zabbix3.0添加对tcp连接数及状态的监控

原理：
netstat -an|awk '/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}'
TIME_WAIT 79
ESTABLISHED 6
LISTEN 3


可以使用man netstat查看TCP的各种状态信息描述  
ESTABLISHED       socket已经建立连接  
CLOSED            socket没有被使用，无连接  
CLOSING           服务器端和客户端都同时关闭连接  
CLOSE_WAIT        等待关闭连接  
TIME_WAIT         表示收到了对方的FIN报文，并发送出了ACK报文，等待2MSL后就可回到CLOSED状态  
LAST_ACK          远端关闭，当前socket被动关闭后发送FIN报文，等待对方ACK报文  
LISTEN            监听状态  
SYN_RECV          接收到SYN报文  
SYN_SENT          已经发送SYN报文  
FIN_WAIT1         The socket is closed, and the connection is shutting down  
FIN_WAIT2         Connection is closed, and the socket is waiting for a shutdown from the remote end.  

2.在需要被监控的zabbix-agent端添加脚本编写

创建文件夹

mkdir -p /usr/local/zabbix-agent/scripts/
mkdir -p /etc/zabbix/zabbix_agentd.d/

vim /usr/local/zabbix-agent/scripts/tcp_conn_status.sh

#!/bin/bash
#this script is used to get tcp and udp connetion status
#tcp status
metric=$1
tmp_file=/tmp/tcp_status.txt
/bin/netstat -an|awk '/^tcp/{++S[$NF]}END{for(a in S) print a,S[a]}' > $tmp_file
 
case $metric in
   closed)
          output=$(awk '/CLOSED/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   listen)
          output=$(awk '/LISTEN/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   synrecv)
          output=$(awk '/SYN_RECV/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   synsent)
          output=$(awk '/SYN_SENT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   established)
          output=$(awk '/ESTABLISHED/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   timewait)
          output=$(awk '/TIME_WAIT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   closing)
          output=$(awk '/CLOSING/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   closewait)
          output=$(awk '/CLOSE_WAIT/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
        ;;
   lastack)
          output=$(awk '/LAST_ACK/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
   finwait1)
          output=$(awk '/FIN_WAIT1/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
   finwait2)
          output=$(awk '/FIN_WAIT2/{print $2}' $tmp_file)
          if [ "$output" == "" ];then
             echo 0
          else
             echo $output
          fi
         ;;
         *)
          echo -e "\e[033mUsage: sh  $0 [closed|closing|closewait|synrecv|synsent|finwait1|finwait2|listen|established|lastack|timewait]\e[0m"
   
esac


赋予脚本执行权限
chmod o+x /usr/local/zabbix-agent/scripts/tcp_conn_status.sh 

3.agent的配置文件 /etc/zabbix/zabbix_agentd.conf 中定义了其他key的包含目录 Include=/etc/zabbix/zabbix_agentd.d/, 接着在 /etc/zabbix/zabbix_agentd.d/ 目录新建一个文件 tcp-status-params.conf, 内容如下

vim /etc/zabbix/zabbix_agentd.d/tcp-status-params.conf

UserParameter=tcp.status[*],/usr/local/zabbix-agent/scripts/tcp_conn_status.sh $1

重启agent
service zabbix-agent restart


4.zabbix-master服务端测试
zabbix_get -s 192.168.3.86 -p 10050 -k "tcp.status[listen]"
13

