监控虚拟机跟外部的tcp连接

1.监控虚拟机跟外部的tcp连接，如果连接数超过阈值，就在FORWARD把ip DROP ，并且发送邮件

root@InternetGateway:~# cat /root/scripts/check_conntrack.sh
#!/bin/bash
script_home=`dirname $0`
script_home=`cd $script_home;pwd`
file_dir=/var/scripts/file
conntrack_source=/proc/net/nf_conntrack
ct_file=`date +%F-%T`
cmd=/usr/sbin/conntrack
num=`$cmd -C`conntrack_total (){
    [ ! -d $file_dir ] && mkdir -p $file_dir
    cd $file_dir
    cat $conntrack_source > $ct_file && gzip $ct_file
    gzip -cd $ct_file.gz|awk '{S[$6" "$7" "$8" "$10]++} END {for(s in S) print S[s],s}'|sort -rn|head > $ct_file.out
}mail (){
    local sendEmail=$script_home/sendEmail
    local subject="InternetGateway conntrack State abnormality" 
    local content="$file_dir/$ct_file.out"
    $sendEmail -f nagios@onecloud.cn -t gs@abccloud.cn -s 172.16.0.99 -u "$subject" -xu nagios@abccloud.cn -xp engine@nagios2 -o tls=no -o message-content-type=text -o message-file="$content" -o message-charset=utf8
}ip_drop (){
    local ip=`awk -F '[ =]' 'NR==1 {print $4}' $ct_file.out`
    /sbin/iptables -I FORWARD -s $ip -j DROP
}main (){
if [ "$num" -gt "40000" ]
then
    echo "conntrack State abnormality"
    conntrack_total	
    mail
    ip_drop
else
    echo "conntrack State ok"
fi
}

main

用一个例子来演示会更加清晰