diff --git a/doc/Extensions/Applications.md b/doc/Extensions/Applications.md index 30f3b02a9d..fa09fceb4f 100644 --- a/doc/Extensions/Applications.md +++ b/doc/Extensions/Applications.md @@ -3011,34 +3011,34 @@ sagan_stat_check](https://metacpan.org/dist/Sagan-Monitoring/view/bin/sagan_stat ## Socket Statistics (ss) -The Socket Statistics application polls ss and scrapes socket statuses. Individual sockets and address families may be filtered out within the script's optional configuration JSON file. +The Socket Statistics application polls ss and scrapes socket statuses. Individual sockets and address-families may be filtered out within the script's optional configuration JSON file. -a. The following socket types are polled directly. Filtering a socket will disable direct polling as-well-as indirect polling via any address families that list the socket as their child: +* The following socket types are polled directly. Filtering a socket type will disable direct polling as-well-as indirect polling within any address-families that list the socket type as their child: ``` -dccp (also exists within AF inet,inet6) -mptcp (also exists within AF inet,inet6) -raw (also exists within AF inet,inet6) -sctp (also exists within AF inet,inet6) -tcp (also exists within AF inet,inet6) -udp (also exists within AF inet,inet6) +dccp (also exists within address-families "inet" and "inet6") +mptcp (also exists within address-families "inet" and "inet6") +raw (also exists within address-families "inet" and "inet6") +sctp (also exists within address-families "inet" and "inet6") +tcp (also exists within address-families "inet" and "inet6") +udp (also exists within address-families "inet" and "inet6") xdp ``` -b. The following socket types are polled within an address family only: +* The following socket types are polled within an address-family only: ``` -inet6 (within AF inet6) -p_dgr (within AF link) -p_raw (within AF link) -ti_dg (within AF tipc) -ti_rd (within AF tipc) -ti_sq (within AF tipc) -ti_st (within AF tipc) -v_dgr (within AF vsock) -v_str (within AF vsock) -unknown (within AF inet,inet6,link,tipc,vsock) +inet6 (within address-family "inet6") +p_dgr (within address-family "link") +p_raw (within address-family "link") +ti_dg (within address-family "tipc") +ti_rd (within address-family "tipc") +ti_sq (within address-family "tipc") +ti_st (within address-family "tipc") +v_dgr (within address-family "vsock") +v_str (within address-family "vsock") +unknown (within address-families "inet", "inet6", "link", "tipc", and "vsock") ``` -c. The following address families are polled directly, however, they also have socket types within their address family "umbrella". Filtering a socket will filter it from the address family. Filtering an address family will filter out all of its child sockets UNLESS those child sockets are polled directly; see (a) above: +* The following address-families are polled directly and have their child socket types tab-indented below them. Filtering a socket type (see "a" above) will filter it from the address-family. Filtering an address-family will filter out all of its child socket types. However, if those socket types are not DIRECTLY filtered out (see "a" above), then they will continue to be monitored either directly or within other address-families in which they exist: ``` inet dccp @@ -3096,9 +3096,9 @@ extend ss /etc/snmp/ss.py ``` 4. (Optional) Create a /etc/snmp/ss.json file and specify: - a.) "ss_cmd" - String path to the ss binary: ["/sbin/ss"] - b.) "socket_types" - A comma-delimited list of socket types to include. The following socket types are valid: dccp, icmp6, mptcp, p_dgr, p_raw, raw, sctp, tcp, ti_dg, ti_rd, ti_sq, ti_st, u_dgr, u_seq, u_str, udp, unknown, v_dgr, v_dgr, xdp. Please note that the "unknown" socket type is represented in