5.zabbix web端配置：

登录Zabbix3.0 的web界面，一次选择 Configuration > Templates ， 在主界面的右上角有个 Import 按钮，用来导入模板

zabbix-tcp-status.xml

[html]  view plain  copy

1. <?xml version="1.0" encoding="UTF-8"?>  
2. <zabbix_export>  
3.     <version>2.0</version>  
4.     <date>2014-12-04T09:41:57Z</date>  
5.     <groups>  
6.         <group>  
7.             <name>Templates</name>  
8.         </group>  
9.     </groups>  
10.     <templates>  
11.         <template>  
12.             <template>Template TCP Connection Status</template>  
13.             <name>Template TCP Connection Status</name>  
14.             <groups>  
15.                 <group>  
16.                     <name>Templates</name>  
17.                 </group>  
18.             </groups>  
19.             <applications>  
20.                 <application>  
21.                     <name>TCP Status</name>  
22.                 </application>  
23.             </applications>  
24.             <items>  
25.                 <item>  
26.                     <name>CLOSED</name>  
27.                     <type>0</type>  
28.                     <snmp_community/>  
29.                     <multiplier>0</multiplier>  
30.                     <snmp_oid/>  
31.                     <key>tcp.status[closed]</key>  
32.                     <delay>60</delay>  
33.                     <history>90</history>  
34.                     <trends>365</trends>  
35.                     <status>0</status>  
36.                     <value_type>3</value_type>  
37.                     <allowed_hosts/>  
38.                     <units/>  
39.                     <delta>0</delta>  
40.                     <snmpv3_contextname/>  
41.                     <snmpv3_securityname/>  
42.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
43.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
44.                     <snmpv3_authpassphrase/>  
45.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
46.                     <snmpv3_privpassphrase/>  
47.                     <formula>1</formula>  
48.                     <delay_flex/>  
49.                     <params/>  
50.                     <ipmi_sensor/>  
51.                     <data_type>0</data_type>  
52.                     <authtype>0</authtype>  
53.                     <username/>  
54.                     <password/>  
55.                     <publickey/>  
56.                     <privatekey/>  
57.                     <port/>  
58.                     <description/>  
59.                     <inventory_link>0</inventory_link>  
60.                     <applications>  
61.                         <application>  
62.                             <name>TCP Status</name>  
63.                         </application>  
64.                     </applications>  
65.                     <valuemap/>  
66.                 </item>  
67.                 <item>  
68.                     <name>CLOSE_WAIT</name>  
69.                     <type>0</type>  
70.                     <snmp_community/>  
71.                     <multiplier>0</multiplier>  
72.                     <snmp_oid/>  
73.                     <key>tcp.status[closewait]</key>  
74.                     <delay>60</delay>  
75.                     <history>90</history>  
76.                     <trends>365</trends>  
77.                     <status>0</status>  
78.                     <value_type>3</value_type>  
79.                     <allowed_hosts/>  
80.                     <units/>  
81.                     <delta>0</delta>  
82.                     <snmpv3_contextname/>  
83.                     <snmpv3_securityname/>  
84.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
85.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
86.                     <snmpv3_authpassphrase/>  
87.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
88.                     <snmpv3_privpassphrase/>  
89.                     <formula>1</formula>  
90.                     <delay_flex/>  
91.                     <params/>  
92.                     <ipmi_sensor/>  
93.                     <data_type>0</data_type>  
94.                     <authtype>0</authtype>  
95.                     <username/>  
96.                     <password/>  
97.                     <publickey/>  
98.                     <privatekey/>  
99.                     <port/>  
100.                     <description/>  
101.                     <inventory_link>0</inventory_link>  
102.                     <applications>  
103.                         <application>  
104.                             <name>TCP Status</name>  
105.                         </application>  
106.                     </applications>  
107.                     <valuemap/>  
108.                 </item>  
109.                 <item>  
110.                     <name>CLOSING</name>  
111.                     <type>0</type>  
112.                     <snmp_community/>  
113.                     <multiplier>0</multiplier>  
114.                     <snmp_oid/>  
115.                     <key>tcp.status[closing]</key>  
