mirror of
https://github.com/unpoller/unpoller.git
synced 2026-09-30 03:21:28 +02:00
Cooper Ry LeesandClaude Opus 5
31cc5a0f31
A UNVR or UNVR Pro runs UniFi Protect with no Network application installed.
UnPoller could not poll one at all: NewUnifi ends with GetServerData(), a GET of
/proxy/network/status, which such a console answers with its UniFi OS SPA HTML.
The controller entry died during initialisation and re-failed every interval,
never even printing a config summary -- while the Protect Integration API on the
same host answered every endpoint with the same key.
Set disable_network = true on that controller. It defaults to false, so nothing
about an existing config changes.
The Protect collectors were already complete and already not site-scoped; three
things stood between them and a Protect-only console:
- getUnifi now calls unifi.NewProtectClient, which skips the Network probe and
validates the Protect Integration API instead (unpoller/unifi#240).
- pollController aborted on getFilteredSites long before reaching
collectProtect, and collectControllerEvents did the same before
collectProtectLogs. The Network pass is extracted into pollNetwork and
skipped wholesale; the event collector list reduces to collectProtectLogs,
the only site-independent one.
- Metrics counted a poll successful only if it produced devices or clients. A
Protect-only console produces neither, so a filtered scrape of one -- the
Prometheus per-target path -- fell through to the dynamic-controller branch
and reported ErrDynamicLookupsDisabled despite a successful collection.
ProtectDevices now counts too.
Two smaller things worth calling out for reviewers:
- extractDevices dereferenced metrics.Devices unguarded. That was already a
latent panic; skipping the Network pass makes it reachable, so it is fixed
here rather than left for the first person to hit it.
- RawMetrics answers the raw-path kind for these consoles and rejects the
site-scoped kinds with ErrNetworkDisabled. Returning an empty result would
read as "this console has no devices" rather than "wrong question".
warnProtectOnly logs an error, without failing the controller, for the two
configurations that can never collect anything: disable_network with neither
Protect save flag, and save_protect_devices with no key to authenticate with.
Silently collecting nothing is the failure mode hardest to spot in a log.
pkg/inputunifi had no tests before this. input_test.go follows inputunas'
input_test.go: an httptest fake UNVR serving the console's SPA HTML for
everything but the Protect paths and the login, covering initialisation,
metrics, events, the filtered scrape, RawMetrics, both warnings, config binding
across toml/json/yaml/env, and that the shipped examples leave Network enabled.
TestProtectOnlyControllerFailsWithoutFlag pins the original bug against that
same console, so the flag is demonstrably what makes the difference.
Requires github.com/unpoller/unifi/v6 with NewProtectClient (unpoller/unifi#240).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVreutpEATmBjm6PBw9RjQ
332 lines
14 KiB
Plaintext
332 lines
14 KiB
Plaintext
# Unpoller v2 primary configuration file. TOML FORMAT #
|
|
###########################################################
|
|
|
|
[poller]
|
|
# Turns on line numbers, microsecond logging, and a per-device log.
|
|
# The default is false, but I personally leave this on at home (four devices).
|
|
# This may be noisy if you have a lot of devices. It adds one line per device.
|
|
debug = false
|
|
|
|
# Turns off per-interval logs. Only startup and error logs will be emitted.
|
|
# Recommend enabling debug with this setting for better error logging.
|
|
quiet = false
|
|
|
|
# Log unknown device types as DEBUG messages. By default (false), newer UniFi
|
|
# device types that aren't recognized are silently ignored to reduce log volume.
|
|
# Enable this when debugging or reporting new device types to developers.
|
|
# log_unknown_types = false
|
|
|
|
# Load dynamic plugins. Advanced use; only sample mysql plugin provided by default.
|
|
plugins = []
|
|
|
|
#### OUTPUTS
|
|
|
|
# If you don't use an output, you can disable it.
|
|
|
|
[prometheus]
|
|
disable = false
|
|
# This controls on which ip and port /metrics is exported when mode is "prometheus".
|
|
# This has no effect in other modes. Must contain a colon and port.
|
|
http_listen = "0.0.0.0:9130"
|
|
# Adding an SSL Cert and Cert Key will make Poller listen with SSL/https.
|
|
ssl_cert_path = ""
|
|
ssl_key_path = ""
