Nagios / Icinga checks

The scripts in this directory use the authenticated RustProxy administration API. They do not read the SQLite database and do not require access to the proxy process.

Checks

check_rustproxy_api — administration API response time and availability.
check_rustproxy_backends — unavailable/checking backends for all vhosts or selected --pool vhost IDs.
check_rustproxy_latency — the highest current backend EWMA/check latency.
check_rustproxy_queues — dropped live-log records and dropped cold-cache queue work.

All scripts follow the Nagios plugin exit codes (0 OK, 1 WARNING, 2 CRITICAL, 3 UNKNOWN) and expose performance data after |.

Authentication

Use the HTTPS administration hostname that is already allowed by RustProxy. For frequent checks, persist the browser session so Nagios does not create a new session on every probe:

export RUSTPROXY_NAGIOS_USER='nagios'
export RUSTPROXY_NAGIOS_PASSWORD='replace-me'
install -d -m 0700 /var/lib/nagios/rustproxy
./nagios/check_rustproxy_api \
  --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies

The cookie file is written with mode 0600. Keep the password environment variable in a root/Nagios-readable service environment, not on the command line. Once a valid cookie exists, it is reused until RustProxy expires or revokes the session.

For an internal CA, use --ca-file /path/to/ca.pem. --insecure is intended only for temporary diagnostics.

Examples

# API warning at 150 ms, critical at 500 ms
./nagios/check_rustproxy_api --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning-ms 150 --critical-ms 500

# Any backend currently down is CRITICAL; checking/unknown is WARNING
./nagios/check_rustproxy_backends --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies

# Only one vhost/backend pool
./nagios/check_rustproxy_backends --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies --pool app-example

# Slowest backend warning/critical thresholds
./nagios/check_rustproxy_latency --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning-ms 500 --critical-ms 1500

# Cumulative dropped-work counters
./nagios/check_rustproxy_queues --url https://proxy-admin.example.net \
  --cookie-file /var/lib/nagios/rustproxy/session.cookies \
  --warning 1 --critical 20

The status API identifies backend pools by vhost ID. Disabled and draining members are intentionally ignored by availability and latency checks.