Monitoring network connection states with Zabbix (+ iptables + iptstate)

This is a little howto about displaying some small n’ nice graphs regarding to network connections of your machine. In the way of “Nothing is silly if it involves getting graphs”, the goal of this article is to get a realtime graph showing numbers of current server connections according to protocols,

and current TCP states:

Certainly worh at least for displaying SYN flood attacks. Here is the recipe:

1. iptables, iptstate, zabbix server/agent

2. iptables Zabbix template

3. monitoring scripts

We need to get the template from point 2. and import it to Zabbix sever. Then we will rename it’s application from “Network” to e.g. Network_iptables, due to namespace conflict with default Linux template. Now when we have a possibility to display TCP states and type of connections, let’s fill it with data.

/etc/zabbix_agentd.conf:

UserParameter=iptstate.tcp,/etc/zabbix/scripts/net-tcp
UserParameter=iptstate.tcp.syn,/etc/zabbix/scripts/net-syn
UserParameter=iptstate.tcp.timewait,/etc/zabbix/scripts/net-time-wait
UserParameter=iptstate.tcp.established,/etc/zabbix/scripts/net-established
UserParameter=iptstate.tcp.close,/etc/zabbix/scripts/net-close
UserParameter=iptstate.udp,/etc/zabbix/scripts/net-udp
UserParameter=iptstate.icmp,/etc/zabbix/scripts/net-icmp

Bold font are the names of keys in our newly imported iptables/iptstate zabbix template. Then you need to authorize zabbix user to run iptstate command (potentially without password) and you do it in /etc/sudoers file. Since zabbix agent doesn’t allow to call sudo command directly from it’s config ( you will end up with error log “you must have a tty to run sudo” ), it is also required to turn off “Defaults requiretty” by commenting it out. The scripts which are called in the example above are located in point 3.

#!/bin/bash
est=`sudo iptstate -s | grep ESTABLISHED | wc -l`
echo $est

Output of this simple script is a number of connections which are in ESTABLISHED TCP state. These checks are periodical, so after restarting zabbix-agentd, you’ll get graphs like from beggining of this article. Good part is that you don’t need to be stuck with defaults, you can define some more like this:

iptstate -s -t | head -2 |tail -1 | sed 's/^.*OTHER: //'

Have fun!

daan.

Tags: iptables, iptstate, linux, monitoring, system administration, zabbix