telegraf/plugins/inputs/conntrack

Conntrack Input Plugin

Collects stats from Netfilter's conntrack-tools.

The conntrack-tools provide a mechanism for tracking various aspects of network connections as they are processed by netfilter. At runtime, conntrack exposes many of those connection statistics within /proc/sys/net. Depending on your kernel version, these files can be found in either /proc/sys/net/ipv4/netfilter or /proc/sys/net/netfilter and will be prefixed with either ip or nf. This plugin reads the files specified in its configuration and publishes each one as a field, with the prefix normalized to ip_. conntrack exposes many of those connection statistics within /proc/sys/net. Depending on your kernel version, these files can be found in either /proc/sys/net/ipv4/netfilter or /proc/sys/net/netfilter and will be prefixed with either ip_ or nf_. This plugin reads the files specified in its configuration and publishes each one as a field, with the prefix normalized to ip_.

In order to simplify configuration in a heterogeneous environment, a superset of directory and filenames can be specified. Any locations that don't exist will be ignored.

For more information on conntrack-tools, see the Netfilter Documentation.

Global configuration options

In addition to the plugin-specific configuration settings, plugins support additional global and plugin configuration settings. These settings are used to modify metrics, tags, and field or create aliases and configure ordering, etc. See the CONFIGURATION.md for more details.

Configuration

# Collects conntrack stats from the configured directories and files.
# This plugin ONLY supports Linux
[[inputs.conntrack]]
  ## The following defaults would work with multiple versions of conntrack.
  ## Note the nf_ and ip_ filename prefixes are mutually exclusive across
  ## kernel versions, as are the directory locations.

  ## Superset of filenames to look for within the conntrack dirs.
  ## Missing files will be ignored.
  files = ["ip_conntrack_count","ip_conntrack_max",
          "nf_conntrack_count","nf_conntrack_max"]

  ## Directories to search within for the conntrack files above.
  ## Missing directories will be ignored.
  dirs = ["/proc/sys/net/ipv4/netfilter","/proc/sys/net/netfilter"]
  ## all - aggregated statistics
  ## percpu - include detailed statistics with cpu tag
  collect = ["all", "percpu"]

Metrics

A detailed explanation of each fields can be found in kernel documentation

• conntrack
  • ip_conntrack_count (int, count): The number of entries in the conntrack table
  • ip_conntrack_max (int, size): The max capacity of the conntrack table
  • ip_conntrack_buckets (int, size): The size of hash table.

With collect = ["all"]:

• entries: The number of entries in the conntrack table
• searched: The number of conntrack table lookups performed
• found: The number of searched entries which were successful
• new: The number of entries added which were not expected before
• invalid: The number of packets seen which can not be tracked
• ignore: The number of packets seen which are already connected to an entry
• delete: The number of entries which were removed
• delete_list: The number of entries which were put to dying list
• insert: The number of entries inserted into the list
• insert_failed: The number of insertion attempted but failed (same entry exists)
• drop: The number of packets dropped due to conntrack failure
• early_drop: The number of dropped entries to make room for new ones, if maxsize reached
• icmp_error: Subset of invalid. Packets that can't be tracked due to error
• expect_new: Entries added after an expectation was already present
• expect_create: Expectations added
• expect_delete: Expectations deleted
• search_restart: Conntrack table lookups restarted due to hashtable resizes

Tags

With collect = ["percpu"] will include detailed statistics per CPU thread.

Without "percpu" the cpu tag will have all value.

Example Output

$ ./telegraf --config telegraf.conf --input-filter conntrack --test
conntrack,host=myhost ip_conntrack_count=2,ip_conntrack_max=262144 1461620427667995735

with stats:

$ telegraf --config /etc/telegraf/telegraf.conf --input-filter conntrack --test
> conntrack,cpu=all,host=localhost delete=0i,delete_list=0i,drop=2i,early_drop=0i,entries=5568i,expect_create=0i,expect_delete=0i,expect_new=0i,found=7i,icmp_error=1962i,ignore=2586413402i,insert=0i,insert_failed=2i,invalid=46853i,new=0i,search_restart=453336i,searched=0i 1615233542000000000
> conntrack,host=localhost ip_conntrack_count=464,ip_conntrack_max=262144 1615233542000000000