On 30 Jul 2026, at 22:52, Lukas Tribus <lukas@ltri.eu> wrote: [..] There are many reasons rpki-client could stop validating. Connectivity issues, upstream FW changes, read-only FS, no enough memory, not enough disk space, bugs, permission problems, "it's a container so nobody understands what is going on, but the lights are all green".
Disk full is such a standard error case. If you do not watch for that you are just not doing ops correctly. Any software will die horrible death if done so and often silently as messages cannot get out as there is no space to store them etc. Oh and a reminder: Debian Trixie changed /tmp to tmpfs, thus instead of the terabytes of / filesystem you had it might now be a few GBs, thus it will fill, be aware of that one too now. I dump my rpki-client output into JSON, publish it on an internal rsync server and then rsync that from the routers. Each of my router (as they are debian/bird, debian/frr and openbsd/openbgpd) then has the following simple bash script in cron next to a diskspace check: 8<-------------------------- #!/bin/bash F="/rpki/rpki-client.json" if [ ! -f ${F} ]; then echo "ERROR: Missing RPKI JSON: ${F}" exit 1 fi TS=$(cat ${F} | jq -r .metadata.buildtime) if [ -z "${TS}" ]; then echo "ERROR: RPKI misses timestamp in ${F}" exit 1 fi THEN=$(date -d "${TS}" +%s) if [ -z "${THEN}" ]; then echo "ERROR: RPKI timestamp did not convert: ${TS}" exit 1 fi NOW=$(date +%s) MAX=$((4 * 60 * 60)) AGE=$((NOW - THEN)) if [ ${AGE} -gt ${MAX} ]; then echo "ERROR: RPKI more than ${AGE} seconds, max: ${MAX}, timestamp: ${TS}" exit 1 fi exit 0 --------->8 As such, spam will reach me when it is too much. Alternatively, you could poll the file remotely from a central system (so that you know your disk is not full etc, or at least monitoring fails), or do many other things. One can easily monitor the buildtime stamp. Of course, that is just to ensure that the rpki-client.json is updated recently. StayRTR is easier, you can monitor them with rtrmon that is included. (See https://github.com/bgp/stayrtr/blob/master/cmd/rtrmon/index.html.tmpl ) which even has prometheus exports for those that use that. Otherwise do similar to the above and check the metadata....