Grafana dashboard: UFW firewall
Description: Dashboard to monitor UFW firewall, using Telegraf and InfluxDB

Dashboard to monitor UFW firewall, using Telegraf and InfluxDB

Tutorial (in French): [https://www.eliastiksofts.com/blog/2022/04/monitorer-son-serveur-avec-grafana-monitorer-le-pare-feu-ufw](https://www.eliastiksofts.com/blog/2022/04/monitorer-son-serveur-avec-grafana-monitorer-le-pare-feu-ufw)

{
  "__inputs": [
    {
      "name": "DS_INFLUXDB",
      "label": "InfluxDB",
      "description": "",
      "type": "datasource",
      "pluginId": "influxdb",
      "pluginName": "InfluxDB"
    }
  ],
  "__elements": [],
  "__requires": [
    {
      "type": "panel",
      "id": "geomap",
      "name": "Geomap",
      "version": ""
    },
    {
      "type": "grafana",
      "id": "grafana",
      "name": "Grafana",
      "version": "8.5.0"
    },
    {
      "type": "datasource",
      "id": "influxdb",
      "name": "InfluxDB",
      "version": "1.0.0"
    },
    {
      "type": "panel",
      "id": "table",
      "name": "Table",
      "version": ""
    },
    {
      "type": "panel",
      "id": "timeseries",
      "name": "Time series",
      "version": ""
    }
  ],
  "annotations": {
    "list": [
      {
        "builtIn": 1,
        "datasource": {
          "type": "grafana",
          "uid": "-- Grafana --"
        },
        "enable": true,
        "hide": true,
        "iconColor": "rgba(0, 211, 255, 1)",
        "name": "Annotations & Alerts",
        "target": {
          "limit": 100,
          "matchAny": false,
          "tags": [],
          "type": "dashboard"
        },
        "type": "dashboard"
      }
    ]
  },
  "editable": true,
  "fiscalYearStartMonth": 0,
  "graphTooltip": 0,
  "id": null,
  "links": [],
  "liveNow": false,
  "panels": [
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "continuous-GrYlRd"
          },
          "custom": {
            "axisLabel": "",
            "axisPlacement": "auto",
            "barAlignment": 0,
            "drawStyle": "line",
            "fillOpacity": 20,
            "gradientMode": "scheme",
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            },
            "lineInterpolation": "smooth",
            "lineWidth": 3,
            "pointSize": 5,
            "scaleDistribution": {
              "type": "linear"
            },
            "showPoints": "auto",
            "spanNulls": false,
            "stacking": {
              "group": "A",
              "mode": "none"
            },
            "thresholdsStyle": {
              "mode": "off"
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 5,
        "w": 24,
        "x": 0,
        "y": 0
      },
      "id": 9,
      "options": {
        "legend": {
          "calcs": [],
          "displayMode": "list",
          "placement": "bottom"
        },
        "tooltip": {
          "mode": "single",
          "sort": "none"
        }
      },
      "pluginVersion": "8.4.6",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "import \"timezone\"\n\noption location = timezone.location(name: \"Europe/Paris\")\n\nfrom(bucket: \"ufw_data\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> aggregateWindow(every: 5m, fn: count, createEmpty: false)\n  |> filter(fn: (r) => r[\"_measurement\"] == \"ufw_log\")\n  |> pivot(rowKey: [\"_time\"], columnKey: [\"_field\"], valueColumn: \"_value\")\n  |> map(fn: (r) => ({ _time: r._time, \"1\": r.ufw_src_ip }))\n  |> rename(columns: { \"1\": \"IP bloquées\" })\n  |> sort(columns: [\"_time\"], desc: true)\n  |> limit(n: 1000, offset: 0)",
          "refId": "A"
        }
      ],
      "title": "Blocked IP",
      "transformations": [],
      "type": "timeseries"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB}"
      },
      "description": "Dernières adresses IP bloquées, triés par leur dernière date de blocage",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "center",
            "displayMode": "auto",
            "filterable": false,
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "ufw_src_ip {host=\"c5d1b1a365c9\", path=\"/var/log/ufw.log\"}"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 348
