Skip to main content
OPNsense monitors services with the Monit module (Services → Monit) and sends alerts by email. The actions available in the module are sending email, restarting a service and stopping monitoring; there is no webhook. The Flashduty email integration receives these emails and uses rules on the email title to decide whether each one triggers or resolves an alert, so no separate OPNsense integration is needed: create an email integration in Flashduty, add its email address as the Monit alert recipient, and configure the push rules below.

In Flashduty On-call

Get the integration email address in either of the two ways below. In both cases choose the Email integration type, not OPNsense.

Use a dedicated integration

  1. In the Flashduty console, select Channels and open a channel
  2. Select Settings → Integrations → Dedicated integrations and click Add integration
  3. Select Email and click Save
  4. Open the new integration card, copy the email address, then configure the push rules below

Use a shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Email, enter an integration name and copy the email address
  3. Configure the push rules below
  4. Set a default route, select a channel and click Save

Configure OPNsense

1

Enable Monit and configure SMTP in OPNsense

Where: OPNsense › Services › Monit › Settings › General SettingsSave and apply.
2

Add an alert that sends to Flashduty

Where: OPNsense › Services › Monit › Settings › Alert Settings › +The default subject has no host name and no fixed separator between service and event, so the rules could not extract a stable Alert Key from it; with this fixed format the rules can process every email:
Monit sends a recovery email in the same format when a service recovers. Save and apply.
3

Trigger a service failure and confirm

First configure the push rules in Configure push rules in Flashduty below. Monit has no entry to send a test alert email, so make a service that Monit watches (configured under Service Settings and Service Test Settings) fail once, then recover.Go back to Flashduty. If the integration shows a Latest event time, the failure email creates an alert and the recovery email closes it, the setup works.

Configure push rules in Flashduty

In the title [$HOST] [$SERVICE] $EVENT, $HOST and $SERVICE are the same in the failure email and the recovery email; only $EVENT differs. The rules use the first two parts as the Alert Key, so a recovery email closes the matching alert.
  1. Set Push mode to Trigger or close alert based on rules
  2. Add the two rules below in this order. Each rule’s condition is Email title Match the given regex, and the Alert Key is extracted from the Email title
  3. Under Default rules, choose: if none of the above rules match, discard email
Rule 1: close the alert
Rule 2: trigger an alert
The close rule comes before the trigger rule. The Alert Key is the host name plus the service name, so repeated failures of the same service on the same host merge into one alert. The default rule discards mail that was not sent in the format above (for example from other alerts that have no Mail format set) so it does not create alerts that can never close on their own.

Events in the email title

$EVENT is Monit’s description of the event. Failures and recoveries come in pairs:

Limitations

  • Type and severity: in Flashduty these alerts show the Email integration type, and their severity is always Warning. You can adjust it with alert pipelines based on the title.
  • Other events: Monit events not in the table above are handled as trigger alerts. If an event type has no matching recovery email, turn on the auto-resolve timeout in the channel that receives this integration; 24 hours is a reasonable start.
  • Title format: if you change Subject in Mail format, update the regexes in the rules to match.