@daemonitor/plugins 1.1.11 → 1.1.13

package/dist/plugins/index.js

@@ -8,6 +8,7 @@ import { createWordpressPlugin } from "./monitoring/WordpressPlugin";
 import { createLogWatchPlugin } from "./monitoring/LogWatchPlugin";
 import { createNetScanPlugin } from "./monitoring/NetScanPlugin";
 import { createSnmpPlugin } from "./monitoring/SnmpPlugin";
+import { createThreeCXPlugin } from "./monitoring/ThreeCXPlugin";
 // In future, implement other plugin factory functions using the same pattern
 // import { createOSPlugin } from "./monitoring/OSPlugin"
 // import { createMongoDBPlugin } from "./monitoring/MongoDBPlugin"
@@ -27,6 +28,7 @@ export default {
     Logwatch: createLogWatchPlugin,
     Netscan: createNetScanPlugin,
     Snmp: createSnmpPlugin,
+    ThreeCX: createThreeCXPlugin,
     // CloudflarePlugin: createCloudflarePlugin,
     // EwelinkPlugin: createEwelinkPlugin,
     // MongoDBPlugin: createMongoDBPlugin,

package/dist/plugins/monitoring/SnmpPlugin.js

@@ -258,9 +258,25 @@ async function collectQnap(t) {
         // Only a truly empty bay (no model AND no capacity) is skipped.
         if (!model && !capacity)
             continue;
-        const status = cSt[i] != null ? Number(cSt[i]) : undefined;
+        let status = cSt[i] != null ? Number(cSt[i]) : undefined;
         const tempC = parseC(cTp[i] || null);
-        disks.push({ slot: Number(i), descr: cDs[i] || undefined, model, capacity, tempC, status, smart: cSm[i] && cSm[i] !== "--" ? cSm[i] : undefined });
+        let smart = cSm[i] && cSm[i] !== "--" ? cSm[i] : undefined;
+        // A present disk MUST carry a health verdict (status or SMART). If the
+        // status/smart column walks came back empty for this row that cycle, the
+        // disk would look healthy purely for lack of a reading — the exact bug that
+        // flips a failing NAS green. Fall back to a targeted per-disk get before
+        // giving up on the row.
+        if (status == null) {
+            const s = await snmpGet(t, DT + "4." + i);
+            if (s != null && s !== "" && !isNaN(Number(s)))
+                status = Number(s);
+        }
+        if (smart == null) {
+            const s = await snmpGet(t, DT + "7." + i);
+            if (s != null && s !== "" && s !== "--")
+                smart = s;
+        }
+        disks.push({ slot: Number(i), descr: cDs[i] || undefined, model, capacity, tempC, status, smart });
     }
     // A reachable QNAP always has ≥1 disk. Zero means the disk-table walks came
     // back empty (agent timed out) — treat as an INCOMPLETE read, not a clean
@@ -268,6 +284,16 @@ async function collectQnap(t) {
     if (!disks.length) {
         return { name: t.name, ip: t.ip, kind: "qnap", reachable: true, error: "SNMP read incomplete — disk table empty" };
     }
+    // Every present disk must have a health verdict after the fallback gets. If
+    // any disk still lacks BOTH a status and a SMART reading, we cannot certify it
+    // — the read is incomplete, so report that rather than a false all-clear.
+    const unverified = disks.filter((d) => d.status == null && d.smart == null);
+    if (unverified.length) {
+        return {
+            name: t.name, ip: t.ip, kind: "qnap", reachable: true,
+            error: `SNMP read incomplete — no health verdict for ${unverified.length} disk(s): ${unverified.map((d) => d.descr || `slot ${d.slot}`).join(", ")}`,
+        };
+    }
     // A present disk is bad only on a real error status, an explicitly-bad SMART
     // verdict, or overheating — not a blank "--" or an empty bay.
     const badDisks = disks.filter((d) => (d.status != null && d.status !== 0) ||