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Time"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 373
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 0,
        "y": 5
      },
      "id": 2,
      "options": {
        "footer": {
          "enablePagination": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 0,
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "Time"
          }
        ]
      },
      "pluginVersion": "8.5.0",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "import \"timezone\"\n\noption location = timezone.location(name: \"Europe/Paris\")\n\nfrom(bucket: \"ufw_data\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r[\"_measurement\"] == \"ufw_log\")\n  |> filter(fn: (r) => r[\"_field\"] == \"ufw_src_ip\")\n  |> limit(n: 1000, offset: 0)\n  |> unique()\n  |> yield(name: \"unique\")",
          "refId": "A"
        }
      ],
      "title": "Blocked IP (unique)",
      "transformations": [],
      "type": "table"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB}"
      },
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "hideFrom": {
              "legend": false,
              "tooltip": false,
              "viz": false
            }
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": []
      },
      "gridPos": {
        "h": 8,
        "w": 12,
        "x": 12,
        "y": 5
      },
      "id": 7,
      "options": {
        "basemap": {
          "config": {},
          "name": "Layer 0",
          "type": "default"
        },
        "controls": {
          "mouseWheelZoom": true,
          "showAttribution": true,
          "showDebug": false,
          "showScale": false,
          "showZoom": true
        },
        "layers": [
          {
            "config": {
              "blur": 15,
              "radius": 5,
              "weight": {
                "fixed": 1,
                "max": 1,
                "min": 0
              }
            },
            "location": {
              "latitude": "Latitude",
              "longitude": "Longitude",
              "mode": "coords"
            },
            "name": "Layer 3",
            "tooltip": true,
            "type": "heatmap"
          },
          {
            "config": {
              "showLegend": true,
              "style": {
                "color": {
                  "fixed": "dark-green"
                },
                "opacity": 0.4,
                "rotation": {
                  "fixed": 0,
                  "max": 360,
                  "min": -360,
                  "mode": "mod"
                },
                "size": {
                  "fixed": 5,
                  "max": 15,
                  "min": 2
                },
                "symbol": {
                  "fixed": "img/icons/marker/circle.svg",
                  "mode": "fixed"
                },
                "textConfig": {
                  "fontSize": 12,
                  "offsetX": 0,
                  "offsetY": 0,
                  "textAlign": "center",
                  "textBaseline": "middle"
                }
              }
            },
            "location": {
              "latitude": "Latitude",
              "longitude": "Longitude",
              "mode": "coords"
            },
            "name": "Layer 2",
            "tooltip": true,
            "type": "markers"
          }
        ],
        "view": {
          "id": "zero",
          "lat": 0,
          "lon": 0,
          "zoom": 1
        }
      },
      "pluginVersion": "8.5.0",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "import \"timezone\"\n\noption location = timezone.location(name: \"Europe/Paris\")\n\nfrom(bucket: \"ufw_data\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r[\"_measurement\"] == \"ufw_log\")\n  |> filter(fn: (r) => r[\"_field\"] == \"ufw_src_ip\" or r[\"_field\"] == \"ufw_src_ip_country\" or r[\"_field\"] == \"ufw_src_ip_lat\" or r[\"_field\"] == \"ufw_src_ip_lon\")\n  |> limit(n: 1000, offset: 0)\n  |> unique()\n  |> pivot(rowKey: [\"_time\"], columnKey: [\"_field\"], valueColumn: \"_value\")\n  |> map(fn: (r) => ({ _time: r._time, \"1\": r.ufw_src_ip, \"2\": r.ufw_src_ip_country, \"3\": r.ufw_src_ip_lat, \"4\": r.ufw_src_ip_lon }))\n  |> rename(columns: { \"1\": \"IP source\", \"2\": \"Pays\", \"3\": \"Latitude\", \"4\": \"Longitude\" })\n  |> yield(name: \"unique\")",
