Merge pull request #369 from arekkusu/patch-1

Support "nf_conntrack", check for 90% full

Author: k8s-ci-robot

config/plugin/network_problem.sh

@@ -1,23 +1,36 @@
 #!/bin/bash
 
-# This plugin checks for common network issues. Currently, it only checks
-# if the conntrack table is full. 
+# This plugin checks for common network issues.
+# Currently only checks if conntrack table is more than 90% used.
 
-OK=0
-NONOK=1
-UNKNOWN=2
+readonly OK=0
+readonly NONOK=1
+readonly UNKNOWN=2
 
-[ -f /proc/sys/net/ipv4/netfilter/ip_conntrack_max ] || exit $UNKNOWN
-[ -f /proc/sys/net/ipv4/netfilter/ip_conntrack_count ] || exit $UNKNOWN
+# "nf_conntrack" replaces "ip_conntrack" - support both
+readonly NF_CT_COUNT_PATH='/proc/sys/net/netfilter/nf_conntrack_count'
+readonly NF_CT_MAX_PATH='/proc/sys/net/netfilter/nf_conntrack_max'
+readonly IP_CT_COUNT_PATH='/proc/sys/net/ipv4/netfilter/ip_conntrack_count'
+readonly IP_CT_MAX_PATH='/proc/sys/net/ipv4/netfilter/ip_conntrack_max'
 
-conntrack_max=$(cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max)
-conntrack_count=$(cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count)
-
-if (( conntrack_count >= conntrack_max )); then
-    echo "Conntrack table full"
-    exit $NONOK
+if [[ -f $NF_CT_COUNT_PATH ]] && [[ -f $NF_CT_MAX_PATH ]]; then
+  readonly CT_COUNT_PATH=$NF_CT_COUNT_PATH
+  readonly CT_MAX_PATH=$NF_CT_MAX_PATH
+elif [[ -f $IP_CT_COUNT_PATH ]] && [[ -f $IP_CT_MAX_PATH ]]; then
+  readonly CT_COUNT_PATH=$IP_CT_COUNT_PATH
+  readonly CT_MAX_PATH=$IP_CT_MAX_PATH
+else
+  exit $UNKNOWN
 fi
 
-echo "Conntrack table available"
-exit $OK
+readonly conntrack_count=$(< $CT_COUNT_PATH) || exit $UNKNOWN
+readonly conntrack_max=$(< $CT_MAX_PATH) || exit $UNKNOWN
+readonly conntrack_usage_msg="${conntrack_count} out of ${conntrack_max}"
 
+if (( conntrack_count > conntrack_max * 9 /10 )); then
+  echo "Conntrack table usage over 90%: ${conntrack_usage_msg}"
+  exit $NONOK
+else
+  echo "Conntrack table usage: ${conntrack_usage_msg}"
+  exit $OK
+fi