Home Directory Plugins Network Connections, Stats and Bandwidth check_netstat / check_snmp_netstat

Search Exchange

Search All Sites

Nagios Live Webinars

Let our experts show you how Nagios can help your organization.

Contact Us

Phone: 1-888-NAGIOS-1
Email: sales@nagios.com


Remember Me

Directