Merge lp:~brad-marshall/charms/trusty/nrpe-external-master/add-conntrack-check into lp:charms/nrpe-external-master

[Brad Marshall]

Add iptables conntrack nrpe check

Unmerged revisions

43. By Brad Marshall on 2017-03-27

Added conntrack nrpe check

=== modified file 'config.yaml'
--- config.yaml	2015-05-01 13:23:24 +0000
+++ config.yaml	2017-03-30 07:26:20 +0000
@@ -64,6 +64,10 @@
     default: "-w 90% -c 75%"
     type: string
     description: Swap check
+  conntrack:
+    default: "-w 80 -c 90"
+    type: string
+    description: conntrack table check
   hostgroups:
     default: ""
     type: string

=== added file 'files/check_conntrack.sh'
--- files/check_conntrack.sh	1970-01-01 00:00:00 +0000
+++ files/check_conntrack.sh	2017-03-30 07:26:20 +0000
@@ -0,0 +1,66 @@
+#!/bin/sh
+# This file is managed by juju.  Do not make local changes.
+
+# Copyright (C) 2013, 2016 Canonical Ltd.
+# Author: Haw Loeung <[e-mail]>
+#         Paul Gear <[e-mail]>
+
+# Alert when current conntrack entries exceeds certain percentage of max. to
+# detect when we're about to fill it up and start dropping packets.
+
+set -eu
+
+STATE_OK=0
+STATE_WARNING=1
+STATE_CRITICAL=2
+STATE_UNKNOWN=3
+
+if ! lsmod | grep -q conntrack; then
+    echo "OK: no conntrack modules present"
+    exit $STATE_OK
+fi
+
+max=$(sysctl net.netfilter.nf_conntrack_max | awk '{ print $3 }')
+current=$(sysctl net.netfilter.nf_conntrack_count | awk '{ print $3 }')
+
+# default thresholds
+crit=90
+warn=80
+
+# parse command line
+set +e
+OPTIONS=$(getopt w:c: "$@")
+if [ $? -ne 0 ]; then
+    echo "Usage: $0 [-w warningpercent] [-c criticalpercent]" >&2
+    echo "       Check nf_conntrack_count against nf_conntrack_max" >&2
+    exit $STATE_UNKNOWN
+fi
+set -e
+
+set -- $OPTIONS
+while true; do
+    case "$1" in
+	-w) warn=$2; shift 2 ;;
+	-c) crit=$2; shift 2 ;;
+	--) shift;   break ;;
+	*)  break ;;
+    esac
+done
+
+percent=$((current * 100 / max))
+stats="| current=$current max=$max percent=$percent;$warn;$crit"
+
+threshold=$((max * crit / 100))
+if [ $current -gt $threshold ]; then
+    echo "CRITICAL: conntrack table nearly full. $stats"
+    exit $STATE_CRITICAL
+fi
+
+threshold=$((max * warn / 100))
+if [ $current -gt $threshold ]; then
+    echo "WARNING: conntrack table filling. $stats"
+    exit $STATE_WARNING
+fi
+
+echo "OK: conntrack table normal $stats"
+exit $STATE_OK

=== modified file 'hooks/config-changed'
--- hooks/config-changed	2015-05-21 15:52:29 +0000
+++ hooks/config-changed	2017-03-30 07:26:20 +0000
@@ -41,6 +41,7 @@
 LOAD=$(config-get load)
 USERS=$(config-get users)
 SWAP=$(config-get swap)
+CONNTRACK=$(config-get conntrack)
 
 if [[ "$PROCS" == "auto" ]]; then
     PROC_COUNT=$(nproc)
@@ -80,6 +81,9 @@
 echo "# Swap" > /etc/nagios/nrpe.d/check_swap.cfg
 echo "command[check_swap]=/usr/lib/nagios/plugins/check_swap ${SWAP}" >> /etc/nagios/nrpe.d/check_swap.cfg
 
+echo "# Conntrack" > /etc/nagios/nrpe.d/check_conntrack.cfg
+echo "command[check_conntrack]=/usr/local/lib/nagios/plugins/check_conntrack.sh ${CONNTRACK}" >> /etc/nagios/nrpe.d/check_conntrack.cfg
+
 #------------------------------------------------------
 # Host check
 #------------------------------------------------------