . $server['vpnid'] . '"'; + $json_string .= ',"{#SERVERNAME}":"' . $name . '"'; + $json_string .= ',"{#UNIQUEID}":"' . $server['vpnid'] . '+' . $common_name . '"'; + $json_string .= ',"{#USERID}":"' . $conn['common_name'] . '"'; + $json_string .= '},'; } } } @@ -222,6 +225,7 @@ function pfz_openvpn_server_userdiscovery(){ // Get OpenVPN User Connected Value function pfz_openvpn_server_uservalue($unique_id, $valuekey, $default=""){ + $unique_id = pfz_replacespecialchars($unique_id,true); $atpos=strpos($unique_id,'+'); $server_id = substr($unique_id,0,$atpos); $user_id = substr($unique_id,$atpos+1); @@ -258,6 +262,20 @@ function pfz_openvpn_clientdiscovery() { echo $json_string; } +function pfz_replacespecialchars($inputstr,$reverse=false){ + $specialchars = ",',\",`,*,?,[,],{,},~,$,!,&,;,(,),<,>,|,#,@,0x0a"; + $specialchars = explode(",",$specialchars); + $resultstr = $inputstr; + + for ($n=0;$n Date: Mon, 18 Jan 2021 17:29:21 +0100 Subject: [PATCH 10/19] Added Radvd to list of service stopped on CARP Secondary --- pfsense_zbx.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 30218c1..e754672 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -338,7 +338,7 @@ function pfz_service_value($name,$value){ //List of service which are stopped on CARP Slave. //For now this is the best way i found for filtering out the triggers //Waiting for a way in Zabbix to use Global Regexp in triggers with items discovery - $stopped_on_carp_slave = array("haproxy","openvpn.","openvpn"); + $stopped_on_carp_slave = array("haproxy","radvd","openvpn.","openvpn"); foreach ($services as $service){ $namecfr = $service["name"]; From 3268a4445b518871f0a4fbd0b4b43cf8cfb2e40f Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 18 Jan 2021 22:31:47 +0100 Subject: [PATCH 11/19] Fixed gateway Status, Removed IPsec Phase2 Status (reqid mismatch) --- pfsense_zbx.php | 1 + template_pfsense_active_ipsec.xml | 205 +----------------------------- 2 files changed, 2 insertions(+), 204 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index e754672..dc5b42c 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -756,6 +756,7 @@ function pfz_valuemap($valuename, $value, $default="0"){ case "gateway.status": $valuemap = array( + "online" => "0", "none" => "0", "loss" => "1", "highdelay" => "2", diff --git a/template_pfsense_active_ipsec.xml b/template_pfsense_active_ipsec.xml index 30721a1..8ebeafe 100644 --- a/template_pfsense_active_ipsec.xml +++ b/template_pfsense_active_ipsec.xml @@ -1,7 +1,7 @@ 4.0 - 2021-01-18T15:02:45Z + 2021-01-18T21:30:16Z Templates/Network Devices @@ -504,188 +504,6 @@ https://github.com/rbicelli/pfsense-zabbix-template 30d Discovery of IPsec Phase 2 - - IPsec Tunnel {#IKEID}.{#REQID} {#NAME} Phase 2 Byte Received - 7 - - - pfsense.value[ipsec_ph2,{#EXTID},status.bytes-in] - 60s - 90d - 365d - 0 - 3 - - b - - - 0 - 0 - - 0 - - - - 0 - - - - - - IPsec Tunnel Phase 2 Protocol - 0 - - - IPsec - - - - - - - 3s - - - - 200 - 1 - 0 - - - 0 - 0 - 0 - 0 - - - - 0 - 0 - - - - - IPsec Tunnel {#IKEID}.{#REQID} {#NAME} Phase 2 Byte Sent - 7 - - - pfsense.value[ipsec_ph2,{#EXTID},status.bytes-out] - 60s - 90d - 365d - 0 - 3 - - b - - - 0 - 0 - - 0 - - - - 0 - - - - - - IPsec Tunnel Phase 2 Protocol - 0 - - - IPsec - - - - - - - 3s - - - - 200 - 1 - 0 - - - 0 - 0 - 0 - 0 - - - - 0 - 0 - - - - - IPsec Tunnel {#IKEID}.{#REQID} {#NAME} Phase 2 Status - 7 - - - pfsense.value[ipsec_ph2,{#EXTID},status] - 60s - 90d - 365d - 0 - 3 - - - - - 0 - 0 - - 0 - - - - 0 - - - - - - IPsec Tunnel Phase 2 Protocol - 0 - - - IPsec - - - - pfSense IPsec Phase 2 Status - - - - - 3s - - - - 200 - 1 - 0 - - - 0 - 0 - 0 - 0 - - - - 0 - 0 - - - IPsec Tunnel {#IKEID}.