|
|
# Errors are rare. Setting this to true will report them to Prometheus.
|
|
report_errors = false
|
|
## Record data for disabled or down (unlinked) switch ports.
|
|
dead_ports = false
|
|
# How often the background poller refreshes the cache served to /metrics.
|
|
# Decouples scrape cadence from UniFi API calls so 429 backoff loops no
|
|
# longer block /metrics. Default: 60s. Values below 15s are clamped to 15s.
|
|
interval = "60s"
|
|
|
|
[influxdb]
|
|
disable = false
|
|
# InfluxDB does not require auth by default, so the user/password are probably unimportant.
|
|
url = "http://127.0.0.1:8086"
|
|
user = "unifipoller"
|
|
# Password for InfluxDB user (above).
|
|
# If the password provided here begins with file:// then the password is read in from
|
|
# the file path that follows the file:// prefix. ex: file:///etc/influxdb/passwd.file
|
|
pass = "unifipoller"
|
|
# Be sure to create this database. See the InfluxDB Wiki page for more info.
|
|
db = "unifi"
|
|
# If your InfluxDB uses a valid SSL cert, set this to true.
|
|
verify_ssl = false
|
|
# The UniFi Controller only updates traffic stats about every 30 seconds.
|
|
# Setting this to something lower may lead to "zeros" in your data.
|
|
# If you're getting zeros now, set this to "1m"
|
|
interval = "30s"
|
|
## Record data for disabled or down (unlinked) switch ports.
|
|
dead_ports = false
|
|
|
|
# Global tags applied to every InfluxDB measurement. Per-metric tags
|
|
# (site, device id, etc.) always win on key collision.
|
|
# [influxdb.tags]
|
|
# customer = "abc_corp"
|
|
# env = "prod"
|
|
|
|
# To enable output of UniFi Events to Loki, add a URL; it's disabled otherwise.
|
|
# User, pass and tenant_id are optional and most folks wont set them.
|
|
# Pick which logs you want per-controller in the [unifi.controller] section.
|
|
# This is a new feature. Feedback welcome!
|
|
[loki]
|
|
disable = true
|
|
url = ""
|
|
# The rest of this is advanced & optional. See wiki.
|
|
user = ""
|
|
pass = ""
|
|
verify_ssl = false
|
|
tenant_id = ""
|
|
interval = "2m"
|
|
timeout = "10s"
|
|
|
|
[datadog]
|
|
# How often to poll UniFi and report to Datadog.
|
|
interval = "2m"
|
|
|
|
# To enable this output plugin
|
|
enable = false
|
|
|
|
# Datadog Custom Options
|
|
|
|
# address to talk to the datadog agent, by default this uses the local statsd UDP interface
|
|
# address = "localhost:8125"
|
|
|
|
# namespace to prepend to all data, default is no additional prefix.
|
|
# namespace = ""
|
|
|
|
# tags to append to all data
|
|
# tags = [ "customer:abc_corp" ]
|
|
|
|
# For more advanced options for very large amount of data collected see the upstream
|
|
# github.com/unpoller/unpoller/pkg/datadogunifi repository README.
|
|
|
|
|
|
# Unpoller has an optional web server. To turn it on, set enable to true. If you
|
|
# wish to use SSL, provide SSL cert and key paths. This interface is currently
|
|
# read-only; it just displays information, like logs, devices and clients.
|
|
# Notice: Enabling the web server with many sites will increase memory usage.
|
|
# This is a new feature and lacks a UI, enabling only recommended for testing.
|
|
[webserver]
|
|
enable = false
|
|
port = 37288
|
|
# The HTML path is different on Windows and BSD/macOS.
|
|
html_path = "/usr/local/lib/unpoller/web"
|
|
ssl_cert_path = ""
|
|
ssl_key_path = ""
|
|
# How many events per event group to hold. 200-2000. Use fewer with many sites.
|
|
# With 1 site, you'll have a max total of 9 event groups; 1 per plugin, 4 per site.
|
|
# Each site adds 1 event group for each of these inputs that is enabled:
|
|
# save_ids, save_events, save_anomalies, save_alarms.
|
|
max_events = 200
|
|
|
|
# By default the web interface does not require authentication. You can change
|
|
# that by adding a username and password hash (or multiple) below.
|
|
# To create a hash, run unifi-poller with the -e CLI argument. See Wiki for more!
|
|
[webserver.accounts]
|
|
# username = "password-hash"
|
|
# captain = "$2a$04$mxw6i0LKH6u46oaLK2cq5eCTAAFkfNiRpzNbz.EyvJZZWNa2FzIlS"
|
|
|
|
#### INPUTS
|
|
|
|
[unifi]
