lfd: High 5 minute load average alert

[chrismfz]

Hello there.

Is it possible when an email alert for load is coming
to also include a netstat .txt attachment?
It is already sending apache status, vmstat, ps etc,

with a netstat at least we can see "live" if the load
is coming -for example- from a DoS or DDoS attack
seeing the number of the connections the time of the load.

A sum of SYN_RECV, TIME_WAIT, CLOSE_WAIT and ESTABLISHED should
be nice too as an extra

[chirpy]

You can have lfd send you custom reports by using the PT_LOAD_ACTION option, e.g.:

create a file call /etc/csf/load.sh with the following contents:

Code: Select all

#!/bin/sh
>/etc/csf/csf.report
iostat -d 1 5 >> /etc/csf/csf.report
iostat -x -d 1 5 >> /etc/csf/csf.report
mpstat -P ALL >> /etc/csf/csf.report
top -b -n 1 >> /etc/csf/csf.report
netstat -autpn
mail -s "Load Report" root < /etc/csf/csf.report

Then:

chmod +x /etc/csf/load.sh

Then edit /etc/csf/csf.conf and change:

PT_LOAD_ACTION = "/etc/csf/load.sh"

The next time you get high load you'll get a load more information about what is happening on the server.

[chrismfz]

Thanks for that! I'll give it a try

[GiraffeDog]

Nice script!

Any reason why you're just calling this and not piping it to that file?

Code: Select all

netstat -autpn

I've updated my shell script, but thought I'd raise it...

Thanks for posting it