checks/fortigate_signatures

   1 #!/usr/bin/python
   2 # -*- encoding: utf-8; py-indent-offset: 4 -*-
   3 # +------------------------------------------------------------------+
   4 # |             ____ _               _        __  __ _  __           |
   5 # |            / ___| |__   ___  ___| | __   |  \/  | |/ /           |
   6 # |           | |   | '_ \ / _ \/ __| |/ /   | |\/| | ' /            |
   7 # |           | |___| | | |  __/ (__|   <    | |  | | . \            |
   8 # |            \____|_| |_|\___|\___|_|\_\___|_|  |_|_|\_\           |
   9 # |                                                                  |
  10 # | Copyright Mathias Kettner 2016             mk@mathias-kettner.de |
  11 # +------------------------------------------------------------------+
  12 #
  13 # This file is part of Check_MK.
  14 # The official homepage is at http://mathias-kettner.de/check_mk.
  15 #
  16 # check_mk is free software;  you can redistribute it and/or modify it
  17 # under the  terms of the  GNU General Public License  as published by
  18 # the Free Software Foundation in version 2.  check_mk is  distributed
  19 # in the hope that it will be useful, but WITHOUT ANY WARRANTY;  with-
  20 # out even the implied warranty of  MERCHANTABILITY  or  FITNESS FOR A
  21 # PARTICULAR PURPOSE. See the  GNU General Public License for more de-
  22 # tails. You should have  received  a copy of the  GNU  General Public
  23 # License along with GNU Make; see the file  COPYING.  If  not,  write
  24 # to the Free Software Foundation, Inc., 51 Franklin St,  Fifth Floor,
  25 # Boston, MA 02110-1301 USA.
  26
  27 # .1.3.6.1.4.1.12356.101.4.2.1.0 27.00768(2015-09-01 15:10)
  28 # .1.3.6.1.4.1.12356.101.4.2.2.0 6.00689(2015-09-01 00:15)
  29
  30 # signature ages (defaults are 1/2 days)
  31 factory_settings['fortigate_signature_default_levels'] = {
  32     'av_age': (86400, 172800),
  33     'ips_age': (86400, 172800),
  34 }
  35
  36
  37 def parse_fortigate_signatures(info):
  38     def parse_version(ver):
  39         # sample: 27.00768(2015-09-01 15:10)
  40         ver_regex = regex(r"([0-9.]*)\(([0-9-: ]*)\)")
  41         match = ver_regex.match(ver)
  42         if match is None:
  43             return None, None
  44         # what timezone is this in?
  45         t = time.strptime(match.group(2), "%Y-%m-%d %H:%S")
  46         ts = time.mktime(t)
  47         return match.group(1), time.time() - ts
  48
  49     parsed = []
  50     for (key, title), value in zip([("av_age", "AV"), ("ips_age", "IPS"),
  51                                     ("av_ext_age", "AV extended"), ("ips_ext_age", "IPS extended")],
  52                                    info[0]):
  53         version, age = parse_version(value)
  54         parsed.append((key, title, version, age))
  55     return parsed
  56
  57
  58 def inventory_fortigate_signatures(parsed):
  59     if parsed:
  60         return [(None, {})]
  61
  62
  63 def check_fortigate_signatures(_no_item, params, parsed):
  64     for key, title, version, age in parsed:
  65         if age is None:
  66             continue
  67         infotext = "[%s] %s age: %s" % (version, title, get_age_human_readable(age))
  68         state = 0
  69         levels = params.get(key)
  70         if levels is not None:
  71             warn, crit = levels
  72             if crit is not None and age >= crit:
  73                 state = 2
  74             elif warn is not None and age >= warn:
  75                 state = 1
  76             if state:
  77                 infotext += " (warn/crit at %s/%s)" % (get_age_human_readable(warn),
  78                                                        get_age_human_readable(crit))
  79         yield state, infotext
  80
  81
  82 check_info['fortigate_signatures'] = {
  83     'parse_function': parse_fortigate_signatures,
  84     'inventory_function': inventory_fortigate_signatures,
  85     'check_function': check_fortigate_signatures,
  86     'service_description': "Signatures",
  87     'snmp_scan_function': lambda oid: ".1.3.6.1.4.1.12356.101.1" in oid(".1.3.6.1.2.1.1.2.0"),
  88     'snmp_info': (
  89         ".1.3.6.1.4.1.12356.101.4.2",
  90         [
  91             "1",  # FORTINET-FORTIGATE-MIB::fgSysVersionAv
  92             "2",  # FORTINET-FORTIGATE-MIB::fgSysVersionIps
  93             "3",  # FORTINET-FORTIGATE-MIB::fgSysVersionAvEt
  94             "4",  # FORTINET-FORTIGATE-MIB::fgSysVersionIpsEt
  95         ]),
  96     'default_levels_variable': "fortigate_signature_default_levels",
  97     'group': 'fortinet_signatures'
  98 }