116.                     <delay>60</delay>  
117.                     <history>90</history>  
118.                     <trends>365</trends>  
119.                     <status>0</status>  
120.                     <value_type>3</value_type>  
121.                     <allowed_hosts/>  
122.                     <units/>  
123.                     <delta>0</delta>  
124.                     <snmpv3_contextname/>  
125.                     <snmpv3_securityname/>  
126.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
127.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
128.                     <snmpv3_authpassphrase/>  
129.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
130.                     <snmpv3_privpassphrase/>  
131.                     <formula>1</formula>  
132.                     <delay_flex/>  
133.                     <params/>  
134.                     <ipmi_sensor/>  
135.                     <data_type>0</data_type>  
136.                     <authtype>0</authtype>  
137.                     <username/>  
138.                     <password/>  
139.                     <publickey/>  
140.                     <privatekey/>  
141.                     <port/>  
142.                     <description/>  
143.                     <inventory_link>0</inventory_link>  
144.                     <applications>  
145.                         <application>  
146.                             <name>TCP Status</name>  
147.                         </application>  
148.                     </applications>  
149.                     <valuemap/>  
150.                 </item>  
151.                 <item>  
152.                     <name>ESTABLISHED</name>  
153.                     <type>0</type>  
154.                     <snmp_community/>  
155.                     <multiplier>0</multiplier>  
156.                     <snmp_oid/>  
157.                     <key>tcp.status[established]</key>  
158.                     <delay>60</delay>  
159.                     <history>90</history>  
160.                     <trends>365</trends>  
161.                     <status>0</status>  
162.                     <value_type>3</value_type>  
163.                     <allowed_hosts/>  
164.                     <units/>  
165.                     <delta>0</delta>  
166.                     <snmpv3_contextname/>  
167.                     <snmpv3_securityname/>  
168.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
169.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
170.                     <snmpv3_authpassphrase/>  
171.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
172.                     <snmpv3_privpassphrase/>  
173.                     <formula>1</formula>  
174.                     <delay_flex/>  
175.                     <params/>  
176.                     <ipmi_sensor/>  
177.                     <data_type>0</data_type>  
178.                     <authtype>0</authtype>  
179.                     <username/>  
180.                     <password/>  
181.                     <publickey/>  
182.                     <privatekey/>  
183.                     <port/>  
184.                     <description/>  
185.                     <inventory_link>0</inventory_link>  
186.                     <applications>  
187.                         <application>  
188.                             <name>TCP Status</name>  
189.                         </application>  
190.                     </applications>  
191.                     <valuemap/>  
192.                 </item>  
193.                 <item>  
194.                     <name>FIN_WAIT1</name>  
195.                     <type>0</type>  
196.                     <snmp_community/>  
197.                     <multiplier>0</multiplier>  
198.                     <snmp_oid/>  
199.                     <key>tcp.status[finwait1]</key>  
200.                     <delay>60</delay>  
201.                     <history>90</history>  
202.                     <trends>365</trends>  
203.                     <status>0</status>  
204.                     <value_type>3</value_type>  
205.                     <allowed_hosts/>  
206.                     <units/>  
207.                     <delta>0</delta>  
208.                     <snmpv3_contextname/>  
209.                     <snmpv3_securityname/>  
210.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
211.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
212.                     <snmpv3_authpassphrase/>  
213.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
214.                     <snmpv3_privpassphrase/>  
215.                     <formula>1</formula>  
216.                     <delay_flex/>  
217.                     <params/>  
218.                     <ipmi_sensor/>  
219.                     <data_type>0</data_type>  
220.                     <authtype>0</authtype>  
221.                     <username/>  
222.                     <password/>  
223.                     <publickey/>  
224.                     <privatekey/>  
225.                     <port/>  
226.                     <description/>  
