Network
Security Monitoring is now available Security Monitoring is now available

Network

Agent Check Agent Check

Supported OS: Linux Mac OS Windows

Network Dashboard

Overview

The network check collects TCP/IP stats from the host operating system.

Setup

Follow the instructions below to install and configure this check for an Agent running on a host.

Installation

The network check is included in the Datadog Agent package, so you don’t need to install anything else on your server.

To collect metrics with this integration, make sure the conntrack module is activated on your host. If it’s not the case, run:

sudo modprobe nf_conntrack
sudo modprobe nf_conntrack_ipv4
sudo modprobe nf_conntrack_ipv6

Configuration

  1. The Agent enables the network check by default, but if you want to configure the check yourself, edit file network.d/conf.yaml, in the conf.d/ folder at the root of your Agent’s configuration directory. See the sample network.d/conf.yaml for all available configuration options:

    init_config:

instances:
 ## @param collect_connection_state - boolean - required
 ## Set to true to collect connection states for your interfaces
 ## Note: this will require either the command `ss` from system package `iproute2` or
 ## the command `netstat` from the system package `net-tools` to be installed
 #
 - collect_connection_state: false

  2. Restart the Agent to effect any configuration changes.

Note:

Some conntrack metrics require running conntrack with privileged access to be retrieved.

Linux: Configure the following sudoers rule for this to work:

dd-agent ALL=NOPASSWD: /usr/sbin/conntrack -S

Kubernetes: Conntrack metrics are available by default in Kubernetes < v1.11 or when using the host networking mode in Kubernetes v1.11+.

Validation

Run the Agent’s status subcommand and look for network under the Checks section.

