Metric for incoming traffic by calling host or process

Bert_VanderHeyd — Thu, 05 Oct 2023 15:05:33 GMT

Via "Analyse Process Connections" we can see which host/process is calling our host and what volumes we are talking about. That's great but it's quite deep dive.

For a certain fileserver we want to keep track of the incoming traffic and where it comes from. There are a few metrics for that but none of them have a "calling host" dimension or something like that. See builtin:host.net.nic.trafficIn can be split by host and NIC. But that doesn't tell where the traffic comes from. We know the data is available because we have those details via "Analyse Process Connections".

Is this feasible? And how? For this particular service we want it on a dashboard. Maybe even create alerts when certain incoming spikes arise.

Re: Metric for incoming traffic by calling host or process

mark_bley — Fri, 06 Oct 2023 08:19:38 GMT

Hi @Bert_VanderHeyd ,

you can use a more specific entitySelector in your metric query to get the calling PGIs of the PGI (for my example PROCESS_GROUP_INSTANCE-19A05BD896B3AD67) you want to check e.g.: type(process_group_instance),fromRelationships.isNetworkClientOf(entityId(PROCESS_GROUP_INSTANCE-19A05BD896B3AD67))

The :parents suffix will as well give you the host where the calling PGIs come form.

So your complete query could look like this

builtin:tech.generic.network.traffic.trafficIn:filter(and(or(in( "dt.entity.process_group_instance", entitySelector("type(process_group_instance),fromRelationships.isNetworkClientOf(entityId(PROCESS_GROUP_INSTANCE-19A05BD896B3AD67))") )))):splitBy("dt.entity.process_group_instance"):sort(value(auto,descending)):limit(20):parents

Hope this helps.

BR,

Mark

topic Re: Metric for incoming traffic by calling host or process in Open Q&A

Metric for incoming traffic by calling host or process

Re: Metric for incoming traffic by calling host or process