Detailed explanation of Linux using ss command combined with zabbix to monitor socket

Netid #socket type. In the above example, there are TCP, u_str (unix stream) and other sockets. State #What state is the socket in? Below are all the states and descriptions of TCP sockets, which are actually all the states of TCP's three-way handshake and four-way handshake. Recv-Q #In the ESTAB state, it indicates how many bytes of data in the kernel have not been read by the upper-layer application. If the value here is large, the application may be blocked. Send-Q #In the ESTAB state, it indicates how many bytes of data in the kernel send queue have not received the confirmation ACK. If this value is large, it indicates that the receiving end's reception and processing need to be strengthened. Local Address:Port #Local address and port Peer Address:Port #Remote address and port

: : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : :

[TCP_ESTABLISHED] = "ESTAB",
[TCP_SYN_SENT] = "SYN-SENT",
[TCP_SYN_RECV] = "SYN-RECV",
[TCP_FIN_WAIT1] = "FIN-WAIT-1",
[TCP_FIN_WAIT2] = "FIN-WAIT-2",
[TCP_TIME_WAIT] = "TIME-WAIT",
[TCP_CLOSE] = "UNCONN",
[TCP_CLOSE_WAIT] = "CLOSE-WAIT",
[TCP_LAST_ACK] = "LAST-ACK",
[TCP_LISTEN] = "LISTEN",
[TCP_CLOSING] = "CLOSING",

-h, --help help information -V, --version program version information -n, --numeric do not resolve service names -r, --resolve resolve host names -a, --all display all sockets
-l, --listening Display listening sockets
-o, --options Display timer information -e, --extended Display detailed socket information -m, --memory Display socket memory usage -p, --processes Display the process using the socket -i, --info Display TCP internal information -s, --summary Display socket usage overview -4, --ipv4 Display only IPv4 sockets
-6, --ipv6 Show only IPv6 sockets
-0, --packet Display PACKET socket
-t, --tcp Show only TCP sockets
-u, --udp show only UCP sockets
-d, --dccp Show only DCCP sockets
-w, --raw show only RAW sockets
-x, --unix show only Unix sockets
-f, --family=FAMILY displays sockets of type FAMILY, FAMILY is optional, supports unix, inet, inet6, link, netlink
-A, --query=QUERY, --socket=QUERY
QUERY := {all|inet|tcp|udp|raw|unix|packet|netlink}［,QUERY］
-D, --diag=FILE Dump raw TCP socket information to file -F, --filter=FILE Remove filter information from file FILTER := [ state TCP-STATE ] [ EXPRESSION ]

vim tcp_status.sh
#################Script content#################
#!/bin/bash
if [ $# -ne 1 ];then
    echo "Follow the script name with an argument "
fi

case $1 in

    LISTEN)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/LISTEN/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    ESTAB)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/ESTAB/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;


    CLOSE-WAIT
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/CLOSE-WAIT/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    TIME-WAIT)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/TIME-WAIT/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    SYN-SENT)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/SYN-SENT/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    SYN-RECV)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/SYN-RECV/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    FIN-WAIT-1)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/FIN-WAIT-1/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    FIN-WAIT-2)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/FIN-WAIT-2/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    UNCONN)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/UNCONN/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    LAST-ACK
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/LAST-ACK/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;

    CLOSING)
        result=`ss -ant | awk 'NR>1 {a[$1]++} END {for (b in a) print b,a[b]}' | awk '/CLOSING/{print $2}'`
        if [ "$result" == "" ]; then
               echo 0
        else
           echo $result
        fi
        ;;
 esac

vim zabbix_agent.conf
##############Add the following content#################
UnsafeUserParameters=1 #This parameter is required for custom scripts UserParameter=tcp.status[*],sh /home/zabbix/tcp_status.sh $1 #This is used to specify the script just written, and then pass a parameter

vim tcp_monitory.sh
##################tcp_monitor.sh##################
#!/bin/bash
#Get the data and output it to the data.txt file. The format is: original address ip: count: target address ip
#And filter out the data with count less than 200. There is no socket status here. It is too complicated. Individuals can improve it according to specific needs. ip_addr=`ip addr | grep -w inet | grep -v "127.0.0.1" | awk '{print $2}'| awk -F "/" '{print $1}'`
ss -ant | awk '{ print $5}'|grep -Ev '127.0.0.1' | cut -d ':' -f4 | awk -v ip_addr=$ip_addr 'NR>1 {++s[$1]} END {for(k in s)if(s[k]>=200){print k,s[k],ip_addr}}' | grep -E "^([0-9]{1,3}\.){3}[0-9]" > /home/zabbix/data.txt

#Execute the Python script to output the json format.
python /home/zabbix/get_json.py

#####################################
#The following is the content of get_json.py##############get_json.py#################
#!/usr/bin/env python
#coding=utf-8
import json

def create_json(path):
    json_list = []
    with open(path) as f:
        for line in f.readlines():
            dict = {}
            split = line.split(" ")
            dict["{#DES_IP}"] = split[0]
            //dict["{#LINK_COUNT}"] = split[1] //This is optional dict["{#SOU_IP}"] = split[2][:-1]
            json_list.append(dict)
    sum = {}
    sum["data"] = json_list
    sum = json.dumps(sum)
    print sum


if __name__ == '__main__':
    path = "/home/zabbix/data.txt"
    create_json(path)

###############Dividing line: The above is a self-discovered script###############
###############Dividing line: The following is the item related script###############
vim tcp_item.sh
##################tcp_item.sh####################
#!/bin/bash
export LANG="en_US.UTF-8"
path=/home/zabbix/data.txt
count=`cat $path | grep $1 | grep $2 | awk '{print $2}'`
[ 1 "$count" -eq 1 ] && echo 0 || echo $count

UnsafeUserParameters=1 #If it has already been configured, it does not need to be configured UserParameter=discovery.tcp_monitor[*],sh /home/zabbix/tcp_monitor.sh #Self-discovery UserParameter=alert.tcp_count[*],sh /home/zabbix/tcp_item.sh $1 $2 #item, where $1 and $2 are the transfer parameters in item to distinguish the different items