package/dist/plugins/monitoring/ThreeCXPlugin.js

@@ -0,0 +1,221 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { connect } from "node:net";
+import { hostname } from "node:os";
+import { createMonitoringPlugin } from "../../lib/MonitoringPlugin";
+// 3CX PhoneSystem monitor. Runs ON a 3CX appliance (Debian) and watches the
+// signals that actually break a PBX, using only unprivileged, auth-free reads:
+//   - every 3CX* systemd unit is active (a crashed CallFlow/SIP/Media server is
+//     the real failure mode; `systemctl -o json` needs no root)
+//   - the PBX version (dpkg)
+//   - SIP (5060/5061) and the management console (443) are actually listening
+//
+// It deliberately avoids the 3CX management API — that needs a bearer token and
+// per-appliance provisioning; service + port liveness catches an outage without
+// any secret on the box. One client_state per instance, type "3cx".
+//
+// Two roles:
+//   - "pbx" (default): the PhoneSystem — 3CX* services, SIP listeners (5060/5061),
+//     management console (443).
+//   - "sbc": a Session Border Controller — the single 3cxsbc service plus its
+//     OUTBOUND tunnel to the PBX (an established TCP session to the PBX on 5090).
+//     An SBC doesn't listen for SIP locally, so its health is "service up AND
+//     tunnel to the PBX connected", not a listen-probe.
+//
+// Severity is decided server-side (clientstate/update.put.ts): any down service,
+// a dead SIP port, or (SBC) a dropped tunnel → error; console down → warning.
+const pexec = promisify(execFile);
+function slug(s) {
+    return s.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
+}
+// TCP connect probe — a listening SIP/console port answers the handshake.
+function portListening(host, port, timeout = 4000) {
+    return new Promise((resolve) => {
+        const sock = connect({ host, port });
+        let done = false;
+        const finish = (ok) => {
+            if (done)
+                return;
+            done = true;
+            sock.destroy();
+            resolve(ok);
+        };
+        sock.setTimeout(timeout);
+        sock.once("connect", () => finish(true));
+        sock.once("timeout", () => finish(false));
+        sock.once("error", () => finish(false));
+    });
+}
+async function pbxVersion(pkg) {
+    try {
+        const { stdout } = await pexec("dpkg-query", ["-W", "-f=${Version}", pkg], { timeout: 6000 });
+        const v = stdout.trim();
+        return v || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+// SBC tunnel: the SBC keeps an established outbound TCP session to the PBX on the
+// tunnel port (5090). `ss -tn state established` needs no root and its absence is
+// the real "SBC is cut off from the PBX" signal. Returns whether ≥1 such session
+// exists and the PBX peer it points at.
+async function tunnelStatus(port) {
+    try {
+        const { stdout } = await pexec("ss", ["-tn", "state", "established"], { timeout: 6000 });
+        const suffix = `:${port}`;
+        for (const line of stdout.split("\n")) {
+            const cols = line.trim().split(/\s+/);
+            const peer = cols[cols.length - 1]; // "Peer Address:Port" is the last column
+            if (peer && peer.endsWith(suffix)) {
+                return { up: true, peer: peer.slice(0, -suffix.length) };
+            }
+        }
+        return { up: false };
+    }
+    catch {
+        return { up: false };
+    }
+}
+// Inbound tunnels: on the PBX, each connected SBC (and any tunnelled client) holds
+// an established session whose LOCAL port is the tunnel port (5090). Returns the
+// set of distinct peer IPs — matching a configured SBC's edge IP tells us that SBC
+// is still reaching the PBX, observed entirely from the PBX side.
+async function inboundTunnelPeers(port) {
+    try {
+        const { stdout } = await pexec("ss", ["-tn", "state", "established"], { timeout: 6000 });
+        const suffix = `:${port}`;
+        const peers = new Set();
+        for (const line of stdout.split("\n")) {
+            const cols = line.trim().split(/\s+/);
+            if (cols.length < 2)
+                continue;
+            const local = cols[cols.length - 2];
+            const peer = cols[cols.length - 1];
+            if (!local || !local.endsWith(suffix))
+                continue; // only sessions we LISTEN for on :port
+            const ip = peer.replace(/:\d+$/, "").replace(/^\[|\]$/g, "").replace(/^::ffff:/, "");
+            if (ip)
+                peers.add(ip);
+        }
+        return [...peers];
+    }
+    catch {
+        return [];
+    }
+}
+async function collect3cx(inst) {
+    const role = inst.role === "sbc" ? "sbc" : "pbx";
+    const name = inst.name || hostname();
+    const host = inst.host || "127.0.0.1";
+    const unitGlob = inst.unitGlob || (role === "sbc" ? "3cxsbc*" : "3CX*");
+    const versionPkg = inst.versionPkg || (role === "sbc" ? "3cxsbc" : "3cxpbx");
+    const sipPorts = inst.sipPorts && inst.sipPorts.length ? inst.sipPorts : [5060, 5061];
+    const consolePort = inst.consolePort ?? 443;
+    const pbxTunnelPort = inst.pbxTunnelPort ?? 5090;
