dsa-nagios-checks/checks/dsa-check-soas

   1 #!/usr/bin/ruby
   2
   3 # Copyright 2006, 2012 Peter Palfrader
   4 #           2012  Uli Martens
   5 #
   6 # Permission is hereby granted, free of charge, to any person obtaining
   7 # a copy of this software and associated documentation files (the
   8 # "Software"), to deal in the Software without restriction, including
   9 # without limitation the rights to use, copy, modify, merge, publish,
  10 # distribute, sublicense, and/or sell copies of the Software, and to
  11 # permit persons to whom the Software is furnished to do so, subject to
  12 # the following conditions:
  13 #
  14 # The above copyright notice and this permission notice shall be
  15 # included in all copies or substantial portions of the Software.
  16 #
  17 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  18 # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  19 # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  20 # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  21 # LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  22 # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  23 # WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  24
  25 require 'ipaddr'
  26 require 'resolv'
  27 require 'optparse'
  28 require 'yaml'
  29
  30 NAGIOS_STATUS = { :OK => 0, :WARNING => 1, :CRITICAL => 2, :UNKNOWN => -1 };
  31 @verbose = 0;
  32 @additional_nameservers = []
  33 @check_soa_nameservers = true;
  34
  35 def show_help(parser, code=0, io=STDOUT)
  36   program_name = File.basename($0, '.*')
  37   io.puts "Usage: #{program_name} [options] <domainname> [<domainname> ...]"
  38   io.puts parser.summarize
  39   exit(code)
  40 end
  41 ARGV.options do |opts|
  42         opts.on_tail("-h", "--help" , "Display this help screen")                               { show_help(opts) }
  43         opts.on("-v", "--verbose"   , String, "Be verbose")                                     { @verbose += 1 }
  44         opts.on("-a", "--add=HOST"  , String, "Also check SOA on <nameserver>")                 { |val| @additional_nameservers << val }
  45         opts.on("-n", "--no-soa-ns" , String, "Don't query SOA record for list of nameservers") { @check_soa_nameservers = false }
  46         opts.parse!
  47 end
  48 show_help(ARGV.options, 1, STDERR) if ARGV.length == 0
  49
  50 if @additional_nameservers.count <= 1 and not @check_soa_nameservers
  51         program_name = File.basename($0, '.*')
  52         STDERR.puts "#{program_name}: Only know about #{@additional_nameservers.count} nameserver(s) and --no-soa-ns specified.  I want at least two."
  53         exit(1)
  54 end
  55
  56 warnings = []
  57 oks = []
  58
  59 def resolve_ns(dns, domain, nameserver)
  60         puts "Getting A record for nameserver #{nameserver} for #{domain}" if @verbose > 0
  61         arecords = dns.getresources(nameserver, Resolv::DNS::Resource::IN::A)
  62         warnings << "Nameserver #{nameserver} for #{domain} has #{arecords.length} A records" if arecords.length != 1
  63         addresses = arecords.map { |a| a.address.to_s }
  64         puts "Addresses for nameserver #{nameserver} for #{domain}: #{addresses.join(', ')}" if @verbose > 0
  65         return addresses
  66 end
  67
  68 dns = Resolv::DNS.new
  69 ARGV.each{ |domain|
  70         serial = []
  71         nameserver_addresses = {}
  72         if @check_soa_nameservers
  73                 nameservers = dns.getresources(domain, Resolv::DNS::Resource::IN::NS)
  74                 nameservernames = nameservers.collect{ |ns| ns.name.to_s }
  75                 nameservernames.each do |nameserver|
  76                         addrs = resolve_ns(dns, domain, nameserver)
  77                         warnings << "Duplicate nameserver #{nameserver} for #{domain}" if nameserver_addresses[nameserver]
  78                         nameserver_addresses[nameserver] = addrs
  79                 end
  80         end
  81         @additional_nameservers.each do |ns|
  82                 begin
  83                         ipa = IPAddr.new(ns)  # check if it's an address
  84                         addrs = [ns]
  85                 rescue ArgumentError
  86                         addrs = resolve_ns(dns, domain, ns)
  87                 end
  88                 warnings << "Duplicate nameserver #{ns} for #{domain}" if nameserver_addresses[ns]
  89                 nameserver_addresses[ns] = addrs
  90         end
  91
  92         nameserver_addresses.each_pair do |nameserver, addrs|
  93                 puts "Testing nameserver #{nameserver} for #{domain}" if @verbose > 0
  94                 addrs.each do |a|
  95                         puts " Nameserver #{nameserver} is at #{a}" if @verbose > 0
  96                         begin
  97                                 resolver = Resolv::DNS.new({:nameserver => a})
  98                                 soas = resolver.getresources(domain, Resolv::DNS::Resource::IN::SOA)
  99                         rescue SystemCallError => e
 100                                 warnings << "Could not resolve #{domain} on #{nameserver}: #{e.message}"
 101                         else
 102                                 resolver.close
 103                                 warnings << "Nameserver #{nameserver} for #{domain} returns #{soas.length} SOAs" if soas.length != 1
 104                                 soas.each do |soa|
 105                                         puts " Nameserver #{nameserver} returns serial #{soa.serial} for #{domain}" if @verbose > 0
 106                                         serial << soa.serial unless serial.include? soa.serial
 107                                 end
 108                         end
 109                 end
 110         end
 111         case serial.length
 112                 when 0
 113                         warnings << "Found no serials for #{domain}"
 114                 when 1
 115                         oks << "#{domain} is at #{serial.first}"
 116                 else
 117                         warnings << "Nameservers disagree on serials for #{domain}: found #{serial.join(', ')}" if serial.length != 1
 118         end
 119 }
 120 dns.close
 121
 122 if warnings.length > 0
 123         puts warnings.join('; ')
 124         exit NAGIOS_STATUS[:WARNING]
 125 else
 126         puts oks.join('; ')
 127         exit NAGIOS_STATUS[:OK]
 128 end