Merge ~xavpaice/charm-nrpe:arp_cache into ~nrpe-charmers/charm-nrpe:master

[Xav Paice]

Add check_arp_cache

[🤖 Canonical IS Merge Bot (canonical-is-mergebot)]

This merge proposal is being monitored by mergebot. Change the status to Approved to merge.

[Alvaro Uria (aluria)]

Please find comments inline.

review: Needs Fixing

[Xav Paice (xavpaice)]

Thanks for the review - I've updated the change based on those comments, and added a couple of notes inline.

Unmerged commits

cb8c792... by Xav Paice on 2019-03-11

Add check_arp_cache

Adds a new default check for non-container units that compares the
number of arp entries against the kernel limits configured, and alerts
if >80%.

diff --git a/.gitignore b/.gitignore
index 631fcbc..37ed1f8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@
 *.pyc
 __pycache__/
 .venv/
+.idea
diff --git a/files/plugins/check_arp_cache.py b/files/plugins/check_arp_cache.py
new file mode 100755
index 0000000..51f8935
--- /dev/null
+++ b/files/plugins/check_arp_cache.py
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+# -*- coding: us-ascii -*-
+
+# Copyright (C) 2019 Canonical
+# All rights reserved
+
+import argparse
+import os
+
+from nagios_plugin3 import (
+    CriticalError,
+    WarnError,
+    UnknownError,
+    try_check,
+)
+
+
+def check_arp_cache(warn, crit):
+    """Checks the usage of arp cache against gc_thresh.
+
+    Alerts when the number of arp entries exceeds a threshold of gc_thresh3.
+    See https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt for
+    full details.
+
+    :param warn: integer, % level of hard limit at which to raise Warning
+    :param crit: integer, % level of hard limit at which to raise Critical
+    """
+
+    ARP_TABLE_ENTRIES = '/proc/net/arp'
+    GC_THRESH_LOCATION = '/proc/sys/net/ipv4/neigh/default/gc_thresh3'
+
+    if not (os.path.exists(ARP_TABLE_ENTRIES) and os.path.exists(GC_THRESH_LOCATION)):
+        raise UnknownError("No arp table found!")
+
+    with open(GC_THRESH_LOCATION) as fd:
+        gc_thresh3 = int(fd.read())
+
+    with open(ARP_TABLE_ENTRIES) as fd:
+        arp_cache = fd.read().count('\n') - 1  # remove header
+    extra_info = "arp cache entries: {}".format(arp_cache)
+
+    warn_threshold = gc_thresh3 * warn / 100
+    crit_threshold = gc_thresh3 * crit / 100
+
+    if arp_cache >= crit_threshold:
+        message = "CRITICAL: arp cache is more than {} of limit, {}".format(crit, extra_info)
+        raise CriticalError(message)
+    if arp_cache >= warn_threshold:
+        message = "WARNING: arp cache is more than {} of limit, {}".format(warn, extra_info)
+        raise WarnError(message)
+
+    print('OK: arp cache is healthy: {}'.format(extra_info))
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(description='Check bond status')
+    parser.add_argument('--warn', '-w', type=int,
+                        help='% of gc_thresh3 to exceed for warning',
+                        default=60)
+    parser.add_argument('--crit', '-c', type=int,
+                        help='% of gc_thresh3 to exceed for critical',
+                        default=80)
+    args = parser.parse_args()
+    return args
+
+
+def main():
+    args = parse_args()
+    try_check(check_arp_cache, args.warn, args.crit)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/hooks/nrpe_helpers.py b/hooks/nrpe_helpers.py
index 32dfc4f..c3adc6e 100644
--- a/hooks/nrpe_helpers.py
+++ b/hooks/nrpe_helpers.py
@@ -4,6 +4,7 @@ import socket
 import subprocess
 import yaml
 
+from charmhelpers.core.host import is_container
 from charmhelpers.core.services import helpers
 from charmhelpers.core import hookenv
 
@@ -413,6 +414,15 @@ class SubordinateCheckDefinitions(dict):
             },
         ]
 
+        if not is_container():
+            arp_check = {
+                'description': 'ARP cache entries',
+                'cmd_name': 'check_arp_cache',
+                'cmd_exec': os.path.join(local_plugin_dir, 'check_arp_cache.py'),
+                'cmd_params': '-w 60 -c 80',  # Specify params here to enable the check, not required otherwise.
+            }
+            checks.append(arp_check)
+
         if hookenv.config('lacp_bonds').strip():
             for bond_iface in hookenv.config('lacp_bonds').strip().split():
                 if os.path.exists('/sys/class/net/{}'.format(bond_iface)):