added alarm to detect port scans or busy service crashes
Costa Tsaousis (ktsaou) committed
Sep 17, 2016 at 18:46 UTC
966913fdc01c9f07464438068b2b56e2ac803d61
3 files changed
+34
-1
conf.d/Makefile.am
+1
@@ -48,6 +48,7 @@ dist_healthconfig_DATA = \
48
health.d/cpu.conf \
49
health.d/disks.conf \
50
health.d/entropy.conf \
51
+ health.d/tcp_resets.conf \
52
health.d/memcached.conf \
53
health.d/mysql.conf \
54
health.d/named.conf \
conf.d/health.d/tcp_resets.conf
new
+32
@@ -0,0 +1,32 @@
1
+# -----------------------------------------------------------------------------
2
+
3
+ alarm: ipv4_tcphandshake_last_collected_secs
4
+ on: ipv4.tcphandshake
5
+ calc: $now - $last_collected_t
6
+ units: seconds ago
7
+ every: 10s
8
+ warn: $this > (($status >= $WARNING) ? (0) : ( 5 * $update_every))
9
+ crit: $this > (($status == $CRITICAL) ? (0) : (60 * $update_every))
10
+ delay: up 0 down 5m multiplier 1.5 max 1h
11
+ info: number of seconds since the last successful data collection
12
+ to: sysadmin
13
+
14
+# -----------------------------------------------------------------------------
15
+
16
+ alarm: 1m_ipv4_tcp_resets
17
+ on: ipv4.tcphandshake
18
+ lookup: average -1m at -10s unaligned absolute of OutRsts
19
+ units: tcp resets/s
20
+ every: 10s
21
+ info: average TCP RESETS this host is sending, over the last minute
22
+
23
+ alarm: 10s_ipv4_tcp_resets
24
+ on: ipv4.tcphandshake
25
+ lookup: average -10s unaligned absolute of OutRsts
26
+ units: tcp resets/s
27
+ every: 10s
28
+ warn: $this > ((($1m_ipv4_tcp_resets < 5)?(5):($1m_ipv4_tcp_resets)) * (($status >= $WARNING) ? (1) : (4)))
29
+ delay: up 0 down 60m multiplier 1.2 max 2h
30
+ info: average TCP RESETS this host is sending, over the last 10 seconds (this can be an indication that a port scan is made, or that a service running on this host has crashed)
31
+ to: sysadmin
32
+
src/health.c
+1
-1
@@ -2126,7 +2126,7 @@ static inline void health_alarm_log_process(RRDHOST *host) {
2126
if(unlikely(ae->unique_id < first_waiting))
2127
first_waiting = ae->unique_id;
2128
2129
- if(likely(now > ae->delay_up_to_timestamp))
2129
+ if(likely(now >= ae->delay_up_to_timestamp))
2130
health_process_notifications(host, ae);
2131
}
2132
}