227.                     <inventory_link>0</inventory_link>  
228.                     <applications>  
229.                         <application>  
230.                             <name>TCP Status</name>  
231.                         </application>  
232.                     </applications>  
233.                     <valuemap/>  
234.                 </item>  
235.                 <item>  
236.                     <name>FIN_WAIT2</name>  
237.                     <type>0</type>  
238.                     <snmp_community/>  
239.                     <multiplier>0</multiplier>  
240.                     <snmp_oid/>  
241.                     <key>tcp.status[finwait2]</key>  
242.                     <delay>60</delay>  
243.                     <history>90</history>  
244.                     <trends>365</trends>  
245.                     <status>0</status>  
246.                     <value_type>3</value_type>  
247.                     <allowed_hosts/>  
248.                     <units/>  
249.                     <delta>0</delta>  
250.                     <snmpv3_contextname/>  
251.                     <snmpv3_securityname/>  
252.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
253.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
254.                     <snmpv3_authpassphrase/>  
255.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
256.                     <snmpv3_privpassphrase/>  
257.                     <formula>1</formula>  
258.                     <delay_flex/>  
259.                     <params/>  
260.                     <ipmi_sensor/>  
261.                     <data_type>0</data_type>  
262.                     <authtype>0</authtype>  
263.                     <username/>  
264.                     <password/>  
265.                     <publickey/>  
266.                     <privatekey/>  
267.                     <port/>  
268.                     <description/>  
269.                     <inventory_link>0</inventory_link>  
270.                     <applications>  
271.                         <application>  
272.                             <name>TCP Status</name>  
273.                         </application>  
274.                     </applications>  
275.                     <valuemap/>  
276.                 </item>  
277.                 <item>  
278.                     <name>LAST_ACK</name>  
279.                     <type>0</type>  
280.                     <snmp_community/>  
281.                     <multiplier>0</multiplier>  
282.                     <snmp_oid/>  
283.                     <key>tcp.status[lastack]</key>  
284.                     <delay>60</delay>  
285.                     <history>90</history>  
286.                     <trends>365</trends>  
287.                     <status>0</status>  
288.                     <value_type>3</value_type>  
289.                     <allowed_hosts/>  
290.                     <units/>  
291.                     <delta>0</delta>  
292.                     <snmpv3_contextname/>  
293.                     <snmpv3_securityname/>  
294.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
295.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
296.                     <snmpv3_authpassphrase/>  
297.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
298.                     <snmpv3_privpassphrase/>  
299.                     <formula>1</formula>  
300.                     <delay_flex/>  
301.                     <params/>  
302.                     <ipmi_sensor/>  
303.                     <data_type>0</data_type>  
304.                     <authtype>0</authtype>  
305.                     <username/>  
306.                     <password/>  
307.                     <publickey/>  
308.                     <privatekey/>  
309.                     <port/>  
310.                     <description/>  
311.                     <inventory_link>0</inventory_link>  
312.                     <applications>  
313.                         <application>  
314.                             <name>TCP Status</name>  
315.                         </application>  
316.                     </applications>  
317.                     <valuemap/>  
318.                 </item>  
319.                 <item>  
320.                     <name>LISTEN</name>  
321.                     <type>0</type>  
322.                     <snmp_community/>  
323.                     <multiplier>0</multiplier>  
324.                     <snmp_oid/>  
325.                     <key>tcp.status[listen]</key>  
326.                     <delay>60</delay>  
327.                     <history>90</history>  
328.                     <trends>365</trends>  
329.                     <status>0</status>  
330.                     <value_type>3</value_type>  
331.                     <allowed_hosts/>  
332.                     <units/>  
333.                     <delta>0</delta>  
334.                     <snmpv3_contextname/>  
335.                     <snmpv3_securityname/>  
336.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
