Add lock option to the IPtables input plugin (#2201)
* Update README.md * Add lock support to the IPtables input plugin * Update iptables.go Doc cleaning
This commit is contained in:
parent
786557a2cc
commit
4740b818fe
|
@ -30,11 +30,17 @@ You may edit your sudo configuration with the following:
|
|||
telegraf ALL=(root) NOPASSWD: /usr/bin/iptables -nvL *
|
||||
```
|
||||
|
||||
### Using IPtables lock feature
|
||||
|
||||
Defining multiple instances of this plugin in telegraf.conf can lead to concurrent IPtables access resulting in "ERROR in input [inputs.iptables]: exit status 4" messages in telegraf.log and missing metrics. Setting 'use_lock = true' in the plugin configuration will run IPtables with the '-w' switch, allowing a lock usage to prevent this error.
|
||||
|
||||
### Configuration:
|
||||
|
||||
```toml
|
||||
# use sudo to run iptables
|
||||
use_sudo = false
|
||||
# run iptables with the lock option
|
||||
use_lock = false
|
||||
# defines the table to monitor:
|
||||
table = "filter"
|
||||
# defines the chains to monitor:
|
||||
|
|
|
@ -16,6 +16,7 @@ import (
|
|||
// Iptables is a telegraf plugin to gather packets and bytes throughput from Linux's iptables packet filter.
|
||||
type Iptables struct {
|
||||
UseSudo bool
|
||||
UseLock bool
|
||||
Table string
|
||||
Chains []string
|
||||
lister chainLister
|
||||
|
@ -32,8 +33,11 @@ func (ipt *Iptables) SampleConfig() string {
|
|||
## iptables require root access on most systems.
|
||||
## Setting 'use_sudo' to true will make use of sudo to run iptables.
|
||||
## Users must configure sudo to allow telegraf user to run iptables with no password.
|
||||
## iptables can be restricted to only list command "iptables -nvL"
|
||||
## iptables can be restricted to only list command "iptables -nvL"
|
||||
use_sudo = false
|
||||
## Setting 'use_lock' to true runs iptables with the "-w" option.
|
||||
## Adjust your sudo settings appropriately if using this option ("iptables -wnvl")
|
||||
use_lock = false
|
||||
## defines the table to monitor:
|
||||
table = "filter"
|
||||
## defines the chains to monitor:
|
||||
|
@ -75,7 +79,11 @@ func (ipt *Iptables) chainList(table, chain string) (string, error) {
|
|||
name = "sudo"
|
||||
args = append(args, iptablePath)
|
||||
}
|
||||
args = append(args, "-nvL", chain, "-t", table, "-x")
|
||||
iptablesBaseArgs := "-nvL"
|
||||
if ipt.UseLock {
|
||||
iptablesBaseArgs = "-wnvL"
|
||||
}
|
||||
args = append(args, iptablesBaseArgs, chain, "-t", table, "-x")
|
||||
c := exec.Command(name, args...)
|
||||
out, err := c.Output()
|
||||
return string(out), err
|
||||
|
|
Loading…
Reference in New Issue