+    const systemctlBin = inst.systemctlBin || "systemctl";
+    // --- systemd unit health (unprivileged JSON) ---
+    let units = [];
+    let listErr;
+    try {
+        const { stdout } = await pexec(systemctlBin, ["list-units", unitGlob, "--all", "--type=service", "--no-pager", "--no-legend", "-o", "json"], { timeout: 10000 });
+        const parsed = JSON.parse(stdout || "[]");
+        units = (Array.isArray(parsed) ? parsed : []).map((u) => ({
+            unit: String(u.unit || ""),
+            active: String(u.active || ""),
+            sub: String(u.sub || ""),
+        }));
+    }
+    catch (e) {
+        listErr = String(e?.message || e).slice(0, 160);
+    }
+    // A reachable 3CX box always has its service units. Zero units + an error
+    // means we couldn't read systemd at all — report INCOMPLETE, not all-clear,
+    // so a real outage isn't hidden behind a false green.
+    if (!units.length) {
+        return {
+            kind: "3cx", role, name, host, reachable: !listErr,
+            error: listErr ? `systemctl read failed — ${listErr}` : `no ${role === "sbc" ? "3cxsbc" : "3CX"} services found`,
+        };
+    }
+    // A oneshot unit that has run and exited (e.g. 3CXFirewall) reports
+    // active/exited — still "active", so `active === "active"` is the clean
+    // predicate for both long-running and oneshot units.
+    const services = units.map((u) => ({ ...u, ok: u.active === "active" }));
+    const down = services.filter((s) => !s.ok);
+    const version = await pbxVersion(versionPkg);
+    const svcCommon = {
+        kind: "3cx", role, name, host, reachable: true, version,
+        services,
+        servicesTotal: services.length,
+        servicesOk: services.length - down.length,
+        down: down.map((d) => ({ unit: d.unit, active: d.active, sub: d.sub })),
+    };
+    // --- SBC: outbound tunnel to the PBX (no local SIP listener) ---
+    if (role === "sbc") {
+        const tun = await tunnelStatus(pbxTunnelPort);
+        return { ...svcCommon, tunnelUp: tun.up, tunnelPeer: tun.peer, tunnelPort: pbxTunnelPort };
+    }
+    // --- PBX: port liveness ---
+    const sip = await Promise.all(sipPorts.map(async (port) => ({ port, listening: await portListening(host, port) })));
+    const sipOk = sip.every((p) => p.listening);
+    const consoleProbe = { port: consolePort, listening: await portListening(host, consolePort) };
+    // Watch branch SBCs from the PBX side, if any are configured.
+    let sbcs = undefined;
+    let sbcTunnelCount = undefined;
+    if (Array.isArray(inst.sbcs) && inst.sbcs.length) {
+        const peers = await inboundTunnelPeers(pbxTunnelPort);
+        sbcTunnelCount = peers.length;
+        sbcs = inst.sbcs.map((s) => ({
+            name: s.name,
+            peer: s.peer,
+            connected: s.peer ? peers.includes(s.peer) : peers.length > 0,
+        }));
+    }
+    return { ...svcCommon, sip, sipOk, console: consoleProbe, ...(sbcs ? { sbcs, sbcTunnelCount } : {}) };
+}
+export function createThreeCXPlugin() {
+    let refreshTimer = null;
+    const instancesOf = (plugin) => {
+        const cfg = (plugin.config || {});
+        if (Array.isArray(cfg.instances) && cfg.instances.length)
+            return cfg.instances;
+        // No explicit instances → a single on-box instance from the flat config.
+        return [{
+                name: cfg.name && cfg.name !== "3cx" ? cfg.name : undefined,
+                role: cfg.role,
+                host: cfg.host,
+                unitGlob: cfg.unitGlob,
+                versionPkg: cfg.versionPkg,
+                sipPorts: cfg.sipPorts,
+                consolePort: cfg.consolePort,
+                pbxTunnelPort: cfg.pbxTunnelPort,
+                sbcs: cfg.sbcs,
+                systemctlBin: cfg.systemctlBin,
+                uniqueId: cfg.uniqueId,
+            }];
+    };
+    const refreshFn = async (plugin) => {
+        await Promise.all(instancesOf(plugin).map(async (inst) => {
+            const uid = inst.uniqueId || `3cx-${slug(inst.name || hostname())}`;
+            try {
+                const data = await collect3cx(inst);
+                await plugin.send(data, uid);
+            }
+            catch (e) {
+                await plugin.send({ kind: "3cx", name: inst.name || hostname(), reachable: false, error: String(e?.message || e).slice(0, 160) }, uid);
+            }
+        }));
+    };
+    const monitorFn = async (plugin) => {
+        await refreshFn(plugin);
+        refreshTimer = setInterval(() => refreshFn(plugin), plugin.config?.refreshInterval || 60000);
+    };
+    const teardownFn = async () => {
+        if (refreshTimer)
+            clearInterval(refreshTimer);
+        refreshTimer = null;
+    };
+    return createMonitoringPlugin("3cx", "3cx", "3CX PBX monitor (service health, version, SIP/console liveness)", async () => { }, monitorFn, refreshFn, teardownFn);
+}
+export default createThreeCXPlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daemonitor/plugins",
-  "version": "1.1.11",
+  "version": "1.1.13",
   "description": "daemonitor plugins",
   "types": "types/index.d.ts",
   "main": "dist/index.js",