337.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
338.                     <snmpv3_authpassphrase/>  
339.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
340.                     <snmpv3_privpassphrase/>  
341.                     <formula>1</formula>  
342.                     <delay_flex/>  
343.                     <params/>  
344.                     <ipmi_sensor/>  
345.                     <data_type>0</data_type>  
346.                     <authtype>0</authtype>  
347.                     <username/>  
348.                     <password/>  
349.                     <publickey/>  
350.                     <privatekey/>  
351.                     <port/>  
352.                     <description/>  
353.                     <inventory_link>0</inventory_link>  
354.                     <applications>  
355.                         <application>  
356.                             <name>TCP Status</name>  
357.                         </application>  
358.                     </applications>  
359.                     <valuemap/>  
360.                 </item>  
361.                 <item>  
362.                     <name>SYN_RECV</name>  
363.                     <type>0</type>  
364.                     <snmp_community/>  
365.                     <multiplier>0</multiplier>  
366.                     <snmp_oid/>  
367.                     <key>tcp.status[synrecv]</key>  
368.                     <delay>60</delay>  
369.                     <history>90</history>  
370.                     <trends>365</trends>  
371.                     <status>0</status>  
372.                     <value_type>3</value_type>  
373.                     <allowed_hosts/>  
374.                     <units/>  
375.                     <delta>0</delta>  
376.                     <snmpv3_contextname/>  
377.                     <snmpv3_securityname/>  
378.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
379.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
380.                     <snmpv3_authpassphrase/>  
381.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
382.                     <snmpv3_privpassphrase/>  
383.                     <formula>1</formula>  
384.                     <delay_flex/>  
385.                     <params/>  
386.                     <ipmi_sensor/>  
387.                     <data_type>0</data_type>  
388.                     <authtype>0</authtype>  
389.                     <username/>  
390.                     <password/>  
391.                     <publickey/>  
392.                     <privatekey/>  
393.                     <port/>  
394.                     <description/>  
395.                     <inventory_link>0</inventory_link>  
396.                     <applications>  
397.                         <application>  
398.                             <name>TCP Status</name>  
399.                         </application>  
400.                     </applications>  
401.                     <valuemap/>  
402.                 </item>  
403.                 <item>  
404.                     <name>SYN_SENT</name>  
405.                     <type>0</type>  
406.                     <snmp_community/>  
407.                     <multiplier>0</multiplier>  
408.                     <snmp_oid/>  
409.                     <key>tcp.status[synsent]</key>  
410.                     <delay>60</delay>  
411.                     <history>90</history>  
412.                     <trends>365</trends>  
413.                     <status>0</status>  
414.                     <value_type>3</value_type>  
415.                     <allowed_hosts/>  
416.                     <units/>  
417.                     <delta>0</delta>  
418.                     <snmpv3_contextname/>  
419.                     <snmpv3_securityname/>  
420.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
421.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
422.                     <snmpv3_authpassphrase/>  
423.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
424.                     <snmpv3_privpassphrase/>  
425.                     <formula>1</formula>  
426.                     <delay_flex/>  
427.                     <params/>  
428.                     <ipmi_sensor/>  
429.                     <data_type>0</data_type>  
430.                     <authtype>0</authtype>  
431.                     <username/>  
432.                     <password/>  
433.                     <publickey/>  
434.                     <privatekey/>  
435.                     <port/>  
436.                     <description/>  
437.                     <inventory_link>0</inventory_link>  
438.                     <applications>  
439.                         <application>  
440.                             <name>TCP Status</name>  
441.                         </application>  
442.                     </applications>  
443.                     <valuemap/>  
444.                 </item>  
445.                 <item>  
446.                     <name>TIME_WAIT</name>  
447.                     <type>0</type>  
448.                     <snmp_community/>  
