banshee/linux-collection/linux/ssh/interfaces

Network interfaces of a Linux, by SSH

Returns, for each network interface, the link state, the negotiated speed and duplex, the MTU, the traffic, errors and drops, its IP addresses, and the members of a bond. Thirteen watches are offered, each one set on the probe.

What changed since version 1

Members of a bridge, like members of a bond, are no longer judged on their addresses.
no-address and missing are no longer checked by default, and missing expects no name: an interface without an address (a VLAN parent, an unused port) raised a critical, and names like eth0 depend on the machine.
mtu expects 1500 instead of 9000.
A kernel older than 3.15, without carrier_changes, no longer stops the collector; a missing ip command does, with its error, where version 1 counted no address and raised no-address.
Nothing readable in /sys/class/net stops the collector misconfigured (version 1: unreachable), as the machine answered.
Watch ids and kinds are unchanged: a probe upgraded from version 1 keeps its settings.

How it works

The collector reads in one command the files of /sys/class/net (state, speed, duplex, MTU, bond members, bridge port, counters) with grep -s -H, then counts the global addresses of each interface with ip -o addr show scope global.

Traffic comes from the counters over the interval between two runs: there is none on the first run.
A file a driver does not serve (the speed of a link that is down, of a Wi-Fi card) is silenced by grep -s, and its value is missing.
Portable: /sys/class/net is written by the kernel the same way on Alpine, Debian and Fedora; -s and -H are options of BusyBox as of GNU grep; ip -o … scope global is understood by iproute2 (Debian, Fedora) and by the ip applet of BusyBox (Alpine). Nothing is written on the target.

Prerequisites

an SSH account for monitoring, without write rights;
the fingerprint of the server's host key, set in protocol:ssh:fingerprint (not needed when the Security settings trust the first SSH fingerprint presented).

Outputs

Output	Unit	Per	Meaning
`link`	—	interface	`up`, `down`, `lowerlayerdown`…
`carrier-changes`	—	interface	link changes since boot
`speed`	Mbit/s	interface	negotiated speed
`duplex`	—	interface	`full` or `half`
`mtu`	—	interface	MTU
`traffic-in`, `traffic-out`, `traffic`	bit/s	interface	traffic in, out and both
`in-percent`, `out-percent`	%	interface	traffic over the negotiated speed
`packets`	packets/s	interface	packets in and out
`errors`	errors/s	interface	errors in and out
`drops`	packets/s	interface	drops in and out
`drop-percent`	%	interface	share of packets dropped
`addresses`	—	interface	global IP addresses, bond and bridge members excluded
`bond-members`, `bond-members-up`	—	bond	members, and those whose link is up

By default, lo, docker* and veth* are left out; the selection is changed on the probe.

Watches

Watch	Kind	Defaults	Checked
`link-down` Link down	state, on `link`	critical `down`, `lowerlayerdown`	yes
`link-flapping` Link flapping	increase, on `carrier-changes`	warning 3, window 1 h	yes
`speed-degraded` Negotiated speed degraded	custom	expected 1000 Mbit/s; half-duplex critical	yes
`saturation-in` Inbound saturation	above, on `in-percent`	warning 70, critical 90, for 5 min	yes
`saturation-out` Outbound saturation	above, on `out-percent`	warning 70, critical 90, for 5 min	yes
`errors` Errors	custom	warning beyond 1 error/min, critical beyond 0.1 % of traffic	yes
`drops` Packets dropped	above, on `drop-percent`	warning 0.5, critical 2	yes
`traffic-unusual` Unusual traffic	habit, on `traffic`	floor 10,000,000	no
`mute` Silent interface	silence, on `packets`	warning 10 min	no
`missing` Missing interface	missing, on `link`	no expected name	no
`bond-degraded` Bond degraded	custom	warning when a member is down, critical when 1 is left	yes
`mtu` Unexpected MTU	expect, on `mtu`	warning unless 1500	no
`no-address` No IP address left	below, on `addresses`	critical 1	no

Limits

Virtual interfaces (virtio, most cloud NICs) report no speed: they have no usage percent and no speed-degraded.
The counters of a bond add up those of its members: the traffic shows on both.