Editing Traffic accounting with iptables
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.
The edit can be undone.
Please check the comparison below to verify that this is what you want to do, and then save the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
− | Suppose you need to know how much traffic your [[ | + | Suppose you need to know how much traffic your [[VE]]s eat. It can be easily done |
using iptables. | using iptables. | ||
== Situation description == | == Situation description == | ||
− | Let's consider the very simple situation: one | + | Let's consider the very simple situation: one VE with one IP address on the [[Hardware Node]] |
− | with only one network interface. To be more exact, assume that [[ | + | with only one network interface. To be more exact, assume that [[VE]] ID is <tt>200</tt>, the IP address of the [[HN]] |
− | is <tt>192.168.0.56</tt>, the network interface name is <tt>eth0</tt>, and the IP address of the [[ | + | is <tt>192.168.0.56</tt>, the network interface name is <tt>eth0</tt>, and the IP address of the [[VE]] is <tt>192.168.0.117</tt>. |
− | You wish to know how many bytes | + | You wish to know how many bytes VE 200 eats. One more assumption is that there are no iptables rules |
on HN now. All these assumption are only for clarity! | on HN now. All these assumption are only for clarity! | ||
== Solution == | == Solution == | ||
− | Almost any traffic that goes to and from a | + | Almost any traffic that goes to and from a VE can be catched by FORWARD chain of iptables module in [[VE0]], |
thus we add such rules: | thus we add such rules: | ||
<pre> | <pre> | ||
Line 18: | Line 18: | ||
</pre> | </pre> | ||
It means that all traffic forwarded to IP 192.168.0.117 and from IP 192.168.0.117 will be accounted. | It means that all traffic forwarded to IP 192.168.0.117 and from IP 192.168.0.117 will be accounted. | ||
− | To obtain current traffic usage of | + | To obtain current traffic usage of VE you can issue the command: |
<pre> | <pre> | ||
# iptables -nv -L FORWARD | # iptables -nv -L FORWARD | ||
Line 26: | Line 26: | ||
15 1052 all -- * * 0.0.0.0/0 192.168.0.117 | 15 1052 all -- * * 0.0.0.0/0 192.168.0.117 | ||
</pre> | </pre> | ||
− | '''Bytes''' column is the column we need. It's worth saying, that restarting a | + | '''Bytes''' column is the column we need. It's worth saying, that restarting a VE doesn't affect accounting, |
it remains right. But if you restart your [[hardware node]], all the rules and consequently statistics are dropped. | it remains right. But if you restart your [[hardware node]], all the rules and consequently statistics are dropped. | ||
So it is recommended to | So it is recommended to | ||
Line 38: | Line 38: | ||
You will get the exact value of the packet and byte counters, instead of only the rounded number in K’s (multiples of 1000) M’s (multiples of 1000K) or G’s (multiples of 1000M). | You will get the exact value of the packet and byte counters, instead of only the rounded number in K’s (multiples of 1000) M’s (multiples of 1000K) or G’s (multiples of 1000M). | ||
− | As is easy to see, it's not per- | + | As is easy to see, it's not per-VE statistic, but rather per-IP statistic. Thus you must be careful |
− | then changing | + | then changing VE IP addresses, otherwise you'll get mess of results. |
− | By saying ''almost any traffic'' I mean that traffic between a [[ | + | By saying ''almost any traffic'' I mean that traffic between a [[VE]] and [[VE0]] is not accounted by rules above. |
Not sure if it can be useful for anybody, but to account such traffic these rules are needed: | Not sure if it can be useful for anybody, but to account such traffic these rules are needed: | ||
<pre> | <pre> | ||
Line 83: | Line 83: | ||
more complicated situations. | more complicated situations. | ||
− | ; More than one | + | ; More than one VE on the node |
− | : Just add the rules like above for each | + | : Just add the rules like above for each VE IP. |
− | ; More than one IP per | + | ; More than one IP per VE. |
− | : For each IP add the rules like above. When counting the complete traffic of a | + | : For each IP add the rules like above. When counting the complete traffic of a VE you have to summarize over all IPs that this VE owns. |
; More interfaces on the HN. | ; More interfaces on the HN. | ||
Line 95: | Line 95: | ||
Here are some scripting ideas | Here are some scripting ideas | ||
− | === Get | + | === Get VEIDs of all running VEs === |
<pre> | <pre> | ||
host2:~/bin# cat vz-all-running | host2:~/bin# cat vz-all-running | ||
Line 101: | Line 101: | ||
</pre> | </pre> | ||
− | === Get all IPs of running | + | === Get all IPs of running VEs === |
<pre> | <pre> | ||
host2:~/bin# cat vz-all-running-ip | host2:~/bin# cat vz-all-running-ip | ||
Line 116: | Line 116: | ||
=== Generate a traffic.log === | === Generate a traffic.log === | ||
Please use crontab to run this script once per hour or day to collect your traffic statistics. | Please use crontab to run this script once per hour or day to collect your traffic statistics. | ||
− | |||
− | |||
<pre> | <pre> | ||
host2:~/bin# cat vz-generate-traffic-log | host2:~/bin# cat vz-generate-traffic-log | ||
Line 129: | Line 127: | ||
# reset the counter | # reset the counter | ||
iptables -Z | iptables -Z | ||
− | # update the iptables rules if there is a any change in | + | # update the iptables rules if there is a any change in VEs |
./vz-iptables-create-rules | ./vz-iptables-create-rules | ||
Line 162: | Line 160: | ||
$MySQL_Passw="INSERT-YOUR-MYSQL-PASSWORD-HERE"; | $MySQL_Passw="INSERT-YOUR-MYSQL-PASSWORD-HERE"; | ||
− | mysql_connect($MySQL_Host,$MySQL_User,$MySQL_Passw); | + | mysql_connect("$MySQL_Host","$MySQL_User","$MySQL_Passw"); |
$HN=trim(addslashes($_GET["HN"])); // Hardware Node | $HN=trim(addslashes($_GET["HN"])); // Hardware Node | ||
− | $handle = fopen ("tmp/ | + | $handle = fopen ("tmp/$HN-traffic","r"); |
while (!feof($handle)) { | while (!feof($handle)) { | ||
$line = fgets($handle, 4096); | $line = fgets($handle, 4096); | ||
list($date,$time,$ip,$traffic)=explode(" ",$line); | list($date,$time,$ip,$traffic)=explode(" ",$line); | ||
− | if($traffic>0) {mysql($db,"insert into Traffic (ip,measuringtime,bytes) values(' | + | if($traffic>0) {mysql($db,"insert into Traffic (ip,measuringtime,bytes) values('$ip','$date $time','$traffic')");} |
} | } | ||
fclose($handle); | fclose($handle); | ||
Line 187: | Line 185: | ||
=== Notes === | === Notes === | ||
− | As you see this way can be time-consuming in case of a big number of | + | As you see this way can be time-consuming in case of a big number of VEs. |
So if anybody has scripts that automate all the process — you are welcome! | So if anybody has scripts that automate all the process — you are welcome! | ||
− | + | [[Category: HOWTO]] | |
− | |||
− | |||
[[Category: Networking]] | [[Category: Networking]] | ||
− |