{#REQID} {#NAME} Phase 2 Enabled 7 @@ -1025,27 +843,6 @@ https://github.com/rbicelli/pfsense-zabbix-template - - pfSense IPsec Phase 2 Status - - - 0 - Down - - - 1 - Installed - - - 2 - Rekeyed - - - 10 - Down on CARP Secondary - - - pfSense IPsec Protocol From 3d6af9511110813028edff6c02a9ca48215dc7de Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Mon, 18 Jan 2021 23:12:46 +0100 Subject: [PATCH 12/19] Fixed pfz_valuemap function --- pfsense_zbx.php | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index dc5b42c..7ffa472 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -808,9 +808,10 @@ function pfz_valuemap($valuename, $value, $default="0"){ } - if (array_key_exists($value, $valuemap)) - return $valuemap[$value]; - + if (isset($valuemap)) { + if (array_key_exists($value, $valuemap)) + return $valuemap[$value]; + } return $default; } From 7c9c5e66e5afdaf833f8620c2e4251049b0c176f Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Wed, 20 Jan 2021 15:07:57 +0100 Subject: [PATCH 13/19] Added checks in value maps for recent php versions, fixed p2p_tls service detection (Issue #36) --- pfsense_zbx.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 7ffa472..9569a17 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -162,7 +162,11 @@ function pfz_openvpn_servervalue($server_id,$valuekey){ if ($valuekey=="status") { if ( ($server['mode']=="server_user") || ($server['mode']=="server_tls_user") || ($server['mode']=="server_tls") ){ if ($value=="") $value="server_user_listening"; - } + } else if ($server['mode']=="p2p_tls"){ + // For p2p_tls, ensure we have one client, and return up if it's the case + if ($value=="") + $value=(is_array($server["conns"]) && count($server["conns"]) > 0) ? "up" : "down"; + } } } } @@ -808,7 +812,7 @@ function pfz_valuemap($valuename, $value, $default="0"){ } - if (isset($valuemap)) { + if (is_array($valuemap)) { if (array_key_exists($value, $valuemap)) return $valuemap[$value]; } From 0f279ff310272f751d7547dfcd0f66a24ed11f45 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sat, 23 Jan 2021 16:54:32 +0100 Subject: [PATCH 14/19] Added DHCP Failover Monitoring, Renamed CARP section to HA --- README.md | 6 ++ pfsense_zbx.php | 196 +++++++++++++++++++++++++++++++++++- template_pfsense_active.xml | 89 ++++++++++++++-- 3 files changed, 283 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 0566f15..d900f84 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,12 @@ mkdir /root/scripts curl -o /root/scripts/pfsense_zbx.php https://raw.githubusercontent.com/rbicelli/pfsense-zabbix-template/master/pfsense_zbx.php ``` +or, from **Diagnostics/Command Prompt** input this one-liner: + +```bash +mkdir /root/scripts && curl -o /root/scripts/pfsense_zbx.php https://raw.githubusercontent.com/rbicelli/pfsense-zabbix-template/master/pfsense_zbx.php +``` + Then install package "Zabbix Agent 4" on your pfSense Box diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 9569a17..9ba8f14 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -26,7 +26,6 @@ require_once('pkg-utils.inc'); //For DHCP - //Testing function, for template creating purpose function pfz_test(){ $line = "-------------------\n"; @@ -666,6 +665,175 @@ function pfz_carp_status($echo = true){ } +// DHCP Checks (copy of status_dhcp_leases.php, waiting for pfsense 2.5) +function pfz_remove_duplicate($array, $field) { + foreach ($array as $sub) { + $cmp[] = $sub[$field]; + } + $unique = array_unique(array_reverse($cmp, true)); + foreach ($unique as $k => $rien) { + $new[] = $array[$k]; + } + return $new; +} + +// Get DHCP Arrays (copied from status_dhcp_leases.php, waiting for pfsense 2.5, in order to use system_get_dhcpleases();) +function pfz_dhcp_get($valuekey) { + + require_once("config.inc"); + + $leasesfile = "{$g['dhcpd_chroot_path']}/var/db/dhcpd.leases"; + + $awk = "/usr/bin/awk"; + /* this pattern sticks comments into a single array item */ + $cleanpattern = "'{ gsub(\"#.