监控SSL证书

添加监控项

[root@10 prometheus]# vim prometheus.yml
rule_files:
 - "ssl_expiry.rules.yml" ###添加监控规则
  - job_name: 'blackbox'
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
    - targets:
       - https://www.centoscn.cn
    relabel_configs:
     - source_labels: [__address__]
       target_label: __param_target
     - source_labels: [__param_target]
       target_label: instance
     - target_label: __address__
	 replacement: 10.11.0.217:9115

添加规则

[root@10 prometheus]# vim ssl_expiry.rules.yml
groups:
  - name: ssl_expiry.rules
    rules:
      - alert: SSLCertExpiringSoon
        expr: probe_ssl_earliest_cert_expiry{job="blackbox"} - time() < 86400 * 30
        for: 10m

添加报警规则

[root@10 prometheus]# vim first_rules.yml
 
- name: 证书还有30天过期
  rules:
  - alert: SslCertificateWillExpireSoon
    expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 30
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "SSL certificate will expire soon (instance {{ $labels.instance }})"
      description: "SSL certificate expires in 30 days\n  VALUE = {{ $value }}\n  LABELS: {{ $labels }}"
- name: 证书已过期
  rules:
  - alert: SslCertificateExpired
    expr: probe_ssl_earliest_cert_expiry - time()  <= 0
    for: 5m
    labels:
      severity: error
    annotations:
      summary: "SSL certificate expired (instance {{ $labels.instance }})"
      description: "SSL certificate has expired already\n  VALUE = {{ $value }}\n  LABELS: {{ $labels }}"

检查配置文件，加载服务。

[root@10 prometheus]# ./promtool check config prometheus.yml
Checking prometheus.yml
  SUCCESS: 2 rule files found
 
Checking first_rules.yml
  SUCCESS: 17 rules found
 
Checking ssl_expiry.rules.yml
  SUCCESS: 1 rules found
 
[root@10 prometheus]# systemctl reload prometheus
[root@10 prometheus]# systemctl restart alertmanager.service

钉钉报警