Skip to content

NetStat


Netstat metrics collection, including TCP/UDP connections, waiting for connections, waiting for requests to be processed, and so on.

Config

Collector Configuration

Go to the conf.d/samples directory under the DataKit installation directory, copy netstat.conf.sample and name it netstat.conf. Examples are as follows:

[[inputs.netstat]]
  ##(Optional) Collect interval, default is 10 seconds
  interval = '10s'

## The ports you want display
## Can add tags too
# [[inputs.netstat.addr_ports]]
  # ports = ["80","443"]

## Groups of ports and add different tags to facilitate statistics
# [[inputs.netstat.addr_ports]]
  # ports = ["80","443"]
# [inputs.netstat.addr_ports.tags]
  # service = "http"

# [[inputs.netstat.addr_ports]]
  # ports = ["9529"]
# [inputs.netstat.addr_ports.tags]
  # service = "datakit"
  # foo = "bar"

## Server may have multiple network cards
## Display only some network cards
## Can add tags too
# [[inputs.netstat.addr_ports]]
  # ports = ["1.1.1.1:80","2.2.2.2:80"]
  # ports_match is preferred if both ports and ports_match configured
  # ports_match = ["*:80","*:443"]

[inputs.netstat.tags]
  # some_tag = "some_value"
  # more_tag = "some_other_value"

Configuration Tips:

## (1) Configure the ports of interest.
[[inputs.netstat.addr_ports]]
  ports = ["80","443"]
# (2) Configure two groups of ports with different tags for easy statistics.
[[inputs.netstat.addr_ports]]
  ports = ["80","443"]
  [inputs.netstat.addr_ports.tags]
    service = "http"

[[inputs.netstat.addr_ports]]
    ports = ["9529"]
    [inputs.netstat.addr_ports.tags]
        service = "datakit"
# (3) The server has multiple NICs and only cares about certain ones.
[[inputs.netstat.addr_ports]]
  ports = ["1.1.1.1:80","2.2.2.2:80"]
# (4) The server has multiple NICs, and the requirement to show this configuration on a per NIC basis will mask the ports configuration value.
[[inputs.netstat.addr_ports]]
  ports = ["1.1.1.1:80","2.2.2.2:80"] // Invalid, masked by ports_match.
  ports_match = ["*:80","*:443"] // Valid.

After configuration, restart DataKit.

Can be turned on by ConfigMap Injection Collector Configuration or Config ENV_DATAKIT_INPUTS .

Can also be turned on by environment variables, (needs to be added as the default collector in ENV_DEFAULT_ENABLED_INPUTS):

  • ENV_INPUT_NETSTAT_INTERVAL

    Collect interval

    Type: Duration

    input.conf: interval

    Default: 10s

  • ENV_INPUT_NETSTAT_ADDR_PORTS

    Groups of ports and add different tags to facilitate statistics

    Type: JSON

    input.conf: addr_ports

    Example: '["1.1.1.1:80","443"]'

  • ENV_INPUT_NETSTAT_TAGS

    Customize tags. If there is a tag with the same name in the configuration file, it will be overwritten

    Type: String

    input.conf: tags

    Example: 'tag1=value1,tag2=value2'


Metric

For all the following data collections, a global tag named host is appended by default (the tag value is the host name of the DataKit), or other tags can be specified in the configuration by [inputs.netstat.tags]:

 [inputs.netstat.tags]
  # some_tag = "some_value"
  # more_tag = "some_other_value"
  # ...

Measurements for statistics regardless of port number: netstat ; Measurements for statistics by port number: netstat_port.

Tags & Fields Description
addr_port
(tag)
Addr and port. Optional.
host
(tag)
Host name.
ip_version
(tag)
IP version, 4 for IPV4, 6 for IPV6, unknown for others
tcp_close Current number of TCP sockets in CLOSE state.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_close_wait Current number of TCP sockets in CLOSE_WAIT state after the remote endpoint has requested termination.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_closing Current number of TCP sockets in CLOSING state while both endpoints are closing the connection.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_established Current number of TCP sockets in ESTABLISHED state.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_fin_wait1 Current number of TCP sockets in FIN_WAIT1 state after the local endpoint has requested connection termination.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_fin_wait2 Current number of TCP sockets in FIN_WAIT2 state while waiting for the remote endpoint to terminate the connection.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_last_ack Current number of TCP sockets in LAST_ACK state while waiting for acknowledgement of the final termination segment.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_listen Current number of TCP sockets in LISTEN state waiting for incoming connection requests.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_none Current number of TCP sockets whose state was reported as NONE by the operating system.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_syn_recv Current number of TCP sockets in SYN_RECV state after receiving a connection request and sending an acknowledgement.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_syn_sent Current number of TCP sockets in SYN_SENT state after sending a connection request.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
tcp_time_wait Current number of TCP sockets in TIME_WAIT state after connection termination.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
udp_socket Current number of UDP sockets.
Type: int | (gauge)
Unit: count
Tagged by: ip_version
Tags & Fields Description
addr_port
(tag)
Matched local address and port, or configured port value when the input is configured without an address.
host
(tag)
Host name.
ip_version
(tag)
IP version, 4 for IPV4, 6 for IPV6, unknown for others
pid Process ID associated with the last matched socket in this address/port group. This field is omitted from the aggregate netstat measurement.
Type: int | (gauge)
Unit: N/A
Tagged by: addr_port, ip_version
tcp_close Current number of matched TCP sockets in CLOSE state.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_close_wait Current number of matched TCP sockets in CLOSE_WAIT state after the remote endpoint has requested termination.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_closing Current number of matched TCP sockets in CLOSING state while both endpoints are closing the connection.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_established Current number of matched TCP sockets in ESTABLISHED state.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_fin_wait1 Current number of matched TCP sockets in FIN_WAIT1 state after the local endpoint has requested connection termination.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_fin_wait2 Current number of matched TCP sockets in FIN_WAIT2 state while waiting for the remote endpoint to terminate the connection.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_last_ack Current number of matched TCP sockets in LAST_ACK state while waiting for acknowledgement of the final termination segment.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_listen Current number of matched TCP sockets in LISTEN state waiting for incoming connection requests.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_none Current number of matched TCP sockets whose state was reported as NONE by the operating system.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_syn_recv Current number of matched TCP sockets in SYN_RECV state after receiving a connection request and sending an acknowledgement.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_syn_sent Current number of matched TCP sockets in SYN_SENT state after sending a connection request.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
tcp_time_wait Current number of matched TCP sockets in TIME_WAIT state after connection termination.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version
udp_socket Current number of matched UDP sockets.
Type: int | (gauge)
Unit: count
Tagged by: addr_port, ip_version

Feedback

Is this page helpful? ×