One Hat Cyber Team

Edit File: net_listeners.conf

disabled: no

name: 'network listeners'

discover:
  - discoverer: net_listeners
    net_listeners:
      tags: "unknown"

classify:
  - name: "Applications"
    selector: "unknown"
    tags: "-unknown app"
    match:
      - tags: "activemq"
        expr: '{{ and (eq .Port "8161") (eq .Comm "activemq") }}'
      - tags: "apache"
        expr: '{{ and (eq .Port "80" "8080") (eq .Comm "apache" "apache2" "httpd") }}'
      - tags: "apcupsd"
        expr: '{{ or (eq .Port "3551") (eq .Comm "apcupsd") }}'
      - tags: "beanstalk"
        expr: '{{ or (eq .Port "11300") (eq .Comm "beanstalkd") }}'
      - tags: "boinc"
        expr: '{{ and (eq .Port "31416") (eq .Comm "boinc") }}'
      - tags: "bind"
        expr: '{{ and (eq .Port "8653") (eq .Comm "bind" "named") }}'
      - tags: "cassandra"
        expr: '{{ and (eq .Port "7072") (glob .Cmdline "*cassandra*") }}'
      - tags: "ceph"
        expr: '{{ and (eq .Port "8443") (eq .Comm "ceph-mgr") }}'
      - tags: "chrony"
        expr: '{{ and (eq .Port "323") (eq .Comm "chronyd") }}'
      - tags: "clickhouse"
        expr: '{{ and (eq .Port "8123") (eq .Comm "clickhouse-server") }}'
      - tags: "cockroachdb"
        expr: '{{ and (eq .Port "8080") (eq .Comm "cockroach") }}'
      - tags: "consul"
        expr: '{{ and (eq .Port "8500") (eq .Comm "consul") }}'
      - tags: "coredns"
        expr: '{{ and (eq .Port "9153") (eq .Comm "coredns") }}'
      - tags: "couchbase"
        expr: '{{ or (eq .Port "8091") (glob .Cmdline "*couchbase*") }}'
      - tags: "couchdb"
        expr: '{{ or (eq .Port "5984") (glob .Cmdline "*couchdb*") }}'
      - tags: "dnsdist"
        expr: '{{ and (eq .Port "8083") (eq .Comm "dnsdist") }}'
      - tags: "dnsmasq"
        expr: '{{ and (eq .Protocol "UDP") (eq .Port "53") (eq .Comm "dnsmasq") }}'
      - tags: "docker_engine"
        expr: '{{ and (eq .Port "9323") (eq .Comm "dockerd") }}'
      - tags: "dovecot"
        expr: '{{ and (eq .Port "24242") (eq .Comm "dovecot") }}'
      - tags: "elasticsearch"
        expr: '{{ or (eq .Port "9200") (glob .Cmdline "*elasticsearch*" "*opensearch*") }}'
      - tags: "envoy"
        expr: '{{ and (eq .Port "9901") (eq .Comm "envoy") }}'
      - tags: "fluentd"
        expr: '{{ and (eq .Port "24220") (glob .Cmdline "*fluentd*") }}'
      - tags: "freeradius"
        expr: '{{ and (eq .Port "18121") (eq .Comm "freeradius") }}'
      - tags: "gearman"
        expr: '{{ or (eq .Port "4730") (eq .Comm "gearmand") }}'
      - tags: "geth"
        expr: '{{ and (eq .Port "6060") (eq .Comm "geth") }}'
      - tags: "haproxy"
        expr: '{{ and (eq .Port "8404") (eq .Comm "haproxy") }}'
      - tags: "hddtemp"
        expr: '{{ and (eq .Port "7634") (eq .Comm "hddtemp") }}'
      - tags: "hdfs_namenode"
        expr: '{{ and (eq .Port "9870") (eq .Comm "hadoop") }}'
      - tags: "hdfs_datanode"
        expr: '{{ and (eq .Port "9864") (eq .Comm "hadoop") }}'
      - tags: "icecast"
        expr: '{{ and (eq .Port "8000") (eq .Comm "icecast") }}'
      - tags: "ipfs"
        expr: '{{ and (eq .Port "5001") (eq .Comm "ipfs") }}'
      - tags: "kubelet"
        expr: '{{ and (eq .Port "10250" "10255") (eq .Comm "kubelet") }}'
      - tags: "kubeproxy"
        expr: '{{ and (eq .Port "10249") (eq .Comm "kube-proxy") }}'
      - tags: "lighttpd"
        expr: '{{ and (eq .Port "80" "8080") (eq .Comm "lighttpd") }}'
      - tags: "logstash"
        expr: '{{ and (eq .Port "9600") (glob .Cmdline "*logstash*") }}'
      - tags: "maxscale"
        expr: '{{ or (eq .Port "8989") (eq .Comm "maxscale") }}'
      - tags: "memcached"
        expr: '{{ or (eq .Port "11211") (eq .Comm "memcached") }}'
      - tags: "mongodb"
        expr: '{{ or (eq .Port "27017") (eq .Comm "mongod") }}'
      - tags: "monit"
        expr: '{{ or (eq .Port "2812") (eq .Comm "monit") }}'
      - tags: "mysql"
        expr: '{{ or (eq .Port "3306") (eq .Comm "mysqld" "mariadbd") }}'
      - tags: "nats"
        expr: '{{ and (eq .Port "8222") (eq .Comm "nats-server") }}'
      - tags: "nginx"
