安装iptstate
# yum install iptstate
配置zabbix key
iptables.conf
# cat /etc/zabbix/zabbix_agentd.d/iptables.conf UserParameter=iptstate[*],/etc/zabbix/monitor_scripts/iptables.sh $1
配置监控脚本:
# cat /etc/zabbix/monitor_scripts/iptables.sh #!/bin/bash#iptables 监控脚本#2016/11-18function tcp { sudo iptstate --single | grep tcp | wc -l} function tcp-syn { sudo iptstate --single | grep SYN | wc -l} function tcp-timewait { sudo iptstate --single | grep TIME_WAIT | wc -l} function tcp-established { sudo iptstate --single | grep ESTABLISHED | wc -l } function tcp-close { sudo iptstate --single | grep CLOSE | wc -l} function udp { sudo iptstate --single | grep udp | wc -l} function icmp { sudo iptstate --single | grep icmp | wc -l}function all { sudo iptstate --single | wc -l }# Run the requested function $1 查看脚本的权限：
# lltotal 8-rwxr-xr-x 1 root root 622 Apr 24 18:44 iptables.sh
添加sudo执行权限：
sed -i "s/^Defaults requiretty/#Defaults requiretty/g" /etc/sudoersecho “zabbix ALL=NOPASSWD: /usr/sbin/iptstate” /etc/sudoers
模板配置：
# cat Template-iptables.xml2.0 2016-11-18T09:27:03Z Template-Security Template-iptables Template-iptables Template-Security Iptstates total all 0 0 iptstate[all] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates total icmp 0 0 iptstate[icmp] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates tcp close 0 0 iptstate[tcp-close] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates tcp established 0 0 iptstate[tcp-established] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates tcp syn 0 0 iptstate[tcp-syn] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates tcp timewait 0 0 iptstate[tcp-timewait] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates total tcp 0 0 iptstate[tcp] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates total udp 0 0 iptstate[udp] 60 90 365 0 3 0 0 0 0 1 0 0 0 Iptstates {Template-iptables:iptstate[all].last()}<3 iptables not running 0 2 iptstates条目小于3认为关闭或者异常状态 0 iptstate 900 200 0.0000 100.0000 1 1 0 1 0 0.0000 0.0000 0 0 0 0 0 0 00C800 0 2 0 Template-iptables iptstate[tcp-close] 1 0 C80000 0 2 0 Template-iptables iptstate[tcp-established] 2 0 0000C8 0 2 0 Template-iptables iptstate[tcp-syn] 3 0 C800C8 0 2 0 Template-iptables iptstate[tcp-timewait] 4 0 00C8C8 0 2 0 Template-iptables iptstate[all] 5 0 C8C800 0 2 0 Template-iptables iptstate[icmp] 6 0 C8C8C8 0 2 0 Template-iptables iptstate[tcp] 7 0 009600 0 2 0 Template-iptables iptstate[udp]
导入模板:
重启zabbix-agent:
# /etc/init.d/zabbix-agent restartShutting down Zabbix agent: [ OK ]Starting Zabbix agent: [ OK ]
增加模板本上档host
