Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add system socket MetricSet #3246

Merged
merged 3 commits into from
Jan 2, 2017
Merged

Add system socket MetricSet #3246

merged 3 commits into from
Jan 2, 2017

Commits on Jan 2, 2017

  1. Update gosigar version to 171a3c9e31dde9688c154ba94be6cd5d8a78bf64

    @andrewkroh
    andrewkroh committed Jan 2, 2017
    Configuration menu
    Copy the full SHA
    5eb8fa5 View commit details
    Browse the repository at this point in the history

  2. Add github.com/elastic/procfs from abf152e5f3e97f2fafac028d2cc06c1feb… 

    …87ffa5
    @andrewkroh
    andrewkroh committed Jan 2, 2017
    Configuration menu
    Copy the full SHA
    b8235d8 View commit details
    Browse the repository at this point in the history

  3. Add system socket MetricSet 

    The system.socket metricset reports an event for each new TCP socket that it
sees. It does this by polling the kernel to get a dump of all sockets.
So using a short polling interval with this metricset is important to
not miss short lived connections.

The metricset reports the process that has the socket open. It does this
by associating the socket's inode to the process that has a file
descriptor open pointing to the socket's inode. It reads /proc and
/proc/<pid>/fd just prior to polling the kernel to get all sockets.

A reverse lookup can be performed by the metricset on the remote IP and the
returned hostname will be added to the event and cached. The is disabled by
default and can be enabled through the configuration.  If a hostname is found
then the eTLD+1 (effective top-level domain plus one level) value will also be
added to the event.

For the IP address fields the index template for Elasticsearch 5.x uses
the ip field type. But for Elasticsearch 2.x it uses string because the
ip field type in 2.x does not support IPv6 addresses.
    @andrewkroh
    andrewkroh committed Jan 2, 2017
    Configuration menu
    Copy the full SHA
    c5a6c97 View commit details
    Browse the repository at this point in the history