Data Collected

Metrics

system.net.bytes_rcvd
(gauge)		The number of bytes received on a device per second.
Shown as byte
system.net.bytes_sent
(gauge)		The number of bytes sent from a device per second.
Shown as byte
system.net.conntrack.acct
(gauge)		Boolean to enable connection tracking flow accounting. 64-bit byte and packet counters per flow are added.
Shown as unit
system.net.conntrack.buckets
(gauge)		Size of the hash table.
Shown as unit
system.net.conntrack.checksum
(gauge)		Boolean to verify checksum of incoming packets.
Shown as unit
system.net.conntrack.count
(gauge)		The number of connections present in the conntrack table.
Shown as connection
system.net.conntrack.drop
(count)		The number of drop in the conntrack table.
Shown as unit
system.net.conntrack.early_drop
(count)		The number of early drop in the conntrack table.
Shown as unit
system.net.conntrack.error
(count)		The number of error in the conntrack table.
Shown as unit
system.net.conntrack.events
(count)		Boolean to enable the connection tracking code will provide userspace with connection tracking events via ctnetlink.
Shown as unit
system.net.conntrack.events_retry_timeout
(gauge)
Shown as unit
system.net.conntrack.expect_max
(gauge)		Maximum size of expectation table.
Shown as unit
system.net.conntrack.found
(count)		The number of currently allocated flow entries.
Shown as unit
system.net.conntrack.generic_timeout
(gauge)		Default for generic timeout. This refers to layer 4 unknown/unsupported protocols.
Shown as unit
system.net.conntrack.helper
(gauge)		Boolean to enable automatic conntrack helper assignment.
Shown as unit
system.net.conntrack.icmp_timeout
(gauge)		Default for ICMP timeout.
Shown as second
system.net.conntrack.ignore
(count)		The number of ignored in the conntrack table.
Shown as unit
system.net.conntrack.invalid
(count)		The number of invalid in the conntrack table.
Shown as unit
system.net.conntrack.insert
(count)		The number of insertion in the conntrack table.
Shown as unit
system.net.conntrack.insert_failed
(count)		The number of failed insertion in the conntrack table.
Shown as unit
system.net.conntrack.log_invalid
(gauge)		Log invalid packets of a type specified by value.
Shown as unit
system.net.conntrack.max
(gauge)		Conntrack table max capacity.
Shown as connection
system.net.conntrack.search_restart
(count)
Shown as unit
system.net.conntrack.tcp_be_liberal
(gauge)		Boolean to mark only out of window RST segments as INVALID.
Shown as unit
system.net.conntrack.tcp_loose
(gauge)		Boolean to enable picking up already established connections.
Shown as unit
system.net.conntrack.tcp_max_retrans
(gauge)		Maximum number of packets that can be retransmitted without received an (acceptable) ACK from the destination.
Shown as packet
system.net.conntrack.tcp_timeout_close
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_close_wait
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_established
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_fin_wait
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_last_ack
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_max_retrans
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_syn_recv
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_syn_sent
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_time_wait
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_unacknowledged
(gauge)
Shown as second
system.net.conntrack.tcp_timeout
(gauge)
Shown as second
system.net.conntrack.tcp_timeout_stream
(gauge)
Shown as second
system.net.conntrack.timestamp
(gauge)		Boolean to enable connection tracking flow timestamping.
Shown as unit
system.net.packets_in.count
(gauge)		The number of packets of data received by the interface.
Shown as packet
system.net.packets_in.error
(gauge)		The number of packet receive errors detected by the device driver.
Shown as error
system.net.packets_out.count
(gauge)		The number of packets of data transmitted by the interface.
Shown as packet
system.net.packets_out.error
(gauge)		The number of packet transmit errors detected by the device driver.
Shown as error
system.net.tcp.in_segs
(gauge)		The number of TCP segments received (Linux or Solaris only).
Shown as segment
system.net.tcp.in_segs.count
(count)		Total number of received TCP segments (Linux or Solaris only).
Shown as segment
system.net.tcp.out_segs
(gauge)		The number of TCP segments transmitted (Linux or Solaris only).
Shown as segment
system.net.tcp.out_segs.count
(count)		Total number of transmitted TCP segments (Linux or Solaris only).
Shown as segment
system.net.tcp.rcv_packs
(gauge)		The number of TCP packets received (BSD only).
Shown as packet
system.net.tcp.retrans_packs
(gauge)		The number of TCP packets retransmitted (BSD only).
Shown as packet
system.net.tcp.retrans_segs
(gauge)		The number of TCP segments retransmitted (Linux or Solaris only).
Shown as segment
system.net.tcp.retrans_segs.count
(count)		Total number of retransmitted TCP segments (Linux or Solaris only).
Shown as segment
system.net.tcp.sent_packs
(gauge)		The number of TCP packets transmitted (BSD only).
Shown as packet
system.net.tcp.listen_overflows
(gauge)		The number of times connections have overflowed the accept buffer (Linux only). Available since Agent v5.14.0.
system.net.tcp.listen_overflows.count
(count)		Total number of times connections have overflowed the accept buffer (Linux only).
system.net.tcp.listen_drops
(gauge)		The number of times connections have dropped out of listen (Linux only). Available since Agent v5.14.0.
system.net.tcp.listen_drops.count
(count)		Total number of times connections have dropped out of listen (Linux only).
system.net.tcp.backlog_drops
(gauge)		The number of packets dropped because there wasn't room in the TCP backlog (Linux only). Available since Agent v5.14.0.
Shown as packet
system.net.tcp.backlog_drops.count
(count)		Total number of packets dropped because there wasn't room in the TCP backlog (Linux only).
Shown as packet
system.net.tcp.failed_retransmits.count
(count)		Total number of packets that failed to be retransmitted (Linux only).
Shown as packet
system.net.tcp4.closing
(gauge)		The number of TCP IPv4 closing connections.
Shown as connection
system.net.tcp4.established
(gauge)		The number of TCP IPv4 established connections.
Shown as connection
system.net.tcp4.listening
(gauge)		The number of TCP IPv4 listening connections.
Shown as connection
system.net.tcp4.opening
(gauge)		The number of TCP IPv4 opening connections.
Shown as connection
system.net.tcp6.closing
(gauge)		The number of TCP IPv6 closing connections.
Shown as connection
system.net.tcp6.established
(gauge)		The number of TCP IPv6 established connections.
Shown as connection
system.net.tcp6.listening
(gauge)		The number of TCP IPv6 listening connections.
Shown as connection
system.net.tcp6.opening
(gauge)		The number of TCP IPv6 opening connections.
Shown as connection
system.net.udp.in_datagrams
(gauge)		The rate of UDP datagrams delivered to UDP users (Linux only).
Shown as datagram
system.net.udp.in_datagrams.count
(count)		Total number of UDP datagrams delivered to UDP users (Linux only).
Shown as datagram
system.net.udp.in_errors
(gauge)		The rate of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port (Linux only).
Shown as datagram
system.net.udp.in_errors.count
(count)		Total number of received UDP datagrams that could not be delivered for reasons other than the lack of an application at the destination port (Linux only).
Shown as datagram
system.net.udp.no_ports
(gauge)		The rate of received UDP datagrams for which there was no application at the destination port (Linux only).
Shown as datagram
system.net.udp.no_ports.count
(count)		Total number of received UDP datagrams for which there was no application at the destination port (Linux only).
Shown as datagram
system.net.udp.out_datagrams
(gauge)		The rate of UDP datagrams sent from this entity (Linux only).
Shown as datagram
system.net.udp.out_datagrams.count
(count)		Total number of UDP datagrams sent from this entity (Linux only).
Shown as datagram
system.net.udp.rcv_buf_errors
(gauge)		The rate of UDP datagrams lost because there was no room in the receive buffer (Linux only).
Shown as error
system.net.udp.rcv_buf_errors.count
(count)		Total number of UDP datagrams lost because there was no room in the receive buffer (Linux only).
Shown as error
system.net.udp.snd_buf_errors
(gauge)		The rate of UDP datagrams lost because there was no room in the send buffer (Linux only).
Shown as error
system.net.udp.snd_buf_errors.count
(count)		Total number of UDP datagrams lost because there was no room in the send buffer (Linux only).
Shown as error
system.net.udp.in_csum_errors.count
(count)		Total number of UDP datagrams that failed checksum verification (Linux only).
Shown as error

Note: system.net.conntrack metrics are available with Agent v6.12+. See the CHANGELOG for details.

Events

The Network check does not include any events.

Service Checks

The Network check does not include any service checks.

Troubleshooting

Further Reading

edit Edit

On this Page