ss output with the netid "???". Please also note that the p_dgr and p_raw socket types are specific to the "link" address family; the ti_dg, ti_rd, ti_sq, and ti_st socket types are specific to the "tipc" address family; the u_dgr, u_seq, and u_str socket types are specific to the "unix" address family; and the v_dgr and v_str socket types are specific to the "vsock" address family. Filtering out the parent address families for the aforementioned will also filter out their specific socket types. Specifying "all" includes all of the socket types. For example: to include only tcp, udp, icmp6 sockets, you would specify "tcp,udp,icmp6": ["all"] - c.) "addr_families" - A comma-delimited list of address families to include. The following families are valid: inet, inet6, link, netlink, tipc, unix, vsock. As mentioned above under (b), filtering out the link, tipc, unix, or vsock address families will also filter out their respective socket types. Specifying "all" includes all of the families. For example: to include only inet and inet6 families, you would specify "inet,inet6": ["all"] +a. "ss_cmd" - String path to the ss binary: ["/sbin/ss"] +b. "socket_types" - A comma-delimited list of socket types to include. The following socket types are valid: dccp, icmp6, mptcp, p_dgr, p_raw, raw, sctp, tcp, ti_dg, ti_rd, ti_sq, ti_st, u_dgr, u_seq, u_str, udp, unknown, v_dgr, v_dgr, xdp. Please note that the "unknown" socket type is represented in /sbin/ss output with the netid "???". Please also note that the p_dgr and p_raw socket types are specific to the "link" address family; the ti_dg, ti_rd, ti_sq, and ti_st socket types are specific to the "tipc" address family; the u_dgr, u_seq, and u_str socket types are specific to the "unix" address family; and the v_dgr and v_str socket types are specific to the "vsock" address family. Filtering out the parent address families for the aforementioned will also filter out their specific socket types. Specifying "all" includes all of the socket types. For example: to include only tcp, udp, icmp6 sockets, you would specify "tcp,udp,icmp6": ["all"] +c. "addr_families" - A comma-delimited list of address families to include. The following families are valid: inet, inet6, link, netlink, tipc, unix, vsock. As mentioned above under (b), filtering out the link, tipc, unix, or vsock address families will also filter out their respective socket types. Specifying "all" includes all of the families. For example: to include only inet and inet6 families, you would specify "inet,inet6": ["all"] ``` { "ss_cmd": "/sbin/ss", @@ -3106,7 +3106,7 @@ extend ss /etc/snmp/ss.py "addr_families": "all" } ``` -In order to filter out usually unused socket types, it is recommended to go with the following JSON: +In order to filter out uncommon/unused socket types, the following JSON configuration is recommended: ``` { "ss_cmd": "/sbin/ss", @@ -3116,7 +3116,7 @@ In order to filter out usually unused socket types, it is recommended to go with ``` -5. (Optional) If you have SELinux in Enforcing mode, you must add a module so the script can access socket state: +5. (Optional) If SELinux is in Enforcing mode, you must add a module so the script can poll sockets: ``` cat << EOF > snmpd_ss.te module snmp_ss 1.0; diff --git a/includes/html/graphs/application/ss-af-common.inc.php b/includes/html/graphs/application/ss-af-common.inc.php new file mode 100644 index 0000000000..d028848d8a --- /dev/null +++ b/includes/html/graphs/application/ss-af-common.inc.php @@ -0,0 +1,59 @@ +data['allowed_afs'] ?? []; +$rrdArray = []; + +// This section draws the individual graphs in the device application page +// displaying the SPECIFIED address-family's socket type's states. +if (isset($vars['netid'])) { + $netid = $vars['netid']; + $af_netid = $addr_family . '_' . $netid; + + // Map