        expr: '{{ and (eq .Port "80" "8080") (eq .Comm "nginx") }}'
      - tags: "nginxunit"
        expr: '{{ and (eq .Port "8000") (eq .Comm "unit") }}'
      - tags: "ntpd"
        expr: '{{ or (eq .Port "123") (eq .Comm "ntpd") }}'
      - tags: "openldap"
        expr: '{{ eq .Comm "slapd" }}'
      - tags: "openvpn"
        expr: '{{ and (eq .Port "7505") (eq .Comm "openvpn") }}'
      - tags: "oracledb"
        expr: '{{ and (eq .Port "1521" "2484") (eq .Comm "tnslsnr") }}'
      - tags: "pgbouncer"
        expr: '{{ or (eq .Port "6432") (eq .Comm "pgbouncer") }}'
      - tags: "pihole"
        expr: '{{ and (eq .Port "80") (eq .Comm "pihole-FTL") }}'
      - tags: "pika"
        expr: '{{ and (eq .Port "9221") (eq .Comm "pika") }}'
      - tags: "postgres"
        expr: '{{ or (eq .Port "5432") (eq .Comm "postgres") }}'
      - tags: "powerdns"
        expr: '{{ and (eq .Port "8081") (eq .Comm "pdns_server") }}'
      - tags: "powerdns_recursor"
        expr: '{{ and (eq .Port "8081") (eq .Comm "pdns_recursor") }}'
      - tags: "proxysql"
        expr: '{{ or (eq .Port "6032") (eq .Comm "proxysql") }}'
      - tags: "puppet"
        expr: '{{ or (eq .Port "8140") (glob .Cmdline "*puppet-server*") }}'
      - tags: "rabbitmq"
        expr: '{{ or (eq .Port "15672") (glob .Cmdline "*rabbitmq*") }}'
      - tags: "redis"
        expr: '{{ or (eq .Port "6379") (eq .Comm "redis-server") }}'
      - tags: "rethinkdb"
        expr: '{{ and (eq .Port "28015") (eq .Comm "rethinkdb") }}'
      - tags: "riak"
        expr: '{{ and (eq .Port "8098") (glob .Cmdline "*riak*") }}'
      - tags: "rspamd"
        expr: '{{ and (eq .Port "11334") (eq .Comm "rspamd") }}'
      - tags: "squid"
        expr: '{{ and (eq .Port "3128") (eq .Comm "squid") }}'
      - tags: "spigotmc"
        expr: '{{ and (eq .Port "25575") (glob .Cmdline "*spigot*") }}'
      - tags: "supervisord"
        expr: '{{ and (eq .Port "9001") (eq .Comm "supervisord") }}'
      - tags: "tomcat"
        expr: '{{ and (eq .Port "8080") (glob .Cmdline "*tomcat*") }}'
      - tags: "tor"
        expr: '{{ and (eq .Port "9051") (eq .Comm "tor") }}'
      - tags: "traefik"
        expr: '{{ and (eq .Port "80" "8080") (eq .Comm "traefik") }}'
      - tags: "typesense"
        expr: '{{ and (eq .Port "8108") (eq .Comm "typesense-server") }}'
      - tags: "unbound"
        expr: '{{ and (eq .Port "8953") (eq .Comm "unbound") }}'
      - tags: "upsd"
        expr: '{{ or (eq .Port "3493") (eq .Comm "upsd") }}'
      - tags: "uwsgi"
        expr: '{{ and (eq .Port "1717") (eq .Comm "uwsgi") }}'
      - tags: "vernemq"
        expr: '{{ and (eq .Port "8888") (glob .Cmdline "*vernemq*") }}'
      - tags: "yugabytedb"
        expr: '{{ and (eq .Port "7000" "9000" "12000" "13000") (or (glob .Cmdline "*YSQL*") (eq .Comm "yb-master" "yb-tserver")) }}'
      - tags: "zookeeper"
        expr: '{{ or (eq .Port "2181" "2182") (glob .Cmdline "*zookeeper*") }}'
  - name: "Prometheus exporters"
    selector: "unknown"
    tags: "-unknown exporter"
    match:
      - tags: "exporter"
        expr: '{{ or (and (not (empty (promPort .Port))) (not (eq .Comm "docker-proxy"))) (glob .Comm "*exporter*") }}'
compose:
  - name: "Applications"
    selector: "app"
    config:
      - selector: "activemq"
        template: |
          module: activemq
          name: local
          url: http://{{.Address}}
          webadmin: admin
      - selector: "apache"
        template: |
          module: apache
          name: local
          url: http://{{.Address}}/server-status?auto
      - selector: "apcupsd"
        template: |
          module: apcupsd
          name: local_{{.Port}}
          address: {{.Address}}
      - selector: "beanstalk"
        template: |
          module: beanstalk
          name: local
          address: {{.Address}}
      - selector: "bind"
        template: |
          module: bind
          name: local
          url: http://{{.Address}}/json/v1
      - selector: "boinc"
        template: |
          module: boinc
          name: local
          address: {{.Address}}
      - selector: "cassandra"
        template: |
          module: cassandra
