Alerting for TCP connections

[chitradevi]

I got the max threshold for TCP connections in definite number for example 18232 and the client wants to get alert if it's reached 80% of this value. I don't see any option to do this under anomaly detection of the particular host.  Any idea?

[AntonPineiro]

Hi,

Maybe you can check "builtin:tech.generic.network.sessions.new" which tells you number of new incoming TCP sessions per second.

If not, no out-the-box soluation. It was discussed here.

Best regards

[tomaxp]

Hi,
you can try with Custom metric events.

Go to Settings → Anomaly detection → Metric events.

Click Add metric event.

Select the metric you want to track (your TCP connection metric).

(Optional) Split by host if you only want this alert on a specific host.

Set a static threshold:

Max = 18232 → 80% = 14,626

Configure the rule to trigger when the metric is greater than 14626.

Save it and assign the event to the correct alerting profile.

P.S. I don’t recall there being a metric to count tcp connection to host. You’ll need to confirm the exact metric key for TCP connections in your environment. but I think this what @AntonPineiro suggested seems to be the closest to what you’re looking for.
Alternatively, you can always inject such a metric into Dynatrace yourself using metric ingestion.

[chitradevi]

But in static threshold we can give only the percentage or per mille threshold not the definite number as a threshold.

[tomaxp]

If the metric reports an absolute value (e.g., number of sessions, TCP connections, bytes, milliseconds), then the threshold is set in the base unit of that metric, so you can enter a fixed number (like 14626).

If the metric is defined as relative (e.g., CPU usage in %), then the threshold options are limited to percentage or per-mille.

For example, in this metric:
builtin:tech.generic.network.sessions.new you can set threshold in [count/s], in another like this: builtin:apps.custom.reportedErrorCount u can set exacl number

[Julius_Loman]

I've built a simple Dynatrace Extension for a client to measure number of connections to defined TCP ports, including connection status. It works on Linux only and uses the ss command to get the info. See https://github.com/juliusloman/dynatrace-extension-host-sockets 
It provides a metric host.net.sockets representing number of socket connections with the dimensions port, and socket status. You can then easily create a metric event to count the connections in TIME_WAIT or ESTABLISHED status for example.