|
|
# Setting this to true and providing default credentials allows you to skip
|
|
# configuring controllers in this config file. Instead you configure them in
|
|
# your prometheus.yml config. Prometheus then sends the controller URL to
|
|
# Unpoller when it performs the scrape. This is useful if you have many,
|
|
# or changing controllers. See wiki for more.
|
|
dynamic = false
|
|
|
|
# The following section contains the default credentials/configuration for any
|
|
# dynamic controller (see above section), or the primary controller if you do not
|
|
# provide one and dynamic is disabled. In other words, you can just add your
|
|
# controller here and delete the following section. The internal defaults are
|
|
# shown below. Any missing values will assume these displayed defaults.
|
|
|
|
[unifi.defaults]
|
|
# URL for the UniFi Controller. Do not add any paths after the host:port.
|
|
# Do not use port 8443 if you have a UDM; just use "https://ip".
|
|
url = "https://127.0.0.1:8443"
|
|
|
|
# Make a read-only user in the UniFi Admin Settings, allow it access to all sites.
|
|
user = "unifipoller"
|
|
|
|
# Password for UniFi controller user (above).
|
|
# If the password provided here begins with file:// then the password is read in from
|
|
# the file path that follows the file:// prefix. ex: file:///etc/unifi/password.file
|
|
# ex: file:///etc/unifi/passwd.file, windows: file://C:\\UserData\\Unifi\\Passwd.txt
|
|
pass = "unifipoller"
|
|
|
|
# API Key
|
|
# Unifi now supports API Key authentication. This is exclusive of user/pass auth.
|
|
# api_key = "unifiapikey"
|
|
|
|
# UniFi Protect Integration API Key. Required to poll Protect device metrics
|
|
# (see save_protect_devices, below). Falls back to api_key (above) if unset.
|
|
# If the value provided here begins with file:// then it's read in from the
|
|
# file path that follows the file:// prefix, same as pass (above).
|
|
# protect_api_key = "unifiprotectapikey"
|
|
|
|
# If the controller has more than one site, specify which sites to poll here.
|
|
# Set this to ["default"] to poll only the first site on the controller.
|
|
# A setting of ["all"] will poll all sites; this works if you only have 1 site too.
|
|
sites = ["all"]
