TECHZEN Zenoss User Community ARCHIVE  

Monitor TCP Connections through SNMP

Subject: Monitor TCP Connections through SNMP
Author: Matt
Posted: 2014-07-16 10:26

Hey,

I have already created a ZenPack to monitor TCP Connections through SNMP.

Here is a quick overview of how the ZenPack works:
Modeler plugin: During modelling all TCP Connections (can be filtered using zProperties) get detected and stored into the DB, including the local IP address, local port, remote IP address and remote port.
Monitoring: I've created a custom Zenoss Daemon to monitor the TCP Connections and whenever no response for a OID is received the connection state is set to 0, which triggers the event

Unfortunately there is a huge problem:
I can't clear events automatically, because the OID changes whenever a TCP connection gets reestablished.

Here is an example:

Local IP address: 192.168.0.2
Local port: 8080
Remote IP address: 192.168.0.3
Remote port: 58837

Therefore the OID I'm monitoring (connection state) is the following:
1.3.6.1.2.1.6.13.1.1.192.168.0.2.8080.192.168.0.3.58837

As soon as the connection breaks down the event gets triggered.

Connection gets reestablished:
Local IP address: 192.168.0.2
Local port: 8080
Remote IP address: 192.168.0.3
Remote port: 63834

OID:
1.3.6.1.2.1.6.13.1.1.192.168.0.2.8080.192.168.0.3.63834

As you can see, the new OID is different.

So what the daemon would have to do is get all TCP connections of the device and compare them with the one that broke down.

If only the remote or local port is different, then the new OID should be written into the DB and the event cleared.

But is that possible Also keeping in mind that I don't want to put too much stress on the Zenoss server.

Hope someone can point me into the right direction.

Thanks in advance.



Subject: wouldn't the event simply
Author: Andrew Kirch
Posted: 2014-07-31 11:45

wouldn't the event simply need to go back and find a connection to the same destination port on the machine from the remote IP Even though the port changes, those two would be the same

Andrew Kirch

akirch@gvit.com

Need Zenoss support, consulting or custom development Look no further. Email or PM me!

Ready for Distributed Topology (collectors) for Zenoss 5 Coming May 1st from GoVanguard



Subject: Hi,
Author: Matt
Posted: 2014-08-05 10:26

Hi,

Thanks for your reply.

Yes, but my criteria is that the connection has to go to the same remote IP address and either the same local Port or same remote Port.

It sounds like there is an solution for that!



Subject: Does anyone have an idea/tip
Author: Matt
Posted: 2014-10-07 20:59

Does anyone have an idea/tip for me



< Previous
Monitor Proxmox on new Dell severs with iDRAC7?
  Next
Monitoring template causes AttributeError
>