Hello there.
I have a use case where we do have different applications running in separate containers. We want to monitor the user activity by keeping track of the open TCP connections on each application.
I am using the official metricbeat container image (docker.elastic.co/beats/metricbeat:6.5.0). It seems like the socket_summary module is what I'm looking for, especially the field "system.socket.summary.tcp.all.count" where it's documented to be "All open TCP connections". However the data I get from the module doesn't change at all, even if I open multiple connections onto the application the count always remains "1". My suspicion is now that "system.socket.summary.tcp.all.count" doesn't return the connection count but just the socket count.
Is the documentation inaccurate or might there be a bug in the metricbeat?
Yes, socket_summary metricset collects summarized metrics of the connections of a system. Take into account that metricbeat is not able to collect these metrics per application at the moment.
When metricbeat is running in a container, to be able to collect network metrics of other applications, it needs one of these things:
To be running in the same network namespace
To have access to the the host proc filesystem (host /proc filesystem has to be mounted in the container and its path in the container has to be passed to metricbeat using --system.hostfs flag).
Could you share the options you are using to run the metricbeat container?
Sorry for the late reply. I can confirm the issue, this should be fixed by upgrading one of the libraries we use, I have opened an issue to keep track if this: https://github.com/elastic/beats/issues/10637
Thanks a lot for reporting, and sorry again for the late reply!
No problem, thanks for looking into it.
For the workaround: It seems like network_mode is ignored when we're deploying a stack in swarm mode (Docker compose reference). Are there any other workarounds on your mind, or do I have to wait until it's fixed?
Anyway, I'm gonna keep track of the issue, thank you.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.