          name: local
          url: http://{{.Address}}/metrics
      - selector: "ceph"
        template: |
          module: ceph
          name: local
          url: https://{{.Address}}
      - selector: "chrony"
        template: |
          module: chrony
          name: local
          address: {{.Address}}
      - selector: "clickhouse"
        template: |
          module: clickhouse
          name: local
          url: http://{{.Address}}
      - selector: "cockroachdb"
        template: |
          module: cockroachdb
          name: local
          url: http://{{.Address}}/_status/vars
      - selector: "consul"
        template: |
          module: consul
          name: local
          url: http://{{.Address}}
      - selector: "coredns"
        template: |
          module: coredns
          name: local
          url: http://{{.Address}}/metrics
      - selector: "couchbase"
        template: |
          module: couchbase
          name: local
          url: http://{{.Address}}
      - selector: "couchdb"
        template: |
          module: couchdb
          name: local
          url: http://{{.Address}}
          node: '_local'
      - selector: "dnsdist"
        template: |
          module: dnsdist
          name: local
          url: http://{{.Address}}
          headers:
            X-API-Key: 'dnsdist-api-key'
      - selector: "dnsmasq"
        template: |
          module: dnsmasq
          name: local
          protocol: udp
          address: {{.Address}}
      - selector: "docker_engine"
        template: |
          module: docker_engine
          name: local
          url: http://{{.Address}}/metrics
      - selector: "dovecot"
        template: |
          module: dovecot
          name: local
          address: {{.Address}}
      - selector: "elasticsearch"
        template: |
          module: elasticsearch
          name: local
          {{ if glob .Cmdline "*elastic*" -}}
          url: http://{{.Address}}
          {{ else -}}
          url: https://{{.Address}}
          tls_skip_verify: yes
          username: admin
          password: admin
          {{ end -}}
      - selector: "envoy"
        template: |
          module: envoy
          name: local
          url: http://{{.Address}}/stats/prometheus
      - selector: "envoy"
        template: |
          module: envoy
          name: local
          url: http://{{.Address}}/stats/prometheus
      - selector: "fluentd"
        template: |
          module: fluentd
          name: local
          url: http://{{.Address}}
      - selector: "freeradius"
        template: |
          module: freeradius
          name: local
          address: {{.IPAddress}}
          port: {{.Port}}
          secret: adminsecret
      - selector: "gearman"
        template: |
          module: gearman
          name: local
          address: {{.Address}}
      - selector: "geth"
        template: |
          module: geth
          name: local
          url: http://{{.Address}}/debug/metrics/prometheus
      - selector: "haproxy"
        template: |
          module: haproxy
          name: local
          url: http://{{.Address}}/metrics
      - selector: "hddtemp"
        template: |
          module: hddtemp
          name: local
          address: {{.Address}}
      - selector: "hdfs_namenode"
        template: |
          module: hdfs
          name: namenode_local
          url: http://{{.Address}}/jmx
      - selector: "hdfs_datanode"
        template: |
          module: hdfs
          name: datanode_local
          url: http://{{.Address}}/jmx
      - selector: "icecast"
        template: |
          module: icecast
          name: local
          url: http://{{.Address}}
      - selector: "ipfs"
        template: |
          module: ipfs
          name: local
          url: http://{{.Address}}
      - selector: "kubelet"
        template: |
          module: k8s_kubelet
          name: local
          {{- if eq .Port "10255" }}
          url: http://{{.Address}}/metrics
          {{- else }}
          url: https://{{.Address}}/metrics
          tls_skip_verify: yes
          {{- end }}
