What’s my server talking too?

Every now and again things go wrong with resources and you want to narrow your search down quickly.

Usually extra logging is turned on or added, but if your running in production in the heat of the moment that may not be an option.

Also you may not have convenient access to monitor other servers involved.

I think socketcounting your server process is an under estimated technique for quickly seeing what your server process is connected too, or what is connecting to it.

socketcount <server.pid>

to sum connections per server/ip address from/to your server process.


file:/usr/local/bin/socketcount
#!/bin/bash

echo server pid = $REGEX, using temp file $SNAPSHOT
#check all tcp connections except listeners if using local box
#export NETSTAT_CMD="netstat -tnpa | grep ' $REGEX' | egrep -v '(LISTEN||^Proto||^\(Not)'"
#echo "executing $NETSTAT_CMD"
netstat -tpa | grep $REGEX | egrep -v 'LISTEN' > $SNAPSHOT
echo "------------------------------------"
echo "Connections - this counts connections both ways, so running locally may appear weird."
#echo "ServerConnections can be identified, by host and port."
cat $SNAPSHOT | awk '{print $5}' | sort | awk -f /usr/local/bin/count-dups.awk


The socketcount file relies on the following awk script that sums up by hostname, it would be nice to keep it in one file, I'm sure there is an easier way to do it, but atleast it's readable.


file:/usr/local/bin/count-dups.awk
# expect single field for aggregation
BEGIN{
name=0;
count=0;
total=0}
{
if (name != $1) {
if (name != 0) {
total += count;
printf("%s = %d\n", name, count);
count = 1
}
name = $1
count = 1
}
else {
count++
}
}
END {
printf("%s = %d\n",name,count)
total += count
printf("Total = %d\n",total)
}