scoutapp/scout-plugins — pull request #162 by kday (2014-08-20 01:57:52+00:00)
Title: Add plugin to track connections from netfilter and percent of connections available.

When running a high traffic server with iptables turned on (such as a redis database) the IP connection tracking table maintained by netfilter can max out. I have hit this limit with a redis database receiving over 500 connections per second, and it causes connections to be dropped.

This is a somewhat artificial restraint and can easily be increased:

http://security.stackexchange.com/questions/43205/nf-conntrack-table-full-dropping-packet

The resolution linked to in that stack overflow issue shows some sysctl settings to increase. Those settings can easily be monitored and tracked.

This plugin monitors the current nf_conntrack_count and compares it to the configurable nf_conntrack_max setting and calculates the % of connections taken up. This can easily have a trigger based off it for when the % taken up approaches 100% so that the nf_conntrack_max can be increased.

This is the same as this nagios plugin: http://exchange.nagios.org/directory/Plugins/Security/Firewall-Software/check_netfilter-2Enf_conntrack-2Esh/details