TCP的连接状态对于我们web服务器来说是至关重要的,尤其是并发量ESTAB;或者是syn_recv值,假如这个值比较大的话我们可以认为是不是受到了攻击,或是是time_wait值比较高的话,我们要考虑看我们内核是否需要调优,太高的time_wait值的话会占用太多端口,要是端口少的话后果不堪设想。
1、使用命令获取TCP连接
[[email protected] ~]# netstat -an|awk '/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}' LISTEN 27 ESTABLISHED 4 FIN_WAIT2 1 SYN_SENT 2 TIME_WAIT 124
TCP各种状态信息描述:
LISTEN – 侦听来自远方TCP端口的连接请求;
SYN-SENT -在发送连接请求后等待匹配的连接请求;
SYN-RECEIVED – 在收到和发送一个连接请求后等待对连接请求的确认;
ESTABLISHED- 代表一个打开的连接,数据可以传送给用户;
FIN-WAIT-1 – 等待远程TCP的连接中断请求,或先前的连接中断请求的确认;
FIN-WAIT-2 – 从远程TCP等待连接中断请求;
CLOSE-WAIT – 等待从本地用户发来的连接中断请求;
CLOSING -等待远程TCP对连接中断的确认;
LAST-ACK – 等待原来发向远程TCP的连接中断请求的确认;
TIME-WAIT -等待足够的时间以确保远程TCP接收到连接中断请求的确认;
CLOSED – 没有任何连接状态;
2、编写监控脚本,放于 /etc/zabbix/zabbix_agentd.d/目录下
#!/bin/bash #This script is used to get tcp and udp connetion status #tcp status metric=$1 tmp_file=/tmp/tcp_status.txt /bin/netstat -an|awk '/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}' > $tmp_file case $metric in closed) output=$(awk '/CLOSED/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; listen) output=$(awk '/LISTEN/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; synrecv) output=$(awk '/SYN_RECV/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; synsent) output=$(awk '/SYN_SENT/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; established) output=$(awk '/ESTABLISHED/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; timewait) output=$(awk '/TIME_WAIT/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; closing) output=$(awk '/CLOSING/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; closewait) output=$(awk '/CLOSE_WAIT/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; lastack) output=$(awk '/LAST_ACK/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; finwait1) output=$(awk '/FIN_WAIT1/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; finwait2) output=$(awk '/FIN_WAIT2/{print $2}' $tmp_file) if [ "$output" == "" ];then echo 0 else echo $output fi ;; *) echo -e "\e[033mUsage: sh $0 [closed|closing|closewait|synrecv|synsent|finwait1|finwait2|listen| established|lastack|timewait]\e[0m" esac
脚本保存后并授执行权限 chmod +x tcp_status.sh
3、编辑配置文件
#新建tcp_status.conf配置文件
vim /etc/zabbix/zabbix_agentd.d/tcp_status.conf
UserParameter=tcp.status[*],/etc/zabbix/zabbix_agentd.d/tcp_status.sh "$1"
#重启zabbix-agent客户端
systemctl restart zabbix-agent
4、测试脚本获取值并更改文件属组
[[email protected] ~]# sh /etc/zabbix/zabbix_agentd.d/tcp_status.sh established 2 #更改文件属组用户 chown zabbix:zabbix /tmp/tcp_status.txt
5、服务器上测试获取值
[[email protected] ~]# zabbix_get -s 192.168.1.230 -k tcp.status[established] 3
6、WEB界面配置
这里直接导入TCP监控模板: Template_TCP_Status.xml
关联相关主机,添加监控模板。
监测—>图形 ,查看TCP监控数据