*\", \"\");} { gsub(\";\", \"\"); print;}'"; + /* We then split the leases file by } */ + $splitpattern = "'BEGIN { RS=\"}\";} {for (i=1; i<=NF; i++) printf \"%s \", \$i; printf \"}\\n\";}'"; + + /* stuff the leases file in a proper format into a array by line */ + @exec("/bin/cat {$leasesfile} 2>/dev/null| {$awk} {$cleanpattern} | {$awk} {$splitpattern}", $leases_content); + $leases_count = count($leases_content); + @exec("/usr/sbin/arp -an", $rawdata); + + foreach ($leases_content as $lease) { + /* split the line by space */ + $data = explode(" ", $lease); + /* walk the fields */ + $f = 0; + $fcount = count($data); + /* with less than 20 fields there is nothing useful */ + if ($fcount < 20) { + $i++; + continue; + } + while ($f < $fcount) { + switch ($data[$f]) { + case "failover": + $pools[$p]['name'] = trim($data[$f+2], '"'); + $pools[$p]['name'] = "{$pools[$p]['name']} (" . convert_friendly_interface_to_friendly_descr(substr($pools[$p]['name'], 5)) . ")"; + $pools[$p]['mystate'] = $data[$f+7]; + $pools[$p]['peerstate'] = $data[$f+14]; + $pools[$p]['mydate'] = $data[$f+10]; + $pools[$p]['mydate'] .= " " . $data[$f+11]; + $pools[$p]['peerdate'] = $data[$f+17]; + $pools[$p]['peerdate'] .= " " . $data[$f+18]; + $p++; + $i++; + continue 3; + case "lease": + $leases[$l]['ip'] = $data[$f+1]; + $leases[$l]['type'] = $dynamic_string; + $f = $f+2; + break; + case "starts": + $leases[$l]['start'] = $data[$f+2]; + $leases[$l]['start'] .= " " . $data[$f+3]; + $f = $f+3; + break; + case "ends": + if ($data[$f+1] == "never") { + // Quote from dhcpd.leases(5) man page: + // If a lease will never expire, date is never instead of an actual date. + $leases[$l]['end'] = gettext("Never"); + $f = $f+1; + } else { + $leases[$l]['end'] = $data[$f+2]; + $leases[$l]['end'] .= " " . $data[$f+3]; + $f = $f+3; + } + break; + case "tstp": + $f = $f+3; + break; + case "tsfp": + $f = $f+3; + break; + case "atsfp": + $f = $f+3; + break; + case "cltt": + $f = $f+3; + break; + case "binding": + switch ($data[$f+2]) { + case "active": + $leases[$l]['act'] = $active_string; + break; + case "free": + $leases[$l]['act'] = $expired_string; + $leases[$l]['online'] = $offline_string; + break; + case "backup": + $leases[$l]['act'] = $reserved_string; + $leases[$l]['online'] = $offline_string; + break; + } + $f = $f+1; + break; + case "next": + /* skip the next binding statement */ + $f = $f+3; + break; + case "rewind": + /* skip the rewind binding statement */ + $f = $f+3; + break; + case "hardware": + $leases[$l]['mac'] = $data[$f+2]; + /* check if it's online and the lease is active */ + if (in_array($leases[$l]['ip'], $arpdata_ip)) { + $leases[$l]['online'] = $online_string; + } else { + $leases[$l]['online'] = $offline_string; + } + $f = $f+2; + break; + case "client-hostname": + if ($data[$f+1] <> "") { + $leases[$l]['hostname'] = preg_replace('/"/', '', $data[$f+1]); + } else { + $hostname = gethostbyaddr($leases[$l]['ip']); + if ($hostname <> "") { + $leases[$l]['hostname'] = $hostname; + } + } + $f = $f+1; + break; + case "uid": + $f = $f+1; + break; + } + $f++; + } + $l++; + $i++; + /* slowly chisel away at the source array */ + array_shift($leases_content); + } + /* remove duplicate items by mac address */ + if (count($leases) > 0) { + $leases = pfz_remove_duplicate($leases, "ip"); + } + + if (count($pools) > 0) { + $pools = pfz_remove_duplicate($pools, "name"); + asort($pools); + } + + switch ($valuekey){ + case "pools": + return $pools; + break; + case "failover": + return $failover; + break; + case "leases": + default: + return $leases; + } + +} + function pfz_dhcpfailover_discovery(){ //System functions regarding DHCP Leases will be available in the upcoming release of pfSense, so let's wait require_once("system.inc"); @@ -685,6 +853,29 @@ function pfz_dhcpfailover_discovery(){ echo $json_string; } +function pfz_dhcp_check_failover(){ + // Check DHCP Failover Status + // Returns number of failover pools which state is not normal or + // different than peer state + $failover = pfz_dhcp_get("failover"); + $ret = 0; + foreach ($failover as $f){ + if ( ($f["mystate"]!