Page 1 of 1

Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 9:28 am
by emartine
I was just told that one of our Proofpoint systems experienced a queue issue last night and I was asked to monitoring the queues on these appliances. I have not been able to find any docs on how to monitor proofpoint devices. Anyone know of any snmp checks that can be done?

Re: Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 9:32 am
by mcapra
Is your use case covered by an API call?

https://help.proofpoint.com/Threat_Insi ... umentation

Re: Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 11:16 am
by emartine
Why do you ask?

Re: Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 11:24 am
by mcapra
If there was an API call that returned the metric you're looking for, or something you could use to extrapolate out for what you wanted, it probably wouldn't be that tricky to build a plugin around it.

That and I've been unable to find much documentation about comparable CLI tools or what queuing mechanism they use on the back-end.

Re: Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 11:25 am
by tmcdonald
APIs are a great way to monitor something, as they generally have solid documentation, authentication, and sometimes parameters you can set. SNMP, while widely available, is not always an option, and lacks a lot of the flexibility that an API provides. If Proofpoint exposes metrics over an API, it is fairly trivial to write a plugin that can use it.

Edit: @mcapra beat me to it.

Re: Monitoring Proofpoint appliances

Posted: Tue Jun 12, 2018 4:22 pm
by emartine
Are there examples out there I can use that would help create an API plugin?

Re: Monitoring Proofpoint appliances

Posted: Wed Jun 13, 2018 8:40 am
by mcapra
This plugin allows you to check JSON attributes generically which is useful if the condition you're evaluating is held in a single JSON attribute returned by a REST API call:
https://exchange.nagios.org/directory/P ... s)/details

If you had a convenient "queue" object returned by a REST API call (maybe something like this):

Code: Select all

{
	"name":"My Great Queue",
	"metrics": {
		"queued":20000,
		"state":"waiting"
	}
}
The check_json plugin is probably appropriate if you want to check how large the "queued" attribute is or what the value of "state" is.

Here's one I wrote a while back that leverages the Nagios Log Server API (more so the ElasticSearch API) to monitor the command subsystem within Nagios Log Server:
https://github.com/mcapra/nagios-check_ ... mmands.php

Re: Monitoring Proofpoint appliances

Posted: Wed Jun 13, 2018 10:23 am
by scottwilkerson
Thanks again @mcapra