449.                     <multiplier>0</multiplier>  
450.                     <snmp_oid/>  
451.                     <key>tcp.status[timewait]</key>  
452.                     <delay>60</delay>  
453.                     <history>90</history>  
454.                     <trends>365</trends>  
455.                     <status>0</status>  
456.                     <value_type>3</value_type>  
457.                     <allowed_hosts/>  
458.                     <units/>  
459.                     <delta>0</delta>  
460.                     <snmpv3_contextname/>  
461.                     <snmpv3_securityname/>  
462.                     <snmpv3_securitylevel>0</snmpv3_securitylevel>  
463.                     <snmpv3_authprotocol>0</snmpv3_authprotocol>  
464.                     <snmpv3_authpassphrase/>  
465.                     <snmpv3_privprotocol>0</snmpv3_privprotocol>  
466.                     <snmpv3_privpassphrase/>  
467.                     <formula>1</formula>  
468.                     <delay_flex/>  
469.                     <params/>  
470.                     <ipmi_sensor/>  
471.                     <data_type>0</data_type>  
472.                     <authtype>0</authtype>  
473.                     <username/>  
474.                     <password/>  
475.                     <publickey/>  
476.                     <privatekey/>  
477.                     <port/>  
478.                     <description/>  
479.                     <inventory_link>0</inventory_link>  
480.                     <applications>  
481.                         <application>  
482.                             <name>TCP Status</name>  
483.                         </application>  
484.                     </applications>  
485.                     <valuemap/>  
486.                 </item>  
487.             </items>  
488.             <discovery_rules/>  
489.             <macros/>  
490.             <templates/>  
491.             <screens/>  
492.         </template>  
493.     </templates>  
494.     <triggers>  
495.         <trigger>  
496.             <expression>{Template TCP Connection Status:tcp.status[timewait].last()}>10000</expression>  
497.             <name>There are too many TCP TIME_WAIT status</name>  
498.             <url/>  
499.             <status>0</status>  
500.             <priority>4</priority>  
501.             <description/>  
502.             <type>0</type>  
503.             <dependencies/>  
504.         </trigger>  
505.     </triggers>  
506.     <graphs>  
507.         <graph>  
508.             <name>TCP Status</name>  
509.             <width>900</width>  
510.             <height>200</height>  
511.             <yaxismin>0.0000</yaxismin>  
512.             <yaxismax>100.0000</yaxismax>  
513.             <show_work_period>1</show_work_period>  
514.             <show_triggers>1</show_triggers>  
515.             <type>0</type>  
516.             <show_legend>1</show_legend>  
517.             <show_3d>0</show_3d>  
518.             <percent_left>0.0000</percent_left>  
519.             <percent_right>0.0000</percent_right>  
520.             <ymin_type_1>0</ymin_type_1>  
521.             <ymax_type_1>0</ymax_type_1>  
522.             <ymin_item_1>0</ymin_item_1>  
523.             <ymax_item_1>0</ymax_item_1>  
524.             <graph_items>  
525.                 <graph_item>  
526.                     <sortorder>0</sortorder>  
527.                     <drawtype>0</drawtype>  
528.                     <color>C80000</color>  
529.                     <yaxisside>0</yaxisside>  
530.                     <calc_fnc>2</calc_fnc>  
531.                     <type>0</type>  
532.                     <item>  
533.                         <host>Template TCP Connection Status</host>  
534.                         <key>tcp.status[closed]</key>  
535.                     </item>  
536.                 </graph_item>  
537.                 <graph_item>  
538.                     <sortorder>1</sortorder>  
539.                     <drawtype>0</drawtype>  
540.                     <color>00C800</color>  
541.                     <yaxisside>0</yaxisside>  
542.                     <calc_fnc>2</calc_fnc>  
543.                     <type>0</type>  
544.                     <item>  
545.                         <host>Template TCP Connection Status</host>  
546.                         <key>tcp.status[closewait]</key>  
547.                     </item>  
548.                 </graph_item>  
549.                 <graph_item>  
550.                     <sortorder>2</sortorder>  
551.                     <drawtype>0</drawtype>  
552.                     <color>0000C8</color>  
553.                     <yaxisside>0</yaxisside>  
554.                     <calc_fnc>2</calc_fnc>  
555.                     <type>0</type>  
556.                     <item>  
557.                         <host>Template TCP Connection Status</host>  
558.                         <key>tcp.status[closing]</key>  
559.                     </item>  
560.                 </graph_item>  
561.                 <graph_item>  
