Monitor SSL certs using Prometheus and Black Box exporter

Monitor SSL certs using Prometheus and Black Box exporter

BlackBox Exporter: Prometheus Blackbox Exporter is a vital tool for any organization that monitors external services such as HTTP, DNS, TCP, ICMP, and more. With Prometheus Blackbox Exporter, you can effortlessly collect metrics about the health and performance of your external services and integrate them into your monitoring system.

Let’s begin monitoring some sample URLs:

Samples:

https://github.com

https://www.google.com/

https://hashnode.com/

http://www.localhost:3000

BlackBox Exporter Installation

  1. To install the blackbox exporter Download the binary file, which can be found here, extract and navigate to the extracted directory.

    Download the binary file using your OS’s architecture. To know this execute this command on the terminal uname -a

    You will see something like this

    In my case my Linux os had 64 bit ARM archiecture. So I downloaded it using the link in the command

     wget https://github.com/prometheus/blackbox_exporter/releases/download/v0.25.0/blackbox_exporter-0.25.0.linux-arm64.tar.gz
     tar -xvzf blackbox_exporter-linux-amd64.tar.gz
     cd blackbox_exporter-*
    
  2. Then start the black-box exporter using this command ./blackbox_exporter --config.file=blackbox.yml when you run it. It listens on port 9115

  3. Validate this by putting localhost:9115 it is in your favourite browser

  4. Configure Prometheus for Blackbox Exporter Update the prometheus.yml file to scrape metrics from the Blackbox Exporter.

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']
  # Add more scrape configurations as needed for other exporters or targets
  - job_name: 'blackbox'
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
      - targets:
          - https://github.com/
          - https://hashnode.com/
          - https://www.google.com/
          - http://www.localhost:3000
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: localhost:9115  # Blackbox Exporter addres
  1. After updating the prometheus.yml restart it sudo systemctl restart promethus Wait for some time (5 to 10 mins) to scrape the metrics from the black box to Prometheus.

  2. Hit this URL in the browser http://localhost:9090/targets this is prometheus's endpoint, you should see the blackbox targets in it. The state is up which means the black exporter is running perfectly.

    Also, We can query this probe_ssl_earliest_cert_expiry metrics to see the proper scraping from the black-exporter.

    Building dashboard

    It’s straightforward, download any black box Garfana dashboard from Google and import it into Grafana. I am using this one.

    • https://grafana.com/grafana/dashboards/13659-blackbox-exporter-http-prober/

      Run black box exporter as Service

        1. Create a systemd service file at sduo vi /etc/systemd/system/blackbox_exporter.service

             [Unit]
             Description=Prometheus Blackbox Exporter
             Wants=network-online.target
             After=network-online.target
          
             [Service]
             User=blackbox
             Group=blackbox
             Type=simple
             ExecStart=/usr/local/bin/blackbox/blackbox_exporter --config.file=/usr/local/bin/blackbox/blackbox.yml
             Restart=on-failure
          
             [Install]
             WantedBy=multi-user.target
          
          1. Create a blackbox user and assign the appropriate permissions.

            sudo useradd --no-create-home --shell /bin/false blackbox
            sudo chown -R blackbox:blackbox /usr/local/bin/blackbox/
            sudo chmod -R 777 /usr/local/bin/blackbox/
            
          2. Reload systemd to recognize the new service:

            sudo systemctl daemon-reload
            
          3. Enable the service to start on boot:

            sudo systemctl enable blackbox_exporter
            
          4. Start the service:

            sudo systemctl start blackbox_exporter
            
          5. Check the service status:

            sudo systemctl status blackbox_exporter
            

References:

.