      - selector: "kubeproxy"
        template: |
          module: k8s_kubeproxy
          name: local
          url: http://{{.Address}}/metrics
      - selector: "lighttpd"
        template: |
          module: lighttpd
          name: local
          url: http://{{.Address}}/server-status?auto
      - selector: "logstash"
        template: |
          module: logstash
          name: local
          url: http://{{.Address}}
      - selector: "maxscale"
        template: |
          module: maxscale
          name: local
          url: http://{{.Address}}
      - selector: "memcached"
        template: |
          module: memcached
          name: local
          address: {{.Address}}
      - selector: "mongodb"
        template: |
          module: mongodb
          name: local
          uri: mongodb://{{.Address}}
      - selector: "monit"
        template: |
          module: monit
          name: local
          url: http://{{.Address}}
          username: admin
          password: monit
      - selector: "mysql"
        template: |
          - module: mysql
            name: local
            dsn: netdata@unix(/var/run/mysqld/mysqld.sock)/
          - module: mysql
            name: local
            dsn: netdata@tcp({{.Address}})/
      - selector: "nats"
        template: |
          - module: nats
            name: local
            url: http://{{.Address}}
      - selector: "nginx"
        template: |
          - module: nginx
            name: local
            url: http://{{.Address}}/stub_status
          - module: nginx
            name: local
            url: http://{{.Address}}/basic_status
          - module: nginx
            name: local
            url: http://{{.Address}}/nginx_status
          - module: nginx
            name: local
            url: http://{{.Address}}/status
      - selector: "nginxunit"
        template: |
          - module: nginxunit
            name: local
            url: http://{{.Address}}
      - selector: "ntpd"
        template: |
          module: ntpd
          name: local
          address: {{.Address}}
          collect_peers: no
      - selector: "openldap"
        template: |
          module: openldap
          name: local
          url: ldap://{{.Address}}
      - selector: "openvpn"
        template: |
          module: openvpn
          name: local
          address: {{.Address}}
      - selector: "oracledb"
        template: |
          module: oracledb
          name: local
          {{ if eq .Port "1521" -}}
          dsn: 'oracle://username:password@{{.Address}}/XE'
          {{ else -}}
          dsn: 'oracle://username:password@{{.Address}}/XE?ssl=true&ssl verify=false'
          {{ end -}}
      - selector: "pgbouncer"
        template: |
          module: pgbouncer
          name: local
          dsn: postgres://netdata:postgres@{{.Address}}/pgbouncer
      - selector: "pihole"
        template: |
          module: pihole
          name: local
          url: http://{{.Address}}
      - selector: "pika"
        template: |
          module: pika
          name: local
          address: redis://@{{.IPAddress}}:{{.Port}}
      - selector: "rethinkdb"
        template: |
          module: rethinkdb
          name: local
          address: {{.Address}}
      - selector: "riak"
        template: |
          module: riakkv
          name: local
          url: http://{{.Address}}/stats
      - selector: "rspamd"
        template: |
          module: rspamd
          name: local
          url: http://{{.Address}}
      - selector: "postgres"
        template: |
          - module: postgres
            name: local
            dsn: 'host=/var/run/postgresql dbname=postgres user=postgres'
          - module: postgres
            name: local
            dsn: 'host=/var/run/postgresql dbname=postgres user=netdata'
          - module: postgres
            name: local
            dsn: postgresql://netdata@{{.Address}}/postgres
      - selector: "powerdns"
        template: |
          module: powerdns
          name: local
          url: http://{{.Address}}
          headers:
            X-API-KEY: secret
