zabbix监控linux服务器tcp连接

本次实验环境centos7

zabbix-server版本4.4.5

在需要监控的主机上安装zabbix-agent客户端

wget https://mirrors.aliyun.com/zabbix/zabbix/4.4/rhel/7/x86_64/zabbix-agent-4.4.5-2.el7.x86_64.rpm
rpm -ivh zabbix-agent-4.4.5-2.el7.x86_64.rpm

1、将以下xml保存为zbx_export_templates.xml文件并将其导入zabbix-web端

<?xml version="1.0" encoding="UTF-8"?>
<zabbix_export>
    <version>4.4</version>
    <date>2020-05-08T01:24:18Z</date>
    <groups>
        <group>
            <name>Templates</name>
        </group>
    </groups>
    <templates>
        <template>
            <template>Template TCP Connection Status</template>
            <name>Template TCP Connection Status</name>
            <groups>
                <group>
                    <name>Templates</name>
                </group>
            </groups>
            <applications>
                <application>
                    <name>TCP Status</name>
                </application>
            </applications>
            <items>
                <item>
                    <name>CLOSED</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[closed]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>CLOSE_WAIT</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[closewait]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>CLOSING</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[closing]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>ESTABLISHED</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[established]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>FIN_WAIT1</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[finwait1]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>FIN_WAIT2</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[finwait2]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>LAST_ACK</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[lastack]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>LISTEN</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[listen]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>SYN_RECV</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[synrecv]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>SYN_SENT</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[synsent]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                </item>
                <item>
                    <name>TIME_WAIT</name>
                    <type>ZABBIX_ACTIVE</type>
                    <key>tcp.status[timewait]</key>
                    <delay>60</delay>
                    <applications>
                        <application>
                            <name>TCP Status</name>
                        </application>
                    </applications>
                    <triggers>
                        <trigger>
                            <expression>{last()}&gt;10000</expression>
                            <name>There are too many TCP TIME_WAIT status</name>
                            <priority>HIGH</priority>
                        </trigger>
                    </triggers>
                </item>
            </items>
        </template>
    </templates>
    <graphs>
        <graph>
            <name>TCP Status</name>
            <graph_items>
                <graph_item>
                    <color>C80000</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[closed]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>1</sortorder>
                    <color>00C800</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[closewait]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>2</sortorder>
                    <color>0000C8</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[closing]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>3</sortorder>
                    <color>C800C8</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[established]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>4</sortorder>
                    <color>00C8C8</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[finwait1]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>5</sortorder>
                    <color>C8C800</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[finwait2]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>6</sortorder>
                    <color>C8C8C8</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[lastack]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>7</sortorder>
                    <color>960000</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[listen]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>8</sortorder>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[synrecv]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>9</sortorder>
                    <color>000096</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[synsent]</key>
                    </item>
                </graph_item>
                <graph_item>
                    <sortorder>10</sortorder>
                    <color>960096</color>
                    <item>
                        <host>Template TCP Connection Status</host>
                        <key>tcp.status[timewait]</key>
                    </item>
                </graph_item>
            </graph_items>
        </graph>
    </graphs>
</zabbix_export>

附上百度云链接: https://pan.baidu.com/s/16ah420b6N1cZa6j1rLAkfw 提取码: 89aa

2、具体操作如下

(1)在配置中点击导入选项

(2)选择你要导入的xml文件，点击确定即可

(2)导入后，可以在右上角选择的显示所有模板,直接搜索关键字“TCP”即可看到导入的模板

3、在安装zabbix-agent的主机上创建一个shell脚本(确保服务器上已安装了net-tools)

(1)创建shell脚本

vi /usr/local/bin/tcp_status.sh
chmod +x /usr/local/bin/tcp_status.sh

(2)如果没有安装net-tools,可以执行yum install net-tools -y安装即可,因为脚本中用到了netstat命令

yum install net-tools -y

(3)shell脚本内容如下

#!/bin/bash
#this script is used to get tcp and udp connetion status
#tcp status
metric=$1
tmp_file=/tmp/tcp_status.txt
/bin/netstat -an|awk '/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}' > $tmp_file 

case $metric in
   closed)
          output=$(awk '/CLOSED/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   listen)
          output=$(awk '/LISTEN/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   synrecv)
          output=$(awk '/SYN_RECV/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   synsent)
          output=$(awk '/SYN_SENT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   established)
          output=$(awk '/ESTABLISHED/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   timewait)
          output=$(awk '/TIME_WAIT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   closing)
          output=$(awk '/CLOSING/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   closewait)
          output=$(awk '/CLOSE_WAIT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   lastack)
          output=$(awk '/LAST_ACK/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
   finwait1)
          output=$(awk '/FIN_WAIT1/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
   finwait2)
          output=$(awk '/FIN_WAIT2/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
         *)
          echo -e "e[033mUsage: sh  $0 [closed|closing|closewait|synrecv|synsent|finwait1|finwait2|listen|established|lastack|timewait]e[0m"
   
esac

3、在/etc/zabbix/zabbix_agentd.d目录下创建userparameter_tcpstats.conf配置文件

文件内容如下

UserParameter=tcp.status[*],/usr/local/bin/tcp_status.sh $1

4、由于脚本会在tmp目录下生成tcp_status.txt用于保存输出的tcp连接数

故需要确保zabbix用户对该txt文件具备读写权限

chown zabbix:zabbix /tmp/tcp_status.txt

5、重启zabbix-agent服务

systemctl restart zabbix-agent

6、在zabbix-web界面将tcp模板链接到被监控的主机上即可

7、等待1分钟，即可在zabbix-web界面看到监控数据,模板默认采集频率为1分钟，可以自行修改