="normal") || ($f["mystate"]!=$f["peerstate"])) { + $ret++; + } + } + return $ret; +} + +function pfz_dhcp($section, $valuekey=""){ + switch ($section){ + case "failover": + echo pfz_dhcp_check_failover(); + break; + default: + } +} + //Packages function pfz_packages_uptodate(){ require_once("pkg-utils.inc"); @@ -893,6 +1084,9 @@ switch (strtolower($argv[1])){ case "ipsec_ph2": pfz_ipsec_ph2($argv[2],$argv[3]); break; + case "dhcp": + pfz_dhcp($argv[2],$argv[3]); + break; default: pfz_test(); } diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index 036fd30..8b76d4b 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,7 +1,7 @@ 4.0 - 2021-01-18T15:00:52Z + 2021-01-23T15:53:03Z Templates/Network Devices @@ -21,9 +21,6 @@ https://github.com/rbicelli/pfsense-zabbix-template - - CARP - CPU @@ -33,6 +30,9 @@ https://github.com/rbicelli/pfsense-zabbix-template Gateways + + HA + Memory @@ -271,7 +271,7 @@ https://github.com/rbicelli/pfsense-zabbix-template 0 - CARP + HA @@ -745,7 +745,7 @@ https://github.com/rbicelli/pfsense-zabbix-template 0 - CARP + HA @@ -774,6 +774,65 @@ https://github.com/rbicelli/pfsense-zabbix-template 0 + + DHCP Failover Pool Problems + 7 + + + pfsense.value[dhcp,failover] + 120s + 90d + 365d + 0 + 3 + + + + + 0 + 0 + + 0 + + + + 0 + + + + + + This value indicates, in a HA scenario, if DHCP failover pool partners are out of sync. + 0 + + + HA + + + + + + + 3s + + + + 200 + 1 + 0 + + + 0 + 0 + 0 + 0 + + + + 0 + 0 + + Gateway Status Raw 7 @@ -5254,6 +5313,22 @@ or + + {Template pfSense Active:pfsense.value[carp_status].last()}>2 + 0 + + DHCP Failover Problems on {HOST.NAME} + 0 + + https://docs.netgate.com/pfsense/en/latest/troubleshooting/ha-dhcp-failover.html + 0 + 4 + One or more DHCP Pools are experiencing failover problems. This could potentially cause other problems in yourr network. + 0 + 0 + + + {Template pfSense Active:system.uname.diff(0)}>0 0 @@ -5392,7 +5467,7 @@ or 0 1 - Notify of new version of packages are available + New version of packages are available 0 0 From 57324cf3a396adc24f64af198fdc223442c0ff8f Mon Sep 17 00:00:00 2001 From: Dan Edwards Date: Fri, 19 Mar 2021 10:35:02 +0000 Subject: [PATCH 15/19] Update pfsense_zbx.php Report correct Phase 1 status on non Carp enabled devices --- pfsense_zbx.php | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 9ba8f14..7bebe51 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -603,8 +603,11 @@ function pfz_ipsec_status($ikeid,$reqid=-1,$valuekey='state'){ } switch($valuekey) { case 'state': - $value = pfz_valuemap('ipsec.state', strtolower($tmp_value)); - $value = $value + (10 * ($carp_status-1)); + if ($carp_status == 0) { + $value = pfz_valuemap('ipsec.state', strtolower($tmp_value)); + } else { + $value = $value + (10 * ($carp_status-1)); + } break; default: $value = $tmp_value; From ba0281f08e94cf5e669c10a9332b946d55f96915 Mon Sep 17 00:00:00 2001 From: f87 <62796525+f87@users.noreply.github.com> Date: Fri, 11 Jun 2021 10:20:13 +0300 Subject: [PATCH 16/19] Update pfsense_zbx.php MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Не выполнялся поиск пользователе на серверах с TLS-Аутентификацией --- pfsense_zbx.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index 7bebe51..d2a4c8b 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -201,7 +201,7 @@ function pfz_openvpn_server_userdiscovery(){ $json_string = '{"data":['; foreach ($servers as $server){ - if ( ($server['mode']=='server_user') || ($server['mode']=='server_tls_user') ) { + if ( ($server['mode']=='server_user') || ($server['mode']=='server_tls_user') || ($server['mode']=='server_tls') ) { if (is_array($server['conns'])) { $name = trim(preg_replace('/\w{3}(\d)?\:\d{4,5}/i', '', $server['name'])); From bb2c2cbe4a77d9f142382376034b146813237463 Mon Sep 17 00:00:00 2001 From: Kent Ickler Date: Fri, 25 Jun 2021 01:38:47 -0600 Subject: [PATCH 17/19] Agent (Type 0) to Active Agent (Type 7) corrected Agent (type 0) to Agent Active (Type 7) On Service Discovery Item Prototypes --- template_pfsense_active.