562.                     <sortorder>3</sortorder>  
563.                     <drawtype>0</drawtype>  
564.                     <color>C800C8</color>  
565.                     <yaxisside>0</yaxisside>  
566.                     <calc_fnc>2</calc_fnc>  
567.                     <type>0</type>  
568.                     <item>  
569.                         <host>Template TCP Connection Status</host>  
570.                         <key>tcp.status[established]</key>  
571.                     </item>  
572.                 </graph_item>  
573.                 <graph_item>  
574.                     <sortorder>4</sortorder>  
575.                     <drawtype>0</drawtype>  
576.                     <color>00C8C8</color>  
577.                     <yaxisside>0</yaxisside>  
578.                     <calc_fnc>2</calc_fnc>  
579.                     <type>0</type>  
580.                     <item>  
581.                         <host>Template TCP Connection Status</host>  
582.                         <key>tcp.status[finwait1]</key>  
583.                     </item>  
584.                 </graph_item>  
585.                 <graph_item>  
586.                     <sortorder>5</sortorder>  
587.                     <drawtype>0</drawtype>  
588.                     <color>C8C800</color>  
589.                     <yaxisside>0</yaxisside>  
590.                     <calc_fnc>2</calc_fnc>  
591.                     <type>0</type>  
592.                     <item>  
593.                         <host>Template TCP Connection Status</host>  
594.                         <key>tcp.status[finwait2]</key>  
595.                     </item>  
596.                 </graph_item>  
597.                 <graph_item>  
598.                     <sortorder>6</sortorder>  
599.                     <drawtype>0</drawtype>  
600.                     <color>C8C8C8</color>  
601.                     <yaxisside>0</yaxisside>  
602.                     <calc_fnc>2</calc_fnc>  
603.                     <type>0</type>  
604.                     <item>  
605.                         <host>Template TCP Connection Status</host>  
606.                         <key>tcp.status[lastack]</key>  
607.                     </item>  
608.                 </graph_item>  
609.                 <graph_item>  
610.                     <sortorder>7</sortorder>  
611.                     <drawtype>0</drawtype>  
612.                     <color>960000</color>  
613.                     <yaxisside>0</yaxisside>  
614.                     <calc_fnc>2</calc_fnc>  
615.                     <type>0</type>  
616.                     <item>  
617.                         <host>Template TCP Connection Status</host>  
618.                         <key>tcp.status[listen]</key>  
619.                     </item>  
620.                 </graph_item>  
621.                 <graph_item>  
622.                     <sortorder>8</sortorder>  
623.                     <drawtype>0</drawtype>  
624.                     <color>009600</color>  
625.                     <yaxisside>0</yaxisside>  
626.                     <calc_fnc>2</calc_fnc>  
627.                     <type>0</type>  
628.                     <item>  
629.                         <host>Template TCP Connection Status</host>  
630.                         <key>tcp.status[synrecv]</key>  
631.                     </item>  
632.                 </graph_item>  
633.                 <graph_item>  
634.                     <sortorder>9</sortorder>  
635.                     <drawtype>0</drawtype>  
636.                     <color>000096</color>  
637.                     <yaxisside>0</yaxisside>  
638.                     <calc_fnc>2</calc_fnc>  
639.                     <type>0</type>  
640.                     <item>  
641.                         <host>Template TCP Connection Status</host>  
642.                         <key>tcp.status[synsent]</key>  
643.                     </item>  
644.                 </graph_item>  
645.                 <graph_item>  
646.                     <sortorder>10</sortorder>  
647.                     <drawtype>0</drawtype>  
648.                     <color>960096</color>  
649.                     <yaxisside>0</yaxisside>  
650.                     <calc_fnc>2</calc_fnc>  
651.                     <type>0</type>  
652.                     <item>  
653.                         <host>Template TCP Connection Status</host>  
654.                         <key>tcp.status[timewait]</key>  
655.                     </item>  
656.                 </graph_item>  
657.             </graph_items>  
658.         </graph>  
659.     </graphs>  
660. </zabbix_export>  

在对应主机上添加tcp的监控：

添加报警，当tcp连接数超过5W报警：

{Template TCP Connection Status:tcp.status[established].last()}>50000

最终效果图：

某些服务器的established连接很多(3W或更多)，如果突然下降到一定的值(1000)，这个可能也是问题(可能某个前端的服务出问题了，新的用户进不来)，需要对这个值进行监控

{192.168.1.13:tcp_est_status.last()}<1000

后记：发现通过netstat监控服务器的tcp等连接数效率比较低，netstat统计占用大量cpu带来服务器额外的压力，通过ss命令会更加合适，详情请看：

zabbix3.0对tcp连接数和状态的监控优化

http://blog.youkuaiyun.com/reblue520/article/details/52908966