[perl] TCP Connection Status

[Rael]

Anyone? I'm pretty stumped here.

[Rael]

Nobody has anything on why running the same script from within cacti and by hand produces two different results like I posted on page 3 at the bottom?

[lints]

I can't say I have any idea why it's producing different results when run by hand versus by the poller, but I might have a work around.

I converted this from perl to script server because I figured it might be a bit faster overall than the perl version.

Attached is a PHP script-server version that calls snmpnetstats and returns the values needed. It also should support SNMP V3, although I haven't tested it.

You should just be able to import the xml file (which has the graph template and all it's dependencies) and put the php file in your scripts directory after removing the ".txt" from the end of the filename.

[Mike Philippens]

I can't say I have any idea why it's producing different results when run by hand versus by the poller, but I might have a work around.
I converted this from perl to script server because I figured it might be a bit faster overall than the perl version.
Attached is a PHP script-server version that calls snmpnetstats and returns the values needed. It also should support SNMP V3, although I haven't tested it.

I installed this PHP script and it doesn't give any output. I tried to run it on the command line with 'php [scriptname] but it just gives me zeroes on all counters.

When I do

Code: Select all

snmpwalk -Os -c public -v 1 localhost tcp

on the command line, it gives all the connections, so SNMP works allright on my system. It's a Dell PowerEdge 1650 running Ubuntu 8.04LTS.

[edit]
I did it! I cheated a bit, but I worked out a 'working' snmpnetstat command and put it instead of the command that was constructed in the script. Somehow that command doesn't work well on my system. This is what I changed it to:

Code: Select all

$cmd = 'snmpnetstat -v 1 -c public localhost -Cn -Cp tcp';

Maybe not very pretty, but it seems to work (basically). But I need to look a bit closer into the options to get exactly what I need.

[edit]
I cheered too soon. When I try the edited version of the script using the command line, this shows:

Code: Select all

php ss_tcp_connections.php 
established:176 listen:0 timewait:8 timeclose:0 finwait1:0 finwait2:0 synsent:1 synrecv:0 closewait:0

Seems allright. But the graphic in Cacti remains empty. What am I doing wrong? [edit]: I know what I did...it's too embarrasing to explain here...

[sllywhtboy]

I can't say I have any idea why it's producing different results when run by hand versus by the poller, but I might have a work around.

I converted this from perl to script server because I figured it might be a bit faster overall than the perl version.

Attached is a PHP script-server version that calls snmpnetstats and returns the values needed. It also should support SNMP V3, although I haven't tested it.

You should just be able to import the xml file (which has the graph template and all it's dependencies) and put the php file in your scripts directory after removing the ".txt" from the end of the filename.

on centos 5.x, this mostly worked for me, except for the socket states were always zero. (listening, time wait, etc.)

i updated your script a little, adding a -Ca line 42:

Code: Select all

                : '-c '.$snmp_community ).' -t '.$snmp_timeout.' -Cn -Cp tcp -Ca '.$hostname.':'.$snmp_port;

[dodobelinda]

i added/inserted the following lines below the initial "set statements" (line 16)

Code:
if ($in_version == 2)
{
$in_version = "2c";
}



I also updated the "Data Input Method" input string.

Code:
/usr/bin/perl <path_cacti>/scripts/lvm_netstat_tcp.pl <host> <snmp_version> <snmp_community> <snmp_port> <snmp_timeout>

Could you be a bit more specific about while files you changed to get this to work ?

Thanks

is a bug , I've fixed it,you try it.
and Note that when using the parameters of log and snmpnetstat options

[Chrysalis]

this script is giving me 2 problems.

1 - Established connections are not showing on snmpnetstat, even on manual shell command, timewait and synrecv show but not established.

2 - my graph is all nan values as the cacti log says incomplete response.

[stucky101]

Guys

I used this script for a while until we had an issue where our webservers got into the range of 8000 connections.
Now I cannot use snmpnetstat at all on these. It simply doesn't return anything - it just hangs indefinitely. No wonder cacti can't graph it.

Funny thing the load on those webservers is
load average: 0.09, 0.07, 0.04

and cpu utilisation barely measurable, yet snmpnetstat doesn't return to the prompt when I run it against one of those.
For comparison I can query another system just fine with 2100 connections.
I suppose I'm simply out of luck since at some point there are too many connections for snmpnetstat to work ?
I'd expect it to return something at some point but after 20 minutes I don't think it will.
How many connections do you guys usually have on apache servers ?

[eschoeller]

I'm starting to get a bad feeling about this template in general. But really the "bad feeling" is coming from snmpnetstat. Like Stucky I've been running it for awhile now (several years) but after an incident today, I started to take a closer look at what's going on.