          "refId": "A"
        }
      ],
      "title": "Blocked IP location",
      "type": "geomap"
    },
    {
      "collapsed": false,
      "datasource": {
        "type": "datasource",
        "uid": "grafana"
      },
      "gridPos": {
        "h": 1,
        "w": 24,
        "x": 0,
        "y": 13
      },
      "id": 5,
      "panels": [],
      "title": "Log file",
      "type": "row"
    },
    {
      "datasource": {
        "type": "influxdb",
        "uid": "${DS_INFLUXDB}"
      },
      "description": "Derniers évènements loggés",
      "fieldConfig": {
        "defaults": {
          "color": {
            "mode": "thresholds"
          },
          "custom": {
            "align": "center",
            "displayMode": "auto",
            "filterable": false,
            "inspect": false
          },
          "mappings": [],
          "thresholds": {
            "mode": "absolute",
            "steps": [
              {
                "color": "green",
                "value": null
              },
              {
                "color": "red",
                "value": 80
              }
            ]
          }
        },
        "overrides": [
          {
            "matcher": {
              "id": "byName",
              "options": "ufw_src_ip {host=\"c5d1b1a365c9\", path=\"/var/log/ufw.log\"}"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 726
              }
            ]
          },
          {
            "matcher": {
              "id": "byName",
              "options": "Time"
            },
            "properties": [
              {
                "id": "custom.width",
                "value": 728
              }
            ]
          }
        ]
      },
      "gridPos": {
        "h": 8,
        "w": 24,
        "x": 0,
        "y": 14
      },
      "id": 3,
      "options": {
        "footer": {
          "enablePagination": false,
          "fields": "",
          "reducer": [
            "sum"
          ],
          "show": false
        },
        "frameIndex": 56,
        "showHeader": true,
        "sortBy": [
          {
            "desc": true,
            "displayName": "_time"
          }
        ]
      },
      "pluginVersion": "8.5.0",
      "targets": [
        {
          "datasource": {
            "type": "influxdb",
            "uid": "${DS_INFLUXDB}"
          },
          "query": "import \"timezone\"\n\noption location = timezone.location(name: \"Europe/Paris\")\n\nfrom(bucket: \"ufw_data\")\n  |> range(start: v.timeRangeStart, stop: v.timeRangeStop)\n  |> filter(fn: (r) => r[\"_measurement\"] == \"ufw_log\")\n  |> pivot(rowKey: [\"_time\"], columnKey: [\"_field\"], valueColumn: \"_value\")\n  |> map(fn: (r) => ({ _time: r._time, \"1\": r.ufw_src_ip, \"2\": r.ufw_src_ip_country, \"3\": r.ufw_dest_ip, \"4\": r.ufw_source_port,\n    \"5\": r.ufw_dest_port, \"6\": r.ufw_action, \"7\": r.ufw_packet_len, \"8\": r.ufw_mac,\n    \"9\": r.ufw_hostname, \"99\": r.ufw_interface, \"999\": r.ufw_protocol, \"9999\": r.ufw_tcp_opts }))\n  |> rename(columns: { \"1\": \"Source IP\", \"2\": \"Source IP country\", \"3\": \"Destination IP\", \"4\": \"Source port\",\n    \"5\": \"Destination port\", \"6\": \"Action\", \"7\": \"Packet length\", \"8\": \"Source MAC\",\n    \"9\": \"Hostname\", \"99\": \"Interface\", \"999\": \"Protocol\", \"9999\": \"TCP OPTS\" })\n  |> sort(columns: [\"_time\"], desc: true)\n  |> limit(n: 1000, offset: 0)",
          "refId": "A"
        }
      ],
      "title": "Last events",
      "type": "table"
    }
  ],
  "refresh": "",
  "schemaVersion": 36,
  "style": "dark",
  "tags": [],
  "templating": {
    "list": []
  },
  "time": {
    "from": "now-24h",
    "to": "now"
  },
  "timepicker": {},
  "timezone": "Asia/Dubai",
  "title": "UFW firewall",
  "uid": "dse2XE87k",
  "version": 47,
  "weekStart": "",
  "gnetId": 16164,
  "description": "Dashboard to monitor UFW firewall, using Telegraf and InfluxDB"
}