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index 8b76d4b..dca2ea7 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -4486,7 +4486,7 @@ https://github.com/rbicelli/pfsense-zabbix-template Service {#DESCRIPTION} enabled on CARP Slave - 0 + 7 pfsense.value[service_value,{#SERVICE},run_on_carp_slave] @@ -4548,7 +4548,7 @@ https://github.com/rbicelli/pfsense-zabbix-template Service {#DESCRIPTION} Status - 0 + 7 pfsense.value[service_value,{#SERVICE},status] From d18056cf8af33e6993312d8bb86622bc505845c3 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Thu, 1 Jul 2021 22:45:27 +0200 Subject: [PATCH 18/19] Fixed value mapper --- pfsense_zbx.php | 1 + 1 file changed, 1 insertion(+) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index d2a4c8b..bf73e36 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -1007,6 +1007,7 @@ function pfz_valuemap($valuename, $value, $default="0"){ } if (is_array($valuemap)) { + $value = strtolower($value); if (array_key_exists($value, $valuemap)) return $valuemap[$value]; } From 11784220d974dee47bd8ba55235cda3558efdc04 Mon Sep 17 00:00:00 2001 From: Riccardo Bicelli Date: Sun, 4 Jul 2021 21:20:43 +0200 Subject: [PATCH 19/19] Fixed issues #72 and #76 --- pfsense_zbx.php | 6 +++++- template_pfsense_active.xml | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/pfsense_zbx.php b/pfsense_zbx.php index bf73e36..d4f0788 100644 --- a/pfsense_zbx.php +++ b/pfsense_zbx.php @@ -1,7 +1,7 @@ This program is licensed under Apache 2.0 License @@ -569,11 +569,15 @@ function pfz_ipsec_status($ikeid,$reqid=-1,$valuekey='state'){ } if ($ikesa['version'] == 1) { $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00')); + //pfSense 2.5 with conn enumeration like conn100000 + if ( ($ph1idx==false) || ($ph1idx=='')) $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '0000')); $ipsecconnected[$ph1idx] = $ph1idx; } else { if (!ipsec_ikeid_used($con_id)) { // probably a v2 with split connection then $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '00')); + //pfSense 2.5 with conn enumeration like conn100000 + if ( ($ph1idx==false) || ($ph1idx=='')) $ph1idx = substr($con_id, 0, strrpos(substr($con_id, 0, -1), '0000')); $ipsecconnected[$ph1idx] = $ph1idx; } else { $ipsecconnected[$con_id] = $ph1idx = $con_id; diff --git a/template_pfsense_active.xml b/template_pfsense_active.xml index dca2ea7..7b8638a 100644 --- a/template_pfsense_active.xml +++ b/template_pfsense_active.xml @@ -1,7 +1,7 @@ 4.0 - 2021-01-23T15:53:03Z + 2021-07-04T19:16:51Z Templates/Network Devices @@ -2525,7 +2525,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - quantité de mémoire en cours d'utilisation par les processus + Memory used by processes 0 @@ -2704,7 +2704,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - quantité de mémoire utilisée pour mettre des données en cache + amount of memory used to cache data 0 @@ -2763,7 +2763,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - quantité de mémoire complètement libre et prête a être utilisée directement. + amount of memory completely free and ready to be used directly. 0 @@ -2822,7 +2822,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - quantité de mémoire qui contient des données qui ne sont plus utilisées (peut être directement libéré si besoin) + amount of memory that contains data that is no longer used (can be directly freed if needed) 0 @@ -3124,7 +3124,7 @@ https://github.com/rbicelli/pfsense-zabbix-template - quantité de mémoire utilisée par le kernel, ne peut être ni déchargée en swap, ni compressée. + amount of memory used by the kernel, can neither be unloaded in swap, nor compressed. 0 @@ -4479,7 +4479,14 @@ https://github.com/rbicelli/pfsense-zabbix-template 0 - + + + {#SERVICE} + @pfSense service names for discovery + 8 + A + + 30d