tcp

// The TCP connections of a Windows, by SSH, IPv4 and IPv6 together: those established, those waiting to be
// closed on either side (TIME-WAIT, CLOSE-WAIT), the listening ports and the total.
// Runs one PowerShell command that only reads Get-NetTCPConnection (the CIM class MSFT_NetTCPConnection),
// counted by state on the target, so that a server with a hundred thousand connections returns a few
// lines. A state is named in English whatever the language of Windows: "Established", "TimeWait".
need('protocol:ssh');

output('established', 'number', array('label' => 'Established connections'));
output('time-wait', 'number', array('label' => 'Connections in TIME-WAIT'));
output('close-wait', 'number', array('label' => 'Connections in CLOSE-WAIT'));
output('listen', 'number', array('label' => 'Listening ports'));
output('total', 'number', array('label' => 'TCP connections'));

// No threshold by default: what is normal depends on the role of the server. CLOSE-WAIT piling up says an
// application does not close its connections.
watch.above('too-many', 'Too many TCP connections', 'established', array('enabled' => false));
watch.habit('unusual', 'Unusual number of connections', 'established', array('enabled' => false));
watch.above('close-wait', 'Connections left open', 'close-wait', array('warning' => 100, 'for' => '3 runs', 'enabled' => false));

// One object per state present: Name, the state, and Count, its number of connections.
$read = ssh.run("powershell -NoProfile -NonInteractive -Command \""
    . "ConvertTo-Json -Compress -InputObject @(Get-NetTCPConnection"
    . " | Group-Object State -NoElement | Select-Object Name, Count)\"");
$answer = text.trim($read['output']);
if (list.count(text.match($answer, '^\[')) == 0) {
    fail('misconfigured', 'PowerShell did not return the TCP connections', $answer . $read['errors']);
}
$count = array();
$total = 0;
foreach (json.read($answer) as $state) {
    $count[$state['Name']] = $state['Count'];
    $total = $total + $state['Count'];
}
// The collector's own SSH connection is a TCP connection: reading none is reading nothing.
if ($total == 0) {
    fail('misconfigured', 'No connection found by Get-NetTCPConnection', $answer . $read['errors']);
}

value('established', list.get($count, 'Established', 0));
value('time-wait', list.get($count, 'TimeWait', 0));
value('close-wait', list.get($count, 'CloseWait', 0));
value('listen', list.get($count, 'Listen', 0));
value('total', $total);