Tcp connection status for our web servers is critical, especially concurrency ESTAB; or syn_recv value, if this value is relatively large, then we can say that is not under attack (such as SYN attacks), or is time_wait value is relatively high, we have to consider whether we need to tune the kernel, then the value is too high time_wait would take up too much port, if the port less then lead to disastrous consequences
surroundings
| Host computer | ip | zabbix version | relationship |
|---|---|---|---|
| centos7.5 | 192.168.181.135 | zabbix4.2 | Server |
| centos7.5 | 192.168.181.136 | zabbix4.2 | Client |
Client Configuration
Written collection rules
Write a script file to obtain tcp state reference
vim /etc/zabbix/scripts/tcp_status.sh
#!/bin/bash
#########################################################################
# File Name: tcp_status.sh
# file_path:
# Author: 浪子尘心 # Mail: [email protected] # Created Time: 2019-03-18 14:01:34 # Last Changed: 2019-03-18 14:02:18 # Description: TCP状态采集 # Version: ######################################################################### #!/bin/bash [ $# -ne 1 ] && echo "Usage:CLOSE-WAIT|CLOSED|CLOSING|ESTAB|FIN-WAIT-1|FIN-WAIT-2|LAST-ACK|LISTEN|SYN-RECV SYN-SENT|TIME-WAIT" && exit 1 ss_file=/tmp/ss.txt tcp_status_fun(){ [ $1 == "ESTABLISHED" ] && TCP_STAT="ESTAB" || TCP_STAT=$1 #可能大家习惯了看ESTABLISHED，所以我做了个小小的转换。 ss -ant | awk 'NR>1 {++s[$1]} END {for(k in s) print k,s[k]}' > $ss_file TCP_STAT_VALUE=$(grep ${TCP_STAT} $ss_file|awk {'print $NF'}) if [ -z "$TCP_STAT_VALUE" ];then TCP_STAT_VALUE=0 fi echo $TCP_STAT_VALUE } tcp_status_fun $1Add execute permission to the script
chmod +x /etc/zabbix/scripts/tcp_status.shWriting a custom key
vim /etc/zabbix/zabbix_agentd.d/tcp_status.conf
UserParameter=tcp_status[*],/etc/zabbix/scripts/tcp_status.sh $1Restart the client
systemctl restart zabbix-agentTest data acquisition server
zabbix_get -s 192.168.181.136 -p 10050 -k tcp_status[LISTEN]
Introduction of the TCP Templates
Configuration - Templates - Import
template address
select the client host after the import is complete, you can add a template, click the host group myApplications view 
click tcp template monitored item View 
View graphics