|
|
|
|
# Added an example for overriding the default site name.
|
|
# default_site_name_override = "My Custom Default Site"
|
|
|
|
# Specify a timeout, leave missing to declare infinite wait. This determines the maximum
|
|
# time to wait for a response from the unifi controller on any API request.
|
|
# timeout = 60s
|
|
|
|
# Enable collection of site data. This data powers the Network Sites dashboard.
|
|
# It's not valuable to everyone and setting this to false will save resources.
|
|
save_sites = true
|
|
|
|
# Hash, with md5, client names and MAC addresses. This attempts to protect
|
|
# personally identifiable information. Most users won't want to enable this.
|
|
hash_pii = false
|
|
|
|
# Enable collection of Intrusion Detection System Data (InfluxDB/Loki only).
|
|
# Only useful if IDS or IPS are enabled on one of the sites. This may store
|
|
# a lot of information. Only recommended for testing and debugging. There
|
|
# may not be any dashboards to display this data. It can be used for annotations.
|
|
# Enable this only if using InfluxDB or Loki. This will leak PII data!
|
|
save_ids = false
|
|
|
|
# Enable collection of UniFi Events using the v1 API (InfluxDB/Loki only).
|
|
# This uses the legacy /api/s/{site}/stat/event endpoint.
|
|
# For UDM devices, use save_syslog instead (v2 API).
|
|
# Enable this only if using InfluxDB or Loki. This may leak PII data!
|
|
save_events = false
|
|
|
|
# Enable collection of UniFi System Log using the v2 API (Loki only).
|
|
# This uses the /v2/api/site/{site}/system-log/all endpoint.
|
|
# Recommended for UDM/UDM-Pro/UCG devices running modern firmware.
|
|
# Provides richer event data including client roaming, admin access, etc.
|
|
# Enable this only if using Loki. This may leak PII data!
|
|
save_syslog = false
|
|
|
|
# Enable collection of UniFi Alarms (InfluxDB/Loki only).
|
|
# There are no dashboards to display this data. It can be used for annotations.
|
|
# This is a new (June, 2020) feature. Please provide feedback if you try it out!
|
|
# Enable this only if using InfluxDB or Loki. This will leak PII data!
|
|
save_alarms = false
|
|
|
|
# Enable collection of UniFi Anomalies (InfluxDB/Loki only).
|
|
# There are no dashboards to display this data. It can be used for annotations.
|
|
# This is a new (June, 2020) feature. Please provide feedback if you try it out!
|
|
# Enable this only if using InfluxDB or Loki.
|
|
save_anomalies = false
|
|
|
|
# Enable collection of UniFi Protect event logs (Loki only). Requires a Protect
|
|
# console reachable from this controller. This may leak PII data!
|
|
save_protect_logs = false
|
|
|
|
# Include base64-encoded thumbnails with Protect event logs (above). Loki only.
|
|
protect_thumbnails = false
|
|
|
|
# Enable collection of UniFi Protect device metrics (sensors, cameras, lights,
|
|
# bridges, link stations, NVR) via the Protect Integration API. Requires
|
|
# protect_api_key (or api_key, above) and a Protect console reachable from
|
|
# this controller.
|
|
save_protect_devices = false
|
|
|
|
# Set this on a Protect-only console -- a UNVR or UNVR Pro, which runs UniFi Protect
|
|
# with no Network application installed. UnPoller then skips the Network API entirely:
|
|
# no sites, clients, devices, DPI, events, alarms or IDs are collected, only Protect.
|
|
# Leave it false for every normal controller, including a UDM or UCG that runs both.
|
|
disable_network = false
|
|
|
|
# Enable collection of Deep Packet Inspection data. This data breaks down traffic
|
|
# types for each client and site, it powers a dedicated DPI dashboard.
|
|
# Enabling this adds roughly 150 data points per client. That's 6000 metrics for
|
|
# 40 clients. This adds a little bit of poller run time per interval and causes
|
|
# more API requests to your controller(s). Don't let these "cons" sway you:
|
|
# it's cool data. Please provide feedback on your experience with this feature.
|
|
save_dpi = false
|
|
|
|
## Enabling save_rogue stores even more data in your time series databases.
|
|
## This saves neighboring access point metrics in a dedicated table or namespace.
|
|
save_rogue = false
|
|
|
|
## WAN speed test results, polled from the controller's aggregated-dashboard
|
|
## endpoint. Enabled by default. Set to false to skip that request entirely if
|
|
## your controller misbehaves on it or you simply don't want the metrics.
|
|
save_speedtest = true
|
|
|
|
# If your UniFi controller has a valid SSL certificate (like lets encrypt),
|
|
# you can enable this option to validate it. Otherwise, any SSL certificate is
|
|
# valid. If you don't know if you have a valid SSL cert, then you don't have one.
|
|
verify_ssl = false
|
|
|
|
## You may provide a list of SSL cert files (PEM format) that you expect your
|
|
## controller to use. As long as one of the certs you provide here shows up in
|
|
## the cert trust chain the controller presents it will be accepted and allowed.
|
|
## These files may be re-read while poller is running.
|
|
## Example: ssl_cert_paths = ["/path/to/cert.pem", "/another/cert.pem"]
|
|
ssl_cert_paths = []
|
|
|
|
# The following is optional and used for configurations with multiple UniFi controllers.
|
|
|
|
# You may repeat the following [[unifi.controller]] section as many times as needed to
|
|
# poll multiple controllers. Uncomment the entire section including [[unifi.controller]].
|
|
# Omitted variables will have their values taken from the defaults, above.
|
|
#
|
|
#[[unifi.controller]]
|
|
# url = "https://127.0.0.1:8443"
|
|
# user = "unifipoller"
|
|
# pass = "unifipoller"
|
|
# sites = ["all"]
|
|
# save_sites = true
|
|
# hash_pii = false
|
|
# save_ids = false
|
|
# save_events = false
|
|
# save_syslog = false
|
|
# save_alarms = false
|
|
# save_anomalies = false
|
|
# save_protect_logs = false
|
|
# protect_thumbnails = false
|
|
# save_protect_devices = false
|
|
# protect_api_key = "unifiprotectapikey"
|
|
# disable_network = false
|
|
# save_dpi = false
|
|
# save_traffic = false
|
|
# save_rogue = false
|
|
# save_speedtest = true
|
|
# verify_ssl = false
|
|
# ssl_cert_paths = []
|
|
|
|
##############################
|
|
### UNAS Pro (opt-in)
|
|
##############################
|
|
|
|
# A UNAS Pro is a standalone UniFi OS console with no Network application, so it is polled
|
|
# by its own input plugin with its own credentials and host -- not as a UniFi controller.
|
|
#
|
|
# This section is entirely optional. The plugin is off unless you set enable = true and
|
|
# add at least one [[unas.device]] below; otherwise it stays silent and inert.
|
|
# Metrics land under the unifi_unas_ prefix in Prometheus, and in the unas_device,
|
|
# unas_pool, unas_disk, and unas_share measurements in InfluxDB.
|
|
#
|
|
#[unas]
|
|
# enable = true
|
|
#
|
|
# Defaults applied to every device that does not set its own value.
|
|
#[unas.defaults]
|
|
# user = "unpoller"
|
|
# pass = ""
|
|
# verify_ssl = false
|
|
# timeout = "60s"
|
|
#
|
|
# Repeat the following stanza for each UNAS console you want to poll.
|
|
# Use the console's own local-account credentials. Do not add a path after the host.
|
|
#[[unas.device]]
|
|
# url = "https://192.168.1.10"
|
|
# user = "unpoller"
|
|
# pass = "unpoller"
|
|
# verify_ssl = false
|
|
# timeout = "60s"
|
|
# ssl_cert_paths = []
|