4

I would like to log a warning message to /var/log/messages file if either ingress or egress bandwidth on eth0 interface is over a certain threshold. I could do this with a script which reads the value of /sys/devices/virtual/net/eth0/statistics/[rt]x_bytes file, stores the value, sleeps a second, reads those very same values again, calculates the amount of bits per second sent, compares the result with certain threshold and if higher, writes a message to /var/log/messages file. However, is there a smarter method? I mean for example with iptables or tc which could create a log message in case certain bandwidth threshold on interface is exceeded?

  • 1
    I haven't used it myself but I don't think iptables -m limit actually imposes limits by itself. I think it's just used for matching traffic according to rate. You may try to use it with -j LOG to see if it lets the activity happen and it just logs to syslog. – Bratchley Mar 12 '15 at 15:37
  • Are you open to averaging solutions like sysstat/sa/sar? – Ulrich Schwarz Mar 12 '15 at 15:40
  • @Bratchley IMHO this can not be achieved with iptables limit module. limit module seems to be suitable for logging relatively infrequent events. For example iptables -I INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG would log all the ingress ICMP messages up to 1 log entry per second, i.e. even if more than one ICMP message per second is received, only one is logged. In a nutshell, iptables -m limit does not seem to be a correct tool for this. @Ulrich Schwarz as much as I tested with sar, it simply seems to parse /proc so this gives no additional value. – Martin Mar 16 '15 at 16:05
  • 1
    @Martin that was my main suggestion but looking at the man pages, it looks like there's a a "fuzzy logic controller" with a --lower-limit option that would allow you to -j LOG if traffic gets above a certain PPS. That would likely create a large volume of logs thereafter, though. It might put you in the right direction. – Bratchley Mar 16 '15 at 17:49
  • @Bratchley Thanks for this suggestion! However, fuzzy counts packets in second(pps) not bits in second(bps) and as I have packets with variable length, then this would not work for me. In addition, the way fuzzy module operates is not quite what I need- for example even if I could specify --lower-limit 1Mbps and --upper-limit 10Mbps and traffic is bit over 1Mbps, then only few of the 1Mbps violations are logged. If traffic peaks to 10Mbps, then almost all the violations are logged. fuzzy module seems to be for (D)DOS mitigation. – Martin Mar 17 '15 at 23:55
3
+50

You can use vnstat with -tr option, then compare with threshold and write log if exceeded.

-tr time  
 Calculate how much traffic goes through the selected interface during the giventimeseconds. Thetimewill be 5 seconds if a number parameter isn't included.
2

I finally found the solution which I was looking for. Iptables has rateest module which does exactly that. For example:

# collects all ingress traffic to RATEEST target
iptables -A INPUT -j RATEEST --rateest-name RE1 --rateest-interval 500.0ms --rateest-ewmalog 1s
# creates a log entry(jumps to LOG target) if rate is greater than 10Mbps
iptables -A INPUT -m rateest --rateest RE1 --rateest-gt --rateest-bps 10Mbps -j LOG --log-prefix "Ingress bandwidth >10Mbps "
0
netstat -i 

Just for starters. Look at the headers for RX-OK and TX-OK. Set this up with cron and that's it.

#!/bin/bash
# Mar 2015
# Get bytes transmitted and received on eth0 and log msg.
echo " "
bytein=`netstat -i | grep eth0 | awk '{print $4 }'`
byteout=`netstat -i | grep eth0 | awk '{print $8 }'`
total=$((${bytein} + ${byteout}))
# echo "IN=$bytein, OUT=$byteout, TOTAL=$total"
max=1000000
outfile=/var/log/messages
msg="Bandwidth has exceeded $max bytes"
if [ $total -gt $max ]; then
    echo "$msg" >> $outfile
    echo $msg
fi

What's the big picture OP? I could see doing this for different users to limit their bandwidth, by why do this for the eth0 interface?

  • 1
    They're aware of how to get the information through a script, they're asking for a more standard and automatic way of doing it using common OS mechanisms rather than something they made themselves. – Bratchley Mar 17 '15 at 17:41
  • @Bratchley, it's using common OS mechanisms (kernel packet/byte counters) and it's not a particularly complicated script. That's a good use of the tools available. IMO, of course. – roaima Mar 17 '15 at 22:29
  • @roaima As Bratchley already mentioned, I would like to avoid scripts for this task as I need to keep those running in background in an endless loop. To be honest, I was fairly sure that such functionality is built into NetFilter or at least extensible with NetFilter modules. @user77853 eth0 interface is dedicated for one VPN tunnel. However, as I mentioned in my initial post/question, I'm not looking for a script to log a warning message if either ingress or egress bandwidth on interface is over a certain threshold. – Martin Mar 18 '15 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.