      - selector: "powerdns_recursor"
        template: |
          module: powerdns_recursor
          name: local
          url: http://{{.Address}}
          headers:
            X-API-KEY: secret
      - selector: "proxysql"
        template: |
          module: proxysql
          name: local
          dsn: stats:stats@tcp({{.Address}})/
      - selector: "puppet"
        template: |
          module: puppet
          name: local
          url: https://{{.Address}}
          tls_skip_verify: yes
      - selector: "rabbitmq"
        template: |
          module: rabbitmq
          name: local
          url: http://{{.Address}}
          username: guest
          password: guest
          collect_queues_metrics: no
      - selector: "redis"
        template: |
          module: redis
          name: local
          address: redis://@{{.Address}}
      - selector: "squid"
        template: |
          module: squid
          name: local
          url: http://{{.Address}}
      - selector: "spigotmc"
        template: |
          module: spigotmc
          name: local
          address: {{.Address}}
      - selector: "supervisord"
        template: |
          module: supervisord
          name: local
          url: http://{{.Address}}/RPC2
      - selector: "traefik"
        template: |
          module: traefik
          name: local
          url: http://{{.Address}}/metrics
      - selector: "typesense"
        template: |
          module: typesense
          name: local
          url: http://{{.Address}}
          api_key: {{ trimPrefix "--api-key=" (regexFind "--api-key=[^ ]+" .Cmdline) -}}
      - selector: "tomcat"
        template: |
          module: tomcat
          name: local
          url: http://{{.Address}}
      - selector: "tor"
        template: |
          module: tor
          name: local
          address: {{.Address}}
      - selector: "unbound"
        template: |
          module: unbound
          name: local
          address: {{.Address}}
      - selector: "upsd"
        template: |
          module: upsd
          name: local
          address: {{.Address}}
      - selector: "uwsgi"
        template: |
          module: uwsgi
          name: local
          address: {{.Address}}
      - selector: "vernemq"
        template: |
          module: vernemq
          name: local
          url: http://{{.Address}}/metrics
      - selector: "yugabytedb"
        template: |
          - module: yugabytedb
            {{ if eq .Port "7000" -}}
            name: local_master
            {{ else if eq .Port "9000" -}}
            name: local_tserver
            {{ else if eq .Port "12000" -}}
            name: local_ycql
            {{ else if eq .Port "13000" -}}
            name: local_ysql
            {{ else -}}
            name: local
            {{ end }}
            url: http://{{.Address}}/prometheus-metrics
      - selector: "zookeeper"
        template: |
          module: zookeeper
          name: local
          address: {{.Address}}

- name: "Prometheus exporters generic"
    selector: "exporter"
    config:
      - selector: "exporter"
        template: |
          {{ $name := promPort .Port -}}
          {{ if empty $name -}}
          {{ $name = printf "%s_%s" .Comm .Port -}}
          {{ end -}}
          module: prometheus
          name: {{$name}}_local
          url: http://{{.Address}}/metrics
          {{ if eq $name "caddy" -}}
          expected_prefix: 'caddy_'
          {{ else if eq $name "openethereum" -}}
          expected_prefix: 'blockchaincache_'
          {{ else if eq $name "crowdsec" -}}
          expected_prefix: 'cs_'
          {{ else if eq $name "netbox" -}}
          expected_prefix: 'django_'
          {{ else if eq $name "traefik" -}}
          expected_prefix: 'traefik_'
          {{ else if eq $name "pushgateway" -}}
          expected_prefix: 'pushgateway_'
          selector:
            allow:
              - pushgateway_*
          {{ else if eq $name "wireguard_exporter" -}}
          expected_prefix: 'wireguard_exporter'
          {{ else if eq $name "clickhouse" -}}
          max_time_series: 3000
          {{ end -}}