Xymon Mailing List Archive search

Alert for server connection or CLOSE_WAIT threshold?

3 messages in this thread

list Maik Heinelt · Wed, 17 Dec 2014 08:32:28 +0900 · 
Does someone know an add-on what check the CLOSE_WAIT total or threshold 
of a server?
This would be a good help to get active against attacks, before the 
server gets too busy.

Maik
list Ralph Mitchell · Tue, 16 Dec 2014 18:45:00 -0500 · 
Take a look at the PORTS definition in column in the
server/etc/analysis.cfg file. You can count any port by port number or by
state and get graphs too. It uses information delivered by the standard
client in the ports column.

Ralph Mitchell
▸ quoted from Maik Heinelt
On Dec 16, 2014 6:33 PM, "Maik Heinelt" <user-4ab5eb34adb2@xymon.invalid> wrote:

Does someone know an add-on what check the CLOSE_WAIT total or threshold
of a server?
This would be a good help to get active against attacks, before the server
gets too busy.

Maik
list Deepak Deore · Fri, 2 Jan 2015 19:58:11 -0800 · 
for eg.
in analysis.cfg

HOST=host1.example.com,host2.example.com
        PORT STATE=SYN_RECV MIN=0 MAX=100 COLOR=yellow TRACK="SYN_RECV"
        PORT STATE=ESTABLISHED MIN=0 MAX=500 COLOR=yellow TRACK="EST"


On Tue, Dec 16, 2014 at 3:45 PM, Ralph Mitchell <user-00a5e44c48c0@xymon.invalid>
▸ quoted from Ralph Mitchell
wrote:

Take a look at the PORTS definition in column in the
server/etc/analysis.cfg file. You can count any port by port number or by
state and get graphs too. It uses information delivered by the standard
client in the ports column.

Ralph Mitchell
On Dec 16, 2014 6:33 PM, "Maik Heinelt" <user-4ab5eb34adb2@xymon.invalid> wrote:

Does someone know an add-on what check the CLOSE_WAIT total or threshold
of a server?
This would be a good help to get active against attacks, before the
server gets too busy.

Maik