Rubrik REST API Special Agent

IMPORTANT: Migration to RSC

Since version 1.5.0, the agent uses Rubrik Security Cloud (RSC) GraphQL exclusively. Because of this architectural change, existing rules for the legacy integration must be recreated.

The agent provides the following services:

• Cluster System Status
• Compliance 24 Hours (cluster-side)
• Disk
• Node Hardware Health
• Node Status (node-side)
• Bandwidth
• Storage Runway
• Event Logwatch

Monitor a single cluster by name or UUID, or select SaaS in the special agent rule to monitor all clusters visible to the service account.

Node data is provided via piggyback. In SaaS mode, cluster hosts are also provided via piggyback. Dynamic Host Configuration is recommended to create these hosts automatically.

Event Logwatch

Event Logwatch is reported on the querying host rather than via piggyback.

Event state is stored separately for each querying host and cluster UUID, including when switching clusters in SaaS mode.

At least one of the following event filters must be configured:

• Severity
• Activity types
• Activity status
• Object type

Without a filter, Event Logwatch is disabled, even if the section is selected in the rule. This is intended to reduce the risk of lockouts caused by unfiltered event requests.

Filter values can be identified by inspecting requests from the Rubrik SaaS Events page using the browser developer tools.

Storage Runway

The configurable Storage section reports the estimated remaining capacity in days. Missing runway values result in UNKNOWN rather than being interpreted as zero days.

Node Hardware Health

The Rubrik Node Hardware Health ruleset provides exceptions for selected hardware health policies. An unhealthy policy can be ignored or mapped to OK, WARN, or CRIT. Healthy policies remain OK; unconfigured unhealthy policies remain CRIT.

The worst evaluated state determines the service state. Original findings remain visible in the service details, including ignored or mapped policies. If all returned policies are ignored, the service reports OK with an explicit summary. If no policies are returned, the service reports UNKNOWN.

Connection settings

The request timeout is configurable. SSL certificate verification is enabled by default and can be explicitly disabled in the special agent rule.

Discovered labels

• Cluster hosts: rubrikDevice:cluster
• Node hosts: rubrikDevice:node

Checkmk version compatibility

Compatibility: Checkmk 2.3–2.5 with cloud-based RSC: rubrik_agent-1.5.8.mkp Successfully tested with Checkmk 2.5.0.

Earlier packages:

• Checkmk 2.1.0: rubrik_agent-0.9.3.mkp (deprecated)
• Checkmk 2.2.0: rubrik_agent-1.2.3.mkp
• Checkmk 2.3.0 and 2.4.0 with instance-based CDM: rubrik_agent-1.4.3.mkp

Thanks!

Thanks to my colleague Mathias for his helpful suggestions and support in keeping the code clean.

Thanks to Leon Buhleier (Leon.Buhleier@sva.de) for contributing the metric translation fix for correct scaling of Rubrik Disk graphs.

Thanks to Sebastian Häger (Sebastian.Haeger@sva.de) for contributing version 1.5.3: Event Logwatch with filters, configurable request timeout, and SaaS-wide cluster monitoring with cluster piggyback hosts.

Changelog

As the Changelog went too big for the Checkmk Exchange you will find it on our Github Repository.