Page 1 of 1

Monitoring # of session on a windows host

Posted: Thu Feb 04, 2021 2:26 pm
by emartine
Is it possible to monitor the number of connections occurring on a windows host?
Not just terminal service sessions but all established connections. What plugin would I use for that?

Sorry if this is a newb question I've just never needed to monitor # of connections.

Re: Monitoring # of session on a windows host

Posted: Thu Feb 04, 2021 3:17 pm
by dchurch
Do you mean monitor the number of all open TCP connections? Including when visiting a web site and the browser parallelizes fetching resources, opening up to three connections per remote server, often spiking in the 20-50 range per open tab?

If you could write a PowerShell script to output that data, you could hook it in as an NCPA extension. Here's the doc on how to do that.

It would likely mean running the NCPA listener as an administrator account, since that sort of information isn't usually available to an unprivileged user.

Re: Monitoring # of session on a windows host

Posted: Thu Feb 04, 2021 3:22 pm
by dchurch
Did some checking and it looks like Get-NetTCPConnection -State Established should give you the data you need. How you munge it into NCPA-compatible output is an exercise left up to the reader.

Microsoft's document on that PowerShell function: https://docs.microsoft.com/en-us/powers ... w=win10-ps

Re: Monitoring # of session on a windows host

Posted: Fri Feb 05, 2021 9:18 am
by emartine
So no plugins out there to review all current connections. I am not heavy on scripting.

Re: Monitoring # of session on a windows host

Posted: Fri Feb 05, 2021 11:58 am
by dchurch
Looks like I was wrong, and there's one already baked into NCPA:

Set it up in the Nagios XI service CCM page:
- Check Command: check_xi_ncpa
- Arg1: -t '<your token>' -M 'windowscounters/TCPv4/Connections Active' -w 100 -c 150

All together it'll run this:

Code: Select all

./check_ncpa.py -H <ncpa_agent> -t '<your token>' -M 'windowscounters/TCPv4/Connections Active' -w 100 -c 150
There are more counters that you may be interested in. Here's the NCPA API reference document: https://www.nagios.org/ncpa/help/2.2/api.html