the socket type to its available statuses. + if (array_key_exists($netid, $ss_socket_states_mapper)) { + $local_ss_socket_states_mapper = $ss_socket_states_mapper[$netid]; + } else { + $local_ss_socket_states_mapper = $ss_socket_states_mapper['default']; + } + + // Create the rrdArray and map the address family's socket type + // to its "clean" socket state name and description. + foreach ($local_ss_socket_states_mapper as $socket_state => $socket_state_clean_name) { + $rrdArray[$af_netid][$socket_state_clean_name] = [ + 'descr' => $socket_state_clean_name, + ]; + } +} + +// This section draws the graph for the application-specific pages +// displaying ALL of the address-family's sockets types' states. +if (! isset($vars['netid']) && in_array($addr_family, $allowed_afs)) { + $allowed_sockets = $app->data['allowed_sockets'] ?? []; + + foreach ($ss_netid_mapper[$addr_family] as $netid) { + // Don't display data for filtered sockets. + if (! in_array($netid, $allowed_sockets)) { + continue; + } + $af_netid = $addr_family . '_' . $netid; + + // Map the socket type to its available statuses. + if (array_key_exists($netid, $ss_socket_states_mapper)) { + $local_ss_socket_states_mapper = $ss_socket_states_mapper[$netid]; + } else { + $local_ss_socket_states_mapper = $ss_socket_states_mapper['default']; + } + + // Create the rrdArray and map the address family's socket type + // to its "clean" socket state name and description. + foreach ($local_ss_socket_states_mapper as $socket_state => $socket_state_clean_name) { + $rrdArray[$af_netid][$socket_state_clean_name] = [ + 'descr' => $af_netid . '_' . $socket_state_clean_name, + ]; + } + } +} + +require 'ss-common.inc.php'; diff --git a/includes/html/graphs/application/ss-common.inc.php b/includes/html/graphs/application/ss-common.inc.php index 15947e9fee..ce196af1a8 100644 --- a/includes/html/graphs/application/ss-common.inc.php +++ b/includes/html/graphs/application/ss-common.inc.php @@ -11,6 +11,11 @@ $smalldescrlen = 20; $rrd_list = []; +if (! $rrdArray) { + graph_error('No Data to Display', 'No Data'); +} + +$i = 0; foreach (array_keys($rrdArray) as $socket_type) { $rrd_filename = Rrd::name($device['hostname'], [ $polling_type, @@ -20,7 +25,6 @@ foreach (array_keys($rrdArray) as $socket_type) { ]); if (Rrd::checkRrdExists($rrd_filename)) { - $i = 0; foreach ($rrdArray[$socket_type] as $socket_status => $socket_status_desc) { $rrd_list[$i]['filename'] = $rrd_filename; $rrd_list[$i]['descr'] = $socket_status_desc['descr']; @@ -28,7 +32,7 @@ foreach (array_keys($rrdArray) as $socket_type) { $i++; } } else { - d_echo('RRD ' . $rrd_filename . ' not found'); + graph_error('No Data file ' . basename($rrd_filename), 'No Data'); } } diff --git a/includes/html/graphs/application/ss-netid-common.inc.php b/includes/html/graphs/application/ss-netid-common.inc.php new file mode 100644 index 0000000000..c4c4df09eb --- /dev/null +++ b/includes/html/graphs/application/ss-netid-common.inc.php @@ -0,0 +1,20 @@ + $socket_state_clean_name) { + $rrdArray[$netid][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; +} + +require 'ss-common.inc.php'; diff --git a/includes/html/graphs/application/ss_dccp.inc.php b/includes/html/graphs/application/ss_dccp.inc.php index cc7a1265a6..da273f957c 100644 --- a/includes/html/graphs/application/ss_dccp.inc.php +++ b/includes/html/graphs/application/ss_dccp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_inet.inc.php b/includes/html/graphs/application/ss_inet.inc.php index 9679fc6626..70e0a7371e 100644 --- a/includes/html/graphs/application/ss_inet.inc.php +++ b/includes/html/graphs/application/ss_inet.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_inet6.inc.php b/includes/html/graphs/application/ss_inet6.inc.php index aef79f63ba..d2df6a0e13 100644 --- a/includes/html/graphs/application/ss_inet6.inc.php +++ b/includes/html/graphs/application/ss_inet6.