# Open TCP connection count

**URL:** <https://discuss.elastic.co/t/open-tcp-connection-count/164482>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [January 16, 2019, 2:39pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482 "2019-01-16T14:39:45Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [January 16, 2019, 2:39pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/1 "2019-01-16T14:39:45Z")

</div>

Hello there.  
I have a use case where we do have different applications running in separate containers. We want to monitor the user activity by keeping track of the open TCP connections on each application.  
I am using the official metricbeat container image (`docker.elastic.co/beats/metricbeat:6.5.0`). It seems like the socket\_summary module is what I'm looking for, especially the field  
`"system.socket.summary.tcp.all.count"` where it's documented to be "All open TCP connections". However the data I get from the module doesn't change at all, even if I open multiple connections onto the application the count always remains "1". My suspicion is now that "system.socket.summary.tcp.all.count" doesn't return the connection count but just the socket count.

Is the documentation inaccurate or might there be a bug in the metricbeat?

Thanks in advance for your help!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [January 18, 2019, 12:37pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/2 "2019-01-18T12:37:48Z")

</div>

Hi @rani,

Yes, `socket_summary` metricset collects summarized metrics of the connections of a system. Take into account that metricbeat is not able to collect these metrics per application at the moment.

When metricbeat is running in a container, to be able to collect network metrics of other applications, it needs one of these things:

- To be running in the same network namespace
- To have access to the the host proc filesystem (host `/proc` filesystem has to be mounted in the container and its path in the container has to be passed to metricbeat using `--system.hostfs` flag).

Could you share the options you are using to run the metricbeat container?

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [January 21, 2019, 7:25am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/3 "2019-01-21T07:25:53Z")

</div>

Hi @jsoriano,  
Thanks for your reply.

> [@jsoriano](#):
>
> Could you share the options you are using to run the metricbeat container?

The docker-compose.yml for the swarm contains:

```
host-metricbeat:
  image: docker.elastic.co/beats/metricbeat:6.5.0
    volumes:
      - /opt/elastic/config/metricbeat/host-metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
      - type: bind
        source: /proc
        target: /hostfs/proc,readonly
      - type: bind
        source: /sys/fs/cgroup
        target: /hostfs/sys/fs/cgroup,readonly
      - type: bind
        source: /
        target: /hostfs,readonly
    configs:
      - source: ssl_cert
        target: /usr/share/filebeat/config/certificate.crt
       - source: ssl_key
         target: /usr/share/filebeat/config/private.key
       - source: ssl_ca_chain
         target: /usr/share/filebeat/config/ca-chain.crt

```

> [@jsoriano](#):
>
> To be running in the same network namespace

All the containers are started from the same docker-compose.yml and thus are running in the same docker network, so this should be the case.

> [@jsoriano](#):
>
> To have access to the the host proc filesystem (host `/proc` filesystem has to be mounted in the container and its path in the container has to be passed to metricbeat using `--system.hostfs` flag).

Sadly, I haven't found a way to do this in a docker-compose file.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [January 21, 2019, 3:24pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/4 "2019-01-21T15:24:36Z")

</div>

> Sadly, I haven't found a way to do this in a docker-compose file.

Try to add the arguments to the command like this:

```auto
host-metricbeat:
  image: docker.elastic.co/beats/metricbeat:6.5.0
    command: [
      "-c", "/usr/share/metricbeat/metricbeat.yml",
      "-e",
      "-system.hostfs=/hostfs",
   ]
    volumes:
      - /opt/elastic/config/metricbeat/host-metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
      - type: bind
        source: /proc
        target: /hostfs/proc,readonly
      - type: bind
        source: /sys/fs/cgroup
        target: /hostfs/sys/fs/cgroup,readonly
      - type: bind
        source: /
        target: /hostfs,readonly
    configs:
      - source: ssl_cert
        target: /usr/share/filebeat/config/certificate.crt
       - source: ssl_key
         target: /usr/share/filebeat/config/private.key
       - source: ssl_ca_chain
         target: /usr/share/filebeat/config/ca-chain.crt

