On Friday, 18 February 2011 18:21:38 Root, Paul wrote:

-----Original Message-----

...

From: Buchan Milne [mailto:bgmilne at staff.telkomsa.net] Sent: Friday, February 18, 2011 4:07 AM To: xymon at xymon.com Cc: Root, Paul Subject: Re: [xymon] Making a custom graph

On Thursday, 17 February 2011 22:58:41 Root, Paul wrote:

...

Hi,

    I have a simple script that counts the number of connects we
    have

for a certain port. Specifically, the ssh proxy port for HP NA.

My output looks like this:

Concurrent SSH Sessions

Sessions : 17

Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 :::8022 :::* LISTEN tcp 0 0 ::ffff:199.168.33.8:8022 ::ffff:10.1.193.70:1810 ESTABLISHED

I see that I have issues as there are a bunch of colons. I want to graph just the number of sessions for each interval.

Is there any reason you aren't using the built-in PORTS feature, e.g.

hobbit-clients.cfg

HOST=xxx

  PORT LOCAL=*:8022 0 STATE=ESTABLISHED TRACK=hpna COL=green

That would give you a graph with name hpna of established to the local 8022 port.

The one problem is that we had a situation where a number of connections was stuck in CLOSE-WAIT. I'm guessing this isn't going to track that. Or is it?

Can I set STATE to CLOSE-WAIT? The man page suggests not.

I've used TIME_WAIT:

    PORT LOCAL=%([.:]389) STATE=ESTABLISHED MIN=0 MAX=750 COL=yellow
    PORT LOCAL=%([.:]389) STATE=ESTABLISHED TRACK=ldap MIN=0 MAX=900 

COL=red PORT LOCAL=%([.:]389) STATE=TIME_WAIT MIN=0 MAX=1500 COL=yellow PORT LOCAL=%([.:]389) STATE=TIME_WAIT TRACK=ldap-wait MIN=0 MAX=2500 COL=red

So I see no reason why CLOSE_WAIT wouldn't work:

STATE=state Causes only the sockets in the specified state to be included, "state" is usually LISTEN or ESTABLISHED but can be any socket state reported by the clients "netstat" command.

Regards, Buchan