[xymon] Making a custom graph

[Buchan Milne]

On Friday, 18 February 2011 18:21:38 Root, Paul wrote:
> -----Original Message-----
> 
> > From: Buchan Milne [mailto:bgmilne at staff.telkomsa.net]
> > Sent: Friday, February 18, 2011 4:07 AM
> > To: xymon at xymon.com
> > Cc: Root, Paul
> > Subject: Re: [xymon] Making a custom graph
> > 
> > On Thursday, 17 February 2011 22:58:41 Root, Paul wrote:
> > > Hi,
> > > 
> > >         I have a simple script that counts the number of connects we
> > >         have
> > > 
> > > for a certain port. Specifically, the ssh proxy port for HP NA.
> > > 
> > > My output looks like this:
> > > 
> > > Concurrent SSH Sessions
> > > 
> > > 
> > > 
> > > Sessions : 17
> > > 
> > > Proto Recv-Q Send-Q Local Address Foreign Address State
> > > tcp 0 0 :::8022 :::* LISTEN
> > > tcp 0 0 ::ffff:199.168.33.8:8022 ::ffff:10.1.193.70:1810 ESTABLISHED
> > > 
> > > I see that I have issues as there are a bunch of colons. I want to
> > > graph just the number of sessions for each interval.
> > 
> > Is there any reason you aren't using the built-in PORTS feature, e.g.
> > 
> > # hobbit-clients.cfg
> > HOST=xxx
> > 
> >       PORT LOCAL=*:8022 0 STATE=ESTABLISHED TRACK=hpna COL=green
> > 
> > That would give you a graph with name hpna of established to the local
> > 8022 port.
> 
> The one problem is that we had a situation where a number of connections
> was stuck in CLOSE-WAIT. I'm guessing this isn't going to track that. Or
> is it?
> 
> Can I set STATE to CLOSE-WAIT? The man page suggests not.
> 

I've used TIME_WAIT:


        PORT LOCAL=%([.:]389) STATE=ESTABLISHED MIN=0 MAX=750 COL=yellow
        PORT LOCAL=%([.:]389) STATE=ESTABLISHED TRACK=ldap MIN=0 MAX=900 
COL=red
        PORT LOCAL=%([.:]389) STATE=TIME_WAIT MIN=0 MAX=1500 COL=yellow
        PORT LOCAL=%([.:]389) STATE=TIME_WAIT TRACK=ldap-wait MIN=0 MAX=2500 
COL=red

So I see no reason why CLOSE_WAIT wouldn't work:

STATE=state
      Causes only the sockets in  the  specified  state  to  be included,
      "state" is usually LISTEN or ESTABLISHED but can be any socket state
      reported by the clients "netstat" command.


Regards,
Buchan