1. Zabbix¶

Zabbix is an open source monitoring solution for network monitoring and application monitoring of millions of metrics.

Tip

1.1. Zabbix templates and scripts¶

The following script has been contributed by Region Nordjylland.

Important

The script has been created as a template for Zabbix, that uses the TrustView API to monitor CRLs and alert you when they are about to expire. This way, you can avoid having to log into TrustView or keep an eye on emails constantly.

Zabbix TrustView API - Certificate Revocation List

1.2. Importing the template¶

In Zabbix, go to Data collection Templates Import and select the downloaded .yaml file. Once imported, link the template to the host that should poll TrustView, then set the following macros - either on the template itself or as a per-host override:

{$TRUSTVIEW.URL} - the URL of your TrustView instance

{$TRUSTVIEW.API.KEY} - an API key created in TrustView, with permission to read monitored CRLs

{$TRUSTVIEW.EXPIRY.AFTER} - only CRLs expiring after this date are returned, in yyyy-mm-dd format

Important

{$TRUSTVIEW.EXPIRY.AFTER} is used by the template’s HTTP item but is not itself declared as a template macro with a default value - you must add it yourself (on the template or the host), otherwise the request is sent with the literal, unresolved macro name and TrustView will not filter by expiry as intended. Since the value is a fixed date rather than a rolling window, it needs to be updated from time to time to keep matching CRLs coming.

Two more macros control the warning and critical thresholds for the built-in triggers:

{$TRUSTVIEW.CRL.EXPIRY.WARN} - default 10d

{$TRUESTVIEW.CRL.EXPIRY.CRIT} - default 5d

Note

The critical-threshold macro is misspelled TRUESTVIEW (not TRUSTVIEW) in the shipped template - the trigger expression uses that same misspelling, so set the value on {$TRUESTVIEW.CRL.EXPIRY.CRIT} exactly as shown, rather than the corrected spelling, unless you also fix it consistently in your own copy of the template.