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_link.inc.php b/includes/html/graphs/application/ss_link.inc.php index 8d6b66abd4..db9ab6d089 100644 --- a/includes/html/graphs/application/ss_link.inc.php +++ b/includes/html/graphs/application/ss_link.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_mptcp.inc.php b/includes/html/graphs/application/ss_mptcp.inc.php index 712b0acb15..dbba3a1764 100644 --- a/includes/html/graphs/application/ss_mptcp.inc.php +++ b/includes/html/graphs/application/ss_mptcp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_netlink.inc.php b/includes/html/graphs/application/ss_netlink.inc.php index 76a576c084..90f92d0dc2 100644 --- a/includes/html/graphs/application/ss_netlink.inc.php +++ b/includes/html/graphs/application/ss_netlink.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$addr_family][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_raw.inc.php b/includes/html/graphs/application/ss_raw.inc.php index fd64fa545f..cb7c1c37b3 100644 --- a/includes/html/graphs/application/ss_raw.inc.php +++ b/includes/html/graphs/application/ss_raw.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_sctp.inc.php b/includes/html/graphs/application/ss_sctp.inc.php index ad21f8cb1b..f45b4df11f 100644 --- a/includes/html/graphs/application/ss_sctp.inc.php +++ b/includes/html/graphs/application/ss_sctp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_tcp.inc.php b/includes/html/graphs/application/ss_tcp.inc.php index 65ba4842e7..425d1e41dc 100644 --- a/includes/html/graphs/application/ss_tcp.inc.php +++ b/includes/html/graphs/application/ss_tcp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_tipc.inc.php b/includes/html/graphs/application/ss_tipc.inc.php index d1613aab95..975b85e73b 100644 --- a/includes/html/graphs/application/ss_tipc.inc.php +++ b/includes/html/graphs/application/ss_tipc.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_udp.inc.php b/includes/html/graphs/application/ss_udp.inc.php index 3ebf82e462..2511737eea 100644 --- a/includes/html/graphs/application/ss_udp.inc.php +++ b/includes/html/graphs/application/ss_udp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/graphs/application/ss_unix.inc.php b/includes/html/graphs/application/ss_unix.inc.php index bbc631f85a..9af085d4d3 100644 --- a/includes/html/graphs/application/ss_unix.inc.php +++ b/includes/html/graphs/application/ss_unix.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_vsock.inc.php b/includes/html/graphs/application/ss_vsock.inc.php index ab6e6bbe23..502ffaa96a 100644 --- a/includes/html/graphs/application/ss_vsock.inc.php +++ b/includes/html/graphs/application/ss_vsock.inc.php @@ -1,24 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = [ - 'descr' => $socket_state_clean_name, - ]; -} - -require 'ss-common.inc.php'; +require 'ss-af-common.inc.php'; diff --git a/includes/html/graphs/application/ss_xdp.inc.php b/includes/html/graphs/application/ss_xdp.inc.php index 0cbf15070c..54ea84c45a 100644 --- a/includes/html/graphs/application/ss_xdp.inc.php +++ b/includes/html/graphs/application/ss_xdp.inc.php @@ -1,18 +1,5 @@ $socket_state_clean_name) { - $rrdArray[$socket_type][$socket_state_clean_name] = ['descr' => $socket_state_clean_name]; -} - -require 'ss-common.inc.php'; +require 'ss-netid-common.inc.php'; diff --git a/includes/html/pages/apps.inc.php b/includes/html/pages/apps.inc.php index 5e995b208c..edb817c249 100644 --- a/includes/html/pages/apps.inc.php +++ b/includes/html/pages/apps.inc.php @@ -523,6 +523,20 @@ $graphs['privoxy'] = [ ]; $graphs['ss'] = [ 'sockets', + 'dccp', + 'inet', + 'inet6', + 'link', + 'mptcp', + 'netlink', + 'raw', + 'sctp', + 'tcp', + 'tipc', + 'udp', + 'unix', + 'vsock', + 'xdp', ]; $graphs['borgbackup'] = [ 'unique_csize',