tcp

// The TCP connections of a Windows, by WinRM, IPv4 and IPv6 together: those established, those waiting to
// be closed on either side (TIME-WAIT, CLOSE-WAIT), the listening ports and the total.
// Runs one PowerShell script that only reads Get-NetTCPConnection (the CIM class MSFT_NetTCPConnection),
// counted by state on the target, so that a server with a hundred thousand connections returns a few
// lines. A state is named in English whatever the language of Windows: "Established", "TimeWait".
// The script is the one of windows/ssh/tcp, without the powershell -Command "..." that cmd.exe needs there.
need('protocol:winrm');

output('established', 'number', array('label' => 'Established connections'));
output('time-wait', 'number', array('label' => 'Connections in TIME-WAIT'));
output('close-wait', 'number', array('label' => 'Connections in CLOSE-WAIT'));
output('listen', 'number', array('label' => 'Listening ports'));
output('total', 'number', array('label' => 'TCP connections'));

// No threshold by default: what is normal depends on the role of the server. CLOSE-WAIT piling up says an
// application does not close its connections.
watch.above('too-many', 'Too many TCP connections', 'established', array('enabled' => false));
watch.habit('unusual', 'Unusual number of connections', 'established', array('enabled' => false));
watch.above('close-wait', 'Connections left open', 'close-wait', array('warning' => 100, 'for' => '3 runs', 'enabled' => false));

// One object per state present: Name, the state, and Count, its number of connections.
$read = winrm.run("ConvertTo-Json -Compress -InputObject @(Get-NetTCPConnection"
    . " | Group-Object State -NoElement | Select-Object Name, Count)");
$answer = text.trim($read['output']);
if (list.count(text.match($answer, '^\[')) == 0) {
    fail('misconfigured', 'PowerShell did not return the TCP connections', $answer . $read['errors']);
}
$count = array();
$total = 0;
foreach (json.read($answer) as $state) {
    $count[$state['Name']] = $state['Count'];
    $total = $total + $state['Count'];
}
// The collector's own WinRM connection is a TCP connection: reading none is reading nothing.
if ($total == 0) {
    fail('misconfigured', 'No connection found by Get-NetTCPConnection', $answer . $read['errors']);
}

value('established', list.get($count, 'Established', 0));
value('time-wait', list.get($count, 'TimeWait', 0));
value('close-wait', list.get($count, 'CloseWait', 0));
value('listen', list.get($count, 'Listen', 0));
value('total', $total);