Shulou(Shulou.com)06/02 Report--

Because there are many applications deployed on the company's servers, when there are large concurrent visits, business logic problems, or abnormal traffic access, it is necessary to locate the fault of business applications, so using python to call iftop commands to obtain application process traffic, combined with zabbix, can help locate and analyze problems. The following is the content of the script, and the general idea is:

Use the iftop command iftop-t-P-N-n-s 2 to obtain traffic information and process the obtained traffic information. Unit conversion, the total traffic of all links in the same application (because an application will have many links, each link has traffic, and the total traffic of the application can be obtained by adding all of them) #! / usr/bin/python#coding=utf-8# carries on statistics for the port traffic monitored by the business. Ignore the random port traffic statistics # if in view of the sudden increase in traffic, find its process for alarm, you can not do statistics, get the traffic to judge, if greater than how many threshold Then output import osdef change_unit (unit): if "Mb" in unit: flow = float (unit.strip ("Mb")) * 1024 return flow elif "Kb" in unit: flow = float (unit.strip ("Kb")) return flow elif "b" in unit: flow = float (unit.strip ("b")) / 1024 return flowdef get_flow (): # iftop Parameter:-t uses a text interface without ncurses -P displays host and port information,-N only shows connection port number The service name corresponding to the port is not displayed. The host information output by-n is displayed through IP. No DNS parsing -print a text output after s num num seconds and exit mes = os.popen ("iftop-t-P-N-n-s 22 > / dev/null | grep-A 1-E'^ [0-9]'"). Read () # splits iftop_list = mes.split ("\ n") count = len (iftop_list) # definition dictionary to store host information and incoming and outgoing traffic Flow_dict = {} # definition list Store host information host_ips = [] # add the host to the array, query whether the new host is in the list, if not, add the host information to host_ips, and assemble a new dictionary value into the flow_dict dictionary. If there is host information in host_ips, take out the dictionary value, recalculate the increased traffic value, and then add the dictionary flow_dict # the count/2 here is the data obtained by iftop If the inbound and outbound traffic is grouped into a group, there are count/2 traffic connections. You can execute the iftop command in os.popen to understand for i in range (count/2): flow_msg = "" # get the sent ip address (local ip address), port (local port), and the traffic sent, after it is separated by newline characters. Data even digit is locally sent traffic information location_li_s = iftop_ list [I * 2] send_flow_lists = location_li_s.split ("") # empty element while''in send_flow_lists: send_flow_lists.remove ('') host_ip = send_flow_lists [1] send_flow = send_ Flow_lists [3] send_flow_float = change_unit (send_flow) # print send_flow_lists # get received traffic location_li_r = iftop_ list [I * 2q1] rec_flow_lists = location_li_r.split (") while''in rec_flow_lists: rec_flow_lists.remove ('') Rec_flow = rec_flow_lists [3] rec_flow_float = change_unit (rec_flow) # remove random ports with local linux greater than 10000 Since none of the company's business applications is greater than 10000, you can also remove port = host_ip.split (":") [1] if int (port) < 10000: # if the host information does not exist, add host_ips. If it exists, the dictionary value will be taken. Add the inbound and outbound traffic if host_ip not in host_ips: host_ips.append (host_ip) flow_msg = str (float ('% 2.f'% send_flow_float)) + ":" + str (float ('.2f'% rec_flow_float)) flow_ flows [host _ ip] = flow _ msg else: flow_dict_msg = flow_ traffic [host _ ip] flow_dict_msg_li = flow_dict_msg.split (":") # get the send and receive traffic flow_dict_msg_send = float (host [0]) flow_dict in the dictionary _ msg_rec = float (flow_dict_msg_li [1]) # send and receive traffic in the dictionary and new traffic obtained add flow_add_send = flow_dict_msg_send + send_flow_float flow_add_rec = flow_dict_msg_rec + rec_flow_float # to the new result Update to the dictionary flow_msg = str (float ('% .2f'% flow_add_send)) + ":" + str (float ('% .2f'% flow_add_rec)) flow_ traffic [host _ ip] = flow_msg for key in flow_dict: flow_li = flow_ send [key] .split (":") # flow_li [0] is the sending traffic Flow_li [1] is received traffic in Kb print key + "|" + flow_li [0] + "|" + flow_li [1] get_flow ()

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.