Skip to content

Commit

Permalink
Enhance docs
Browse files Browse the repository at this point in the history
  • Loading branch information
yhabteab committed Sep 12, 2023
1 parent c744fcc commit 79e6b30
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 42 deletions.
45 changes: 5 additions & 40 deletions doc/03-Configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,59 +30,24 @@ port:
`443,5665-5669`

Additionally, each job may also exclude specific **hosts** and **IP** addresses from scan. These hosts won't be scanned
when you run the [scan](04-Scanning.md#scan-command) or [jobs](04-Scanning.md#scheduling-jobs) command. Excluding an
entire network and specifying IP addresses in CIDR format will not work. You must specify a comma-separated concrete
**IP** and **host CN**, e.g:
when you run the [scan](04-Scanning.md#scan-command) or [jobs](04-Scanning.md#scheduling-jobs) command. Excluding an entire network and specifying IP addresses in CIDR
format will not work. You must specify concrete **IP** and **host CN** separated with commas, e.g:

`192.0.2.2,192.0.2.5,icinga.com`

### Job Schedules

Schedules are `cron` and [rrule](https://www.rfc-editor.org/rfc/rfc5545) based configs used to run periodically
at the given interval. Every job is allowed to have multiple schedules that can be run independently of each other.
Don't worry, you don't need to know anything about rrule to create **rrule** based schedules. All you need to do is
clicking some buttons over the UI. On the other hand, you should know what cron is and how to configure it to create
**cron**-based schedules. `Cron` based examples can be found [here](#cron-schedules).

Each job schedule provides different options that you can use to control the scheduling behavior of the
[jobs command](04-Scanning.md#scheduling-jobs).
Schedules are [`cron`](https://crontab.guru) and rule based configs used to run jobs periodically at the given interval.
Every job is allowed to have multiple schedules that can be run independently of each other. Each job schedule provides
different options that you can use to control the scheduling behavior of the [jobs command](04-Scanning.md#scheduling-jobs).

#### Examples

##### RRule Schedules

A schedule that runs weekly on **Friday** and scans all targets that have not yet been scanned, or
whose last scan is older than `1 week`.

![Weekly Schedules](res/weekly-schedules.png "Weekly Schedules")


##### Cron Schedules

The `cron` format is as follows:

```
* * * * *
- - - - -
| | | | |
| | | | |
| | | | +----- day of week (0 - 6) (Sunday to Saturday)
| | | +---------- month (1 - 12)
| | +--------------- day of month (1 - 31)
| +-------------------- hour (0 - 23)
+------------------------- minute (0 - 59)
```

Example definitions:

| Description | Definition |
|------------------------------------------------------------|------------|
| Run once a year at midnight of 1 January | 0 0 1 1 * |
| Run once a month at midnight of the first day of the month | 0 0 1 * * |
| Run once a week at midnight on Sunday morning | 0 0 * * 0 |
| Run once a day at midnight | 0 0 * * * |
| Run once an hour at the beginning of the hour | 0 * * * * |

## Server Name Indication

In case you are serving multiple virtual hosts under a single IP you can configure those in
Expand Down
4 changes: 2 additions & 2 deletions doc/04-Scanning.md
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# <a id="Scanning"></a>Scanning

The Icinga Certificate Monitoring provides CLI commands to scan arbitrary **hosts** and **IPs** in various ways.
The Icinga Certificate Monitoring provides CLI commands to scan **hosts** and **IPs** in various ways.
These commands are listed below and can be used individually. It is necessary for all commands to know which IP address
ranges and ports to scan. These can be configured as described [here](03-Configuration.md#configure-jobs).

## Scan Command

The scan command, as its name implies, scans targets to find their X.509 certificates and track changes to them.
The scan command, scans targets to find their X.509 certificates and track changes to them.
A **target** is an **IP-port** combination that is generated from the job configuration, taking into account configured
[**SNI**](03-Configuration.md#server-name-indication) maps, so that targets with multiple certificates are also properly
scanned.
Expand Down

0 comments on commit 79e6b30

Please sign in to comment.