juliusloman / dynatrace-oneagent-plugin-sslcertcheck Goto Github PK

I am not sure if this is an actual issue or would have any effect on the plugin that you have created. But I could not find anything the plugin that sets a max amount of properties for any entity. Was hoping for some insight as to if this is a plugin problem or a Dynatrace problem.

I have also been chatting with Dynatrace help center to see if they have an answer and will update accordingly.

Thank you

When a certificate expiry date is less than the error event, the error description quotes the info event number of days.

e.g. "days_event_info" = "30"
"days_event_error" = "7"

If certificate is expired in 6 days, the problem is opened with the following description:

Certificate expiring in less than 30 days

Line 189 of the source code should use "days_event_error" instead of "days_event_info".

Thank you for sharing the plugin. I've used 1.02 version of plugin.

I followed two steps

1. to add/upload extension -successful

2. to copy/extract the plugin to the following location

[SERVER custom.python.sslcertcheck_plugin]$ pwd

/opt/dynatrace/oneagent/plugin_deployment/custom.python.sslcertcheck_plugin

[SERVER custom.python.sslcertcheck_plugin]$ ll

total 40

drwxrwxr-x 2 root root 4096 Dec 18 17:09 asn1crypto

drwxrwxr-x 2 root root 4096 Dec 18 17:09 asn1crypto-1.4.0.dist-info

-rwxrwxr-x 1 root root 2473 Nov 12 08:56 plugin.json

drwxrwxr-x 3 root root 4096 Dec 18 17:09 pytz

drwxrwxr-x 2 root root 4096 Dec 18 17:09 pytz-2020.4.dist-info

-rw-rw-r-- 1 root root 3336 Nov 12 09:54 README.md

drwxrwxr-x 2 root root 4096 Dec 18 17:09 sslcertcheck_plugin-1.2.dist-info

-rw-rw-r-- 1 root root 11272 Dec 18 17:09 sslcertcheck_plugin.py

Then I've changed the Global Configuration and it showed me the hosts are being correctly monitored initially then shows the following error, I guess its the error due to certificate expiry date falling in the notification/error range but I couldn't get any notification and details. I couldn't find the plugin log file to get any further details. Could you suggest please?

Can you suggest which log file would you need for further analysis please?

Using API V2 metrics
{
metricId: "ext:ssl.certificates_found",
displayName: "Certificates found",
description: "",
unit: "Count"
}

is returning empty

{
totalCount: 0,
nextPageKey: null,
result: [
{
metricId: "ext:ssl.certificates_found",
data: [ ]
}
]
}

and also from Dynatrace UI the custom chart is also empty, as you can see in the attached screenshot below

Hi @juliusloman, this is not much of an issue, but more of a feature request.

We're trying your extesion in our Dynatrace's Managed installation and, since it's on premise, your plugin's checks run from one of our internal servers, on our local internal network, with our local DNS server.

This scenario works just fine up to a point: some of our services are public available, but when accessed from our internal network, the user is redirect to specific servers which are different from the server the outside users (from the internet) are redirected to.

This means that from our internal network, the address "mycompany.com" resolves to a local IP address and specifc internal servers, but the same address from the internet resolves to a public IP and it's hosted on completly different servers. The internal and external servers have different SSL certificates.

Your extension, therefore, only checks for our internal SSL certificates, since it's running in one of our local servers.

There are several ways that we can workaround this (customize your extension, create scripts that populate custom metrics using Dynatrace API, etc), but I wonder if you would consider support using specific DNS servers for specific websites on your extension.

This feature would resolve our issue since by changing the DNS server used to resolve the "mycompany.com" from our internal DNS server to a public one, it would then resolve to the real public IP address and therefore it would be redirected to our external webservers.

Error showing on Dynatrace UI after extracting the zip file inside the one-agent deployment folder on a Windows Machine and checking on Dynatrace UI - Error (common_name)

RuntimeError: dictionary changed size during iteration

OneAgent
Version 1.195.161

Plugin
Version 1.01

OS
Linux xxxxx.com 2.6.32-754.30.2.el6.x86_64 #1 SMP Fri May 29 04:45:43 EDT 2020 x86_64 x86_64 x86_64 GNU/Linux

That then changed to...

Log
RuntimeError: dictionary changed size during iteration

2020-07-29 14:38:54.998 UTC [5a7b780f] info    [native] 139703919249152(MainThread) - [report_status] status changed for engine ('custom.python.sslcertcheck_plugin', 7579246905101042689) PluginFullStatus(pluginName=custom.python.sslcertcheck_plugin, pluginVersion=1.01, state=ERROR_UNKNOWN, description=dictionary changed size during iteration, monitoredEntityId=0x692ee4e75386c401, stacktrace=Traceback (most recent call last):
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/plugin_state_machine.py", line 340, in _execute_next_task
     self._query_plugin()
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/plugin_state_machine.py", line 672, in _query_plugin
     self._plugin_run_data.plugin_instance._query_internal(**self._plugin_run_data.plugin_args)
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/api/base_plugin.py", line 455, in _query_internal
     return self.query(**kwargs)
   File "/opt/dynatrace/oneagent/plugin_deployment/custom.python.sslcertcheck_plugin/sslcertcheck_plugin.py", line 136, in query
     for binding in self.sslinfo:
 RuntimeError: dictionary changed size during iteration
 )

KeyError: 'common_name'

('custom.python.sslcertcheck_plugin', 7579246905101042689): (PluginFullStatus(pluginName=custom.python.sslce
rtcheck_plugin, pluginVersion=1.01, state=ERROR_UNKNOWN, description=common_name, monitoredEntityId=0x692ee4e75386c401, stacktrace=
Traceback (most recent call last):
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/plugin_state_machine.py", line 340, in _execute_next_task
     self._query_plugin()
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/plugin_state_machine.py", line 672, in _query_plugin
     self._plugin_run_data.plugin_instance._query_internal(**self._plugin_run_data.plugin_args)
   File "/var/lib/dynatrace/oneagent/agent/runtime/engine_unpacked/ruxit/api/base_plugin.py", line 455, in _query_internal
     return self.query(**kwargs)
   File "/opt/dynatrace/oneagent/plugin_deployment/custom.python.sslcertcheck_plugin/sslcertcheck_plugin.py", line 148, in query
     sub=cert['subject'].native['common_name'],
 KeyError: 'common_name'

When installing the SSL certificate check, I can see a Dynatrace notification about DDU consumption. When I looked at the DDU page, I could not find the SSL cert check consuming any DDU's. I was wondering if this was a fluke or if DDU's are actually being consumes and how I could see the consumption rates.

The Problem created status becomes 'Resolved' after few mins even though actually the issue is not resolved.

Hi Julius,

I am able to get the certs info for the SSL certs but not for key stores. Do you have any script that captures Keystore expiry dates as well?

Thanks,

Ketan

I had set the "Interval between checks (hours)" to 24 to check once a day, but it seems that the same Certificate is creating an event every 30 seconds. I am still looking at the python file to see if I can find why, but I was hoping you could give me some insight as to why this is happening?

Thank you

Error (No module named 'asn1crypto') for Myservername.
Using windows server 2012

The link to the releases page in the Installation section is not working. It points to https://github.com/juliusloman/dynatrace-oneagent-plugin-sslcertcheck/blob/master/releases, but I think this should be https://github.com/juliusloman/dynatrace-oneagent-plugin-sslcertcheck/releases.