```

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [January 22, 2019, 8:06am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/5 "2019-01-22T08:06:17Z")

</div>

I've tried it and my config now looks like this:

```
host-metricbeat:
	image: docker.elastic.co/beats/metricbeat:6.5.0
	command: [
	  "-c", "/usr/share/metricbeat/metricbeat.yml",
	  "-e",
	  "-system.hostfs=/hostfs",
	]
	volumes:
	  - /opt/elastic/config/metricbeat/host-metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
	  - type: bind
		source: /proc
		target: /hostfs/proc
	  - type: bind
		source: /sys/fs/cgroup
		target: /hostfs/sys/fs/cgroup,readonly
	  - type: bind
		source: /
		target: /hostfs,readonly
	configs:
	  - source: ssl_cert
		target: /usr/share/filebeat/config/certificate.crt
	  - source: ssl_key
		target: /usr/share/filebeat/config/private.key
	  - source: ssl_ca_chain
		target: /usr/share/filebeat/config/ca-chain.crt

```

However there is no change in the metrics I get.

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [January 22, 2019, 2:02pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/6 "2019-01-22T14:02:42Z")

</div>

I just realized that the "readonly" flags don't work when specified like in my example above. I just changed it to:

```
host-metricbeat:
	image: docker.elastic.co/beats/metricbeat:6.5.0
	command: [
	  "-c", "/usr/share/metricbeat/metricbeat.yml",
	  "-e",
	  "-system.hostfs=/hostfs",
	]
	volumes:
	  - /opt/elastic/config/metricbeat/host-metricbeat.yml:/usr/share/metricbeat/metricbeat.yml
	  - type: bind
		source: /proc
		target: /hostfs/proc
		read_only: true
	  - type: bind
		source: /sys/fs/cgroup
		target: /hostfs/sys/fs/cgroup
		read_only: true
	  - type: bind
		source: /
		target: /hostfs
		read_only: true
	configs:
	  - source: ssl_cert
		target: /usr/share/filebeat/config/certificate.crt
	  - source: ssl_key
		target: /usr/share/filebeat/config/private.key
	  - source: ssl_ca_chain
		target: /usr/share/filebeat/config/ca-chain.crt

```

But the metrics still don't change.

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [January 28, 2019, 6:46am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/7 "2019-01-28T06:46:16Z")

</div>

Any other ideas @jsoriano, please?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [February 7, 2019, 5:57pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/8 "2019-02-07T17:57:05Z")

</div>

Hi @rani,

Sorry for the late reply. I can confirm the issue, this should be fixed by upgrading one of the libraries we use, I have opened an issue to keep track if this: [https://github.com/elastic/beats/issues/10637](https://github.com/elastic/beats/issues/10637)

Thanks a lot for reporting, and sorry again for the late reply!

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [February 7, 2019, 5:58pm UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/9 "2019-02-07T17:58:09Z")

</div>

@rani as a workaround in the meantime you can try to start metricbeat in the host namespace (`network_mode: host`).

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [February 11, 2019, 6:26am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/10 "2019-02-11T06:26:47Z")

</div>

Hi @jsoriano,

No problem, thanks for looking into it.  
For the workaround: It seems like `network_mode` is ignored when we're deploying a stack in swarm mode ([Docker compose reference](https://docs.docker.com/compose/compose-file/#network_mode)). Are there any other workarounds on your mind, or do I have to wait until it's fixed?

Anyway, I'm gonna keep track of the issue, thank you.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [February 11, 2019, 11:48am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/11 "2019-02-11T11:48:28Z")

</div>

@rani take a look to these comments, they may help you in this case: [https://github.com/elastic/beats/issues/8685#issuecomment-456096492](https://github.com/elastic/beats/issues/8685#issuecomment-456096492)

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [February 20, 2019, 9:23am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/12 "2019-02-20T09:23:12Z")

</div>

This doesn't seem to work for me. ☹  
Guess I'll have to wait. Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2019, 9:23am UTC](https://discuss.elastic.co/t/open-tcp-connection-count/164482/13 "2019-03-20T09:23:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.