Useful for:
monitoring number of connections to specific TCP port
checking if service is listening on specific port
statistics of TCP connections table
checking load on specific service as number of connections
detecting TCP connection state based attacks and abnormalities
Requirements:
agent on *nix system with net-snmp tools
bash,grep,cat,snmpnetstat
Links:
http://net-snmp.sourceforge.net/docs/man/snmpnetstat.html
snmp_stat.sh attached
How-to:
1.
configure agent on node that has snmp connection to nodes you want to monitor:
ExternalParameter = TCP.Connections(*):/opt/netxms/scripts/snmp_stat.sh $1 $2 $3 $4
add nodes you want to monitor to trusted nodes on that node
parameters:
# $1 = hostname, monitored node ip
# $2 = community, monitored node snmp community string
# $3 = TCP state {ESTABLISHED|LISTEN|TIMEWAIT|TIMECLOSE|FINWAIT1|FINWAIT2|SYNSENT|SYNRECV}
# $4 = TCP port for detailed {ESTABLISHED|LISTEN}
configure DCI's on node you want to monitor and specify node from 1.
as proxy node when creating DCI
examples DCI's:
# all established connections
TCP.Connections(192.168.1.1,public,ESTABLISHED)
# all established connections to TCP port 80
TCP.Connections(192.168.1.1,public,ESTABLISHED,80)
# will return 1 if service is listening on TCP port 25
TCP.Connections(192.168.1.1,public,LISTEN,25)
Feel free to use. Suggestions, spelling and bug fixes welcome.
Ales
snmp_stat.sh
