← All dashboards

Loki conntrack

conntrack

This dashboard uses Loki to display information about the network connections of a gateway.

Info: https://elpuig.xeill.net/Members/vcarceler/articulos/registro-del-trafico-en-gnu-linux-mediante-conntrack-loki-y-grafana

In the gateway, the following systemd unit has been defined.

vcarceler@cirdan-2204:~$ cat /etc/systemd/system/conntrack-to-journal.service 
[Unit]
Description=Send to journal DESTROY events for nat flows
After=network.target

[Service]
Type=simple
# Needs:
#
# echo 1 >/proc/sys/net/netfilter/nf_conntrack_acct
# echo 1 >/proc/sys/net/netfilter/nf_conntrack_timestamp
#
# Increased buffer-size
ExecStart=/bin/sh -c '/usr/sbin/conntrack -E -e DESTROY --buffer-size 21299200 | /usr/bin/sed "s/\[DESTROY\] /\[DESTROY\] prot=/;s/src=/srca=/;s/src=/srcb=/;s/dst=/dsta=/;s/dst=/dstb=/;s/sport=/sporta=/;s/sport=/sportb=/;s/dport=/dporta=/;s/dport=/dportb=/;s/packets=/packetsa=/;s/packets=/packetsb=/;s/bytes=/bytesa=/;s/bytes=/bytesb=/"'
TimeoutSec = 2
Restart = on-failure
RestartSec = 10

[Install]
WantedBy=multi-user.target
vcarceler@cirdan-2204:~$

This unit uses conntrack to log a line to the journal every time conntrack closes a connection. We use sed to rename the fields src, dst, sport, dport, … for both flows.

We enable accounting and timestamp in sysctl.conf.

net.netfilter.nf_conntrack_acct = 1
net.netfilter.nf_conntrack_timestamp = 1

Dashboard revisions

RevisionDecscriptionCreated

Reviews

Login or Sign up to write a review

Reviews from the community

Get this dashboard

Data source:

Dependencies:

Import the dashboard template:

or

Download JSON

Docs: Importing dashboards

Downloads: 10