topic Alerting for TCP connections in Alerting

Alerting for TCP connections

chitradevi — Thu, 18 Dec 2025 11:03:14 GMT

I got the max threshold for TCP connections in definite number for example 18232 and the client wants to get alert if it's reached 80% of this value. I don't see any option to do this under anomaly detection of the particular host. Any idea?

Re: Alerting for TCP connections

AntonPineiro — Tue, 23 Sep 2025 14:46:39 GMT

Hi,

Maybe you can check "builtin:tech.generic.network.sessions.new" which tells you number of new incoming TCP sessions per second.

If not, no out-the-box soluation. It was discussed here.

Best regards

Re: Alerting for TCP connections

t_pawlak — Tue, 23 Sep 2025 18:08:01 GMT

Hi,
you can try with Custom metric events.

Go to Settings → Anomaly detection → Metric events.

Click Add metric event.

Select the metric you want to track (your TCP connection metric).

(Optional) Split by host if you only want this alert on a specific host.

Set a static threshold:

Max = 18232 → 80% = 14,626

Configure the rule to trigger when the metric is greater than 14626.

Save it and assign the event to the correct alerting profile.

P.S. I don’t recall there being a metric to count tcp connection to host. You’ll need to confirm the exact metric key for TCP connections in your environment. but I think this what @AntonPineiro suggested seems to be the closest to what you’re looking for.
Alternatively, you can always inject such a metric into Dynatrace yourself using metric ingestion.

Re: Alerting for TCP connections

chitradevi — Tue, 23 Sep 2025 18:37:10 GMT

But in static threshold we can give only the percentage or per mille threshold not the definite number as a threshold.

Re: Alerting for TCP connections

t_pawlak — Tue, 23 Sep 2025 18:45:04 GMT

If the metric reports an absolute value (e.g., number of sessions, TCP connections, bytes, milliseconds), then the threshold is set in the base unit of that metric, so you can enter a fixed number (like 14626).

If the metric is defined as relative (e.g., CPU usage in %), then the threshold options are limited to percentage or per-mille.

For example, in this metric:
builtin:tech.generic.network.sessions.new you can set threshold in [count/s], in another like this: builtin:apps.custom.reportedErrorCount u can set exacl number

Re: Alerting for TCP connections

Julius_Loman — Tue, 23 Sep 2025 20:06:02 GMT

I've built a simple Dynatrace Extension for a client to measure number of connections to defined TCP ports, including connection status. It works on Linux only and uses the ss command to get the info. See https://github.com/juliusloman/dynatrace-extension-host-sockets
It provides a metric host.net.sockets representing number of socket connections with the dimensions port, and socket status. You can then easily create a metric event to count the connections in TIME_WAIT or ESTABLISHED status for example.