Make license information available via SNMP

[sscotter]

Hi,

I recently unintentionally allowed my companies Diladele Web Safety license to expire which resulted in a minor business impact. Looking back through my emails I did received a reminder on Friday 2nd January but obviously missed it.

I do not log into Diladele Web Safety proxy all that often (only to make changes to see why someone can't access something), but if I did I suspect I would have been notified about the license expiring shortly.

I do monitor the the proxy using Zabbix via SNMP. I've snmpwalk'd the output this morning but can't see anything related to license details. I was specifically looking for days left before license expires.. so I could trigger a notification in Zabbix at say 28 days.. then escalate at say 14 days, and again at 7.. to avoid it expiring in future.

Would it be possible expose the license information via SNMP?

Thanks

Steve

[ra-at-diladele-com]

Hello Steve, the SNMP is only implemented in squid where there is no need for a license; we have added Prometheus to wsicap (see https://www.diladele.com/websafety/docs/performance/appliance_exporter/ ) but currently there is no license info. Do you think Zabbix can work with Prometheus? I am not proficient in these technologies so I do not know myself.

[sscotter]

Hi Rafael,

Yeah, I realised after investigating further that the current SNMP was being managed by squid, and there are no options to extend the available OIDs like there is in snmpd for example.

I'm confident Zabbix can digest data available via Prometheus as I monitor a Hashicorp Vault server from Zabbix using Prometheus. I think it would be a good enhancement and I think others would benefit from it.

I have gotten around the issue temporarily by leveraging a local zabbix agent on the proxy host with the following enhancements.

/usr/local/sbin/websafety_license_monitoring.py.. ensure permissions allow execution.

#!/usr/bin/env python3
import ssl
import datetime
import json

def main():
    ssl_date_fmt = r'%b %d %H:%M:%S %Y %Z'
    cert_file_name = "/opt/websafety/etc/license.pem"

    try:
        cert_dict = ssl._ssl._test_decode_cert(cert_file_name)
        serial = cert_dict['serialNumber']
        subject = dict(x[0] for x in cert_dict['subject'])
        issued_to = subject['commonName']
        days_left = (datetime.datetime.strptime(cert_dict['notAfter'], ssl_date_fmt) - datetime.datetime.utcnow()).days
        x = {
           "serial": serial,
           "subject": subject,
           "issued_to": issued_to,
           "days_left": days_left
        }
        print(json.dumps(x, sort_keys=True))

    except Exception as error:
        print("Error decoding certificate: {:}".format(error))


if __name__ == "__main__":
    main()

/etc/zabbix/zabbix_agentd.d/web_safety.conf

UserParameter=websafety.license,/usr/local/sbin/websafety_license_monitoring.py

Zabbix template

zabbix_export:
  version: '7.0'
  template_groups:
    - uuid: 3836640604044bb0a3d045bbad8a7ec5
      name: 'Templates'
  templates:
    - uuid: 15e23ad544f1424380395becf6309290
      template: 'Diladele Web Safety'
      name: 'Diladele Web Safety'
      groups:
        - name: 'Templates'
      items:
        - uuid: 31811d4c83a5440fb0289e3539d0b476
          name: 'Websafety License'
          key: websafety.license
          delay: 1h
          value_type: TEXT
          trends: '0'
        - uuid: 07e6e4485ba94d10872eab3dbe83db8a
          name: 'Websafety License Days Left'
          type: DEPENDENT
          key: websafety.license.days_left
          delay: '0'
          value_type: FLOAT
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.days_left
          master_item:
            key: websafety.license
          triggers:
            - uuid: f90cfdce2c11420e910e63cb3303aef3
              expression: 'last(/Diladele Web Safety/websafety.license.days_left)<=1 and last(/Diladele Web Safety/websafety.license.days_left)>0'
              name: 'Diladele Web Safety license due to expire in less than 1 days'
              priority: DISASTER
            - uuid: 44d371bc867148c1bc4b98f78cf98b35
              expression: 'last(/Diladele Web Safety/websafety.license.days_left)<=7 and last(/Diladele Web Safety/websafety.license.days_left)>1'
              name: 'Diladele Web Safety license due to expire in less than 7 days'
              priority: HIGH
            - uuid: c5a11871fa2347f7bf4510536d0f256e
              expression: 'last(/Diladele Web Safety/websafety.license.days_left)<=14 and last(/Diladele Web Safety/websafety.license.days_left)>7'
              name: 'Diladele Web Safety license due to expire in less than 14 days'
              priority: AVERAGE
            - uuid: 00d1ef9718744e8d95d73ea58fca3d56
              expression: 'last(/Diladele Web Safety/websafety.license.days_left)<=28 and last(/Diladele Web Safety/websafety.license.days_left)>14'
              name: 'Diladele Web Safety license due to expire in less than 28 days'
              priority: WARNING
            - uuid: 91c7cabb9262414797d1bdfbd2705ddd
              expression: 'last(/Diladele Web Safety/websafety.license.days_left)<=0'
              name: 'Diladele Web Safety license has expired'
              priority: DISASTER
        - uuid: 568da043aa4d430685b6cde91a095205
          name: 'Websafety License Issued to'
          type: DEPENDENT
          key: websafety.license.issued_to
          delay: '0'
          value_type: TEXT
          trends: '0'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.issued_to
          master_item:
            key: websafety.license
        - uuid: 1d5ce9e2b4ab4eaebc7c576e8dc520b2
          name: 'Websafety License Serial'
          type: DEPENDENT
          key: websafety.license.serial
          delay: '0'
          value_type: TEXT
          trends: '0'
          preprocessing:
            - type: JSONPATH
              parameters:
                - $.serial
          master_item:
            key: websafety.license
      tags:
        - tag: Application
          value: 'Diladele Web Safety'

I think implementing it via Prometheus would be more elegant, so if it's not too difficult to implement that would be a nice feature to have, then I could roll back my temp fix.

I guess it is now a question of how many people would find the feature useful and is it worthy of the development time?

Kind regards

Steve