Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add lock option to the IPtables input plugin #2201

Merged
merged 3 commits into from
Feb 1, 2017
Merged

Add lock option to the IPtables input plugin #2201

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
349303b
Update README.md
ldep30 Dec 26, 2016
c6ed82d
Add lock support to the IPtables input plugin
ldep30 Dec 26, 2016
526197f
Update iptables.go
ldep30 Jan 26, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions plugins/inputs/iptables/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,17 @@ You may edit your sudo configuration with the following:
telegraf ALL=(root) NOPASSWD: /usr/bin/iptables -nvL *
```

### Using IPtables lock feature

Defining multiple instances of this plugin in telegraf.conf can lead to concurrent IPtables access resulting in "ERROR in input [inputs.iptables]: exit status 4" messages in telegraf.log and missing metrics. Setting 'use_lock = true' in the plugin configuration will run IPtables with the '-w' switch, allowing a lock usage to prevent this error.

### Configuration:

```toml
# use sudo to run iptables
use_sudo = false
# run iptables with the lock option
use_lock = false
# defines the table to monitor:
table = "filter"
# defines the chains to monitor:
Expand Down
12 changes: 10 additions & 2 deletions plugins/inputs/iptables/iptables.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
// Iptables is a telegraf plugin to gather packets and bytes throughput from Linux's iptables packet filter.
type Iptables struct {
UseSudo bool
UseLock bool
Table string
Chains []string
lister chainLister
Expand All @@ -32,8 +33,11 @@ func (ipt *Iptables) SampleConfig() string {
## iptables require root access on most systems.
## Setting 'use_sudo' to true will make use of sudo to run iptables.
## Users must configure sudo to allow telegraf user to run iptables with no password.
## iptables can be restricted to only list command "iptables -nvL"
## iptables can be restricted to only list command "iptables -nvL" or "iptables -wnvl" if using 'use_lock = true'
use_sudo = false
## Setting 'use_lock' to true will run iptables with xtables lock support.
## This option is useful to avoid iptables concurrency errors when running multiple instances of this plugin.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

limit line length to 80 chars and mention that use_lock simply adds the -w option to the iptables

use_lock = false
## defines the table to monitor:
table = "filter"
## defines the chains to monitor:
Expand Down Expand Up @@ -75,7 +79,11 @@ func (ipt *Iptables) chainList(table, chain string) (string, error) {
name = "sudo"
args = append(args, iptablePath)
}
args = append(args, "-nvL", chain, "-t", table, "-x")
iptablesBaseArgs := "-nvL"
if ipt.UseLock {
iptablesBaseArgs = "-wnvL"
}
args = append(args, iptablesBaseArgs, chain, "-t", table, "-x")
c := exec.Command(name, args...)
out, err := c.Output()
return string(out), err
Expand Down