A few pages back, changsung reported a discrepancy between 'netstat' and
snmpnetstat outputs. That user didn't necessarily do a good job of clearly reporting the problem ... here is my shot at it:

Code: Select all

$ snmpnetstat -v2c -c 'public' 127.0.0.1:161 -Ca -Cn -Cp tcp | grep TIMEWAIT | wc -l
100
$ netstat -an | grep -i tcp | grep -i TIME_WAIT | wc -l
168
$ netstat -an | grep -i tcp | grep -i TIME_WAIT | grep -v "ffff" | wc -l
100

So, the first issue is that snmpnetstat does not report on connections in netstat with the format:

Code: Select all

tcp        0      0 ::ffff:172.20.1.10:80      ::ffff:10.0.1.10:52218      TIME_WAIT
tcp        0      0 ::ffff:172.20.1.10:80      ::ffff:10.0.1.10:52221      TIME_WAIT
tcp        0      0 ::ffff:172.20.1.10:80      ::ffff:10.0.1.10:52220      TIME_WAIT

These connections with ffff seem to be ipv6 related, even on a box that only supposedly does ipv4. See this code:

Code: Select all

$ snmpwalk -v2c -c public 127.0.0.1 .1.3.6.1.2.1.6.19.1.7.1 | wc -l
66

$ snmpwalk -v2c -c public 127.0.0.1 .1.3.6.1.2.1.6.19.1.7.2 | wc -l
91

$ netstat -an | grep -i tcp | grep -i TIME_WAIT | wc -l
152

$ snmpwalk -v2c -c public 127.0.0.1 .1.3.6.1.2.1.6.13.1.1 | grep -i timewait | wc -l
64

$ netstat -an | grep -i tcp | grep -v ffff | grep -i TIME_WAIT | wc -l
64

The ipv4 Connection table and ipv6 connection table roughly add up to the total number of time_wait connections in netstat. The TCP Connection table (.1.3.6.1.2.1.6.13.1.1) equals what snmpnetstat reports, and what netstat reports without the ipv6 connections.

To further confuse things ....

Code: Select all

$ snmpnetstat -v2c -c 'public' 127.0.0.1:161 -Ca -Cn -Cp tcp6 | grep TIMEWAIT  | wc -l
0
$ netstat -an | grep -i tcp | grep -i ffff | grep TIME_WAIT | wc -l
122
$ snmpwalk -v2c -c public 127.0.0.1 .1.3.6.1.2.1.6.19.1.7.2 | wc -l
124

Huh? What's that? Well, according to the TCP-MIB::tcpConnectionState.ipv6 SNMP table we have 124 "ipv6" connections in time_wait, netstat mostly agrees, but snmpnetstat reports NOTHING. Connections in the tcpConnectionState.ipv6 table are NOT reported in the TCP-MIB::tcpConnState table which is what snmpnetstat reads.

See this long and confusing thread about the problem with snmpnetstat and ipv6:
http://www.mail-archive.com/net-snmp-us ... 19374.html

Apparently this was fixed:

*5.1.2*
New:
- Minor improvements to snmpdelta (error reporting)
- Minor improvements to snmpnetstat (IPv6 output)

But my versions are far more recent, and still don't work.


For reference, my versions of SNMP (RHEL 5.5)

Code: Select all

net-snmp-libs-5.3.2.2-9.el5
net-snmp-5.3.2.2-9.el5
net-snmp-utils-5.3.2.2-9.el5

Now, the issue I experienced today was with a Solaris 9 host running net-snmp 5.2.2. snmpnetstat (and hence, this template) was reporting 32 established connections, yet the netstat output was reporting well over 400. Here, again is the code:

Code: Select all

$ snmpwalk -v2c -c public 127.0.0.1 .1.3.6.1.2.1.6.13.1.1 | wc -l
32
$ /usr/local/net-snmp/bin/snmpnetstat -v2c -c 'public' 127.0.0.1:161 -Cn -Cp tcp -Cw 25 | wc -l
36
$ netstat -an  | grep -i ESTABLISHED | wc -l
450

I realize this may not be viewed as an apples to apples comparison, but the solaris netstat output is harder to parse then the Linux output. Still I did a spot check of the output (without the wc -l) and I'm not grabbing UNIX domain sockets or UDP sockets here ... I really do have 450 ESTABLISHED connections on this box, yet the snmpd daemon is reporting only 32. The '32' seems fishy to me, almost like some bug in snmpd.

I have absolutely no answers here, only complete frustration. All in all, I'm completely displeased with snmpnetstat/snmpd. Your mileage will definitely vary trying to use this template, and it's not the template's fault.
As for Stucky's issue, I'd concur that if snmpnetstat has the troubles I've identified above I'd most definitely expect it to completely barf on 8000 connections.

I'd be interested to see what your TCP-MIB::tcpConnState table looks like (or rather, how many lines it is )[/code]

[don-harry]

your script does not work with snmp v3 on a debian lenny machine (server and client)

[bacon]

I can't say I have any idea why it's producing different results when run by hand versus by the poller, but I might have a work around.

I converted this from perl to script server because I figured it might be a bit faster overall than the perl version.

Attached is a PHP script-server version that calls snmpnetstats and returns the values needed. It also should support SNMP V3, although I haven't tested it.

You should just be able to import the xml file (which has the graph template and all it's dependencies) and put the php file in your scripts directory after removing the ".txt" from the end of the filename.

It's so cool!

[flw521521]

thank you so much ,it was working very well

[JJX]

your script does not work with snmp v3 on a debian lenny machine (server and client)

Anyone has modified the script and the template so it can work for snmp v3 ?

Any similar script that could work for snmpv3?