zabbix 监控TCP 十一种有限状态机

1、TCP 十一种有限状态机

TCP 共十一种状态

ESTABLISHED
SYN_SENT
SYN_RECV
FIN_WAIT1
FIN_WAIT2
TIME_WAIT
CLOSE
CLOSE_WAIT
LAST_ACK
LISTEN
CLOSING

[root@tomcat01 ~]# netstat -nat
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN
tcp        0     36 192.168.1.11:22         192.168.1.1:51550       ESTABLISHED
tcp        0      0 192.168.1.11:22         192.168.1.1:51551       ESTABLISHED
tcp6       0      0 :::33816                :::*                    LISTEN
tcp6       0      0 :::12345                :::*                    LISTEN
tcp6       0      0 ::1:25                  :::*                    LISTEN
tcp6       0      0 :::34557                :::*                    LISTEN
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN
tcp6       0      0 :::111                  :::*                    LISTEN
tcp6       0      0 :::8080                 :::*                    LISTEN
tcp6       0      0 :::22                   :::*                    LISTEN  

2、自定义监控项实现监控TCP当前ESTABLISHED状态的连接数

先准备脚本实现自定义监控项实现连接数

[root@zabbix-agent ~]# vim /apps/zabbix_agent/conf/zabbix_agentd.conf.d/test.conf
UserParameter=tcp_state_estab,netstat -ant|grep -c ESTABLISHED

[root@zabbix-agent ~]# systemctl restart zabbix-agent.service

root@zabbix-server:~# zabbix_get -s 192.168.1.122 -p 10050 -k "tcp_state_estab"
3

添加被控制主机

在被监控主机添加监控项

验证结果

3、自定义监控项实现监控TCP 状态的连接数

修改监控项的脚本为以下形式,可以实现一个脚本实现多个自定义监控项

[root@zabbix-agent ~]# yum install -y net-tools
[root@zabbix-agent ~]# vim /apps/zabbix_agent/conf/zabbix_agentd.conf.d/tcp_state.sh
#!/bin/bash

tcp_state () {
    netstat -atn|grep -c $1
}

tcp_state $1

[root@zabbix-agent ~]# chmod +x /apps/zabbix_agent/conf/zabbix_agentd.conf.d/tcp_state.sh

[root@zabbix-agent ~]# vim /apps/zabbix_agent/conf/zabbix_agentd.conf.d/tcp_state.conf
UserParameter=tcp_state[*],/apps/zabbix_agent/conf/zabbix_agentd.conf.d/tcp_state.sh $1

[root@zabbix-agent ~]# systemctl restart zabbix-agent.service

root@zabbix-server:~# zabbix_get -s 192.168.1.122 -p 10050 -k "tcp_state[ESTABLISHED]"
5

root@zabbix-server:~# zabbix_get -s 192.168.1.122 -p 10050 -k "tcp_state[LISTEN]"
11

4、自定义模板实现监控

对于主机和监控项众多时，直接将监控项关联至主机的方法，是比较繁琐的。
可以通过将自定义的监控项加入到自定义的模板或已有的模板中，再将此模板关联至需要监控的主机，从而提高效率。

创建应用集

在自定义的模板中创建自定义监控项或者将已有的监控项复制到模板

查看自定义的模板中已存在自定义的应用集和监控项

重新链接模板

查看最新数据

5、创建自定义触发器

创建触发器

测试触发触发器

root@zabbix-server:~# zabbix_get -s 192.168.1.122 -p 10050 -k "tcp_state[ESTABLISHED]"
7

6、自定义图形

7、导出模板

将自定义的模板导出，可以在其它Zabbix Server导入进行复用

<?xml version="1.0" encoding="UTF-8"?>
<zabbix_export>
    <version>5.0</version>
    <date>2023-01-26T00:41:25Z</date>
    <groups>
        <group>
            <name>Linux servers</name>
        </group>
    </groups>
    <templates>
        <template>
            <template>Template test</template>
            <name>Template test</name>
            <groups>
                <group>
                    <name>Linux servers</name>
                </group>
            </groups>
            <applications>
                <application>
                    <name>Tcp_state</name>
                </application>
            </applications>
            <items>
                <item>
                    <name>tcp_state[ESTABLISHED]</name>
                    <key>tcp_state[ESTABLISHED]</key>
                    <delay>10s</delay>
                    <units>个</units>
                    <applications>
                        <application>
                            <name>Tcp_state</name>
                        </application>
                    </applications>
                    <triggers>
                        <trigger>
                            <expression>{last()}&gt;=6</expression>
                            <name>tcp_state[ESTABLISHED]的连接数太多</name>
                            <priority>HIGH</priority>
                        </trigger>
                    </triggers>
                </item>
                <item>
                    <name>tcp_state[LISTEN]</name>
                    <key>tcp_state[LISTEN]</key>
                    <delay>10s</delay>
                    <units>个</units>
                    <applications>
                        <application>
                            <name>Tcp_state</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>tcp_state[TIME_WAIT]</name>
                    <key>tcp_state[TIME_WAIT]</key>
                    <delay>10s</delay>
                    <units>个</units>
                    <applications>
                        <application>
                            <name>Tcp_state</name>
                        </application>
                    </applications>
                </item>
            </items>
        </template>
    </templates>
    <graphs>
        <graph>
            <name>TCP state</name>
            <graph_items>
                <graph_item>
                    <sortorder>1</sortorder>
                    <color>1A7C11</color>
                    <item>
                        <host>Template test</host>
                        <key>tcp_state[ESTABLISHED]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>2</sortorder>
                    <color>F63100</color>
                    <item>
                        <host>Template test</host>
                        <key>tcp_state[LISTEN]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>3</sortorder>
                    <color>2774A4</color>
                    <item>
                        <host>Template test</host>
                        <key>tcp_state[TIME_WAIT]</key>
                    </item>
                </graph_item>
            </graph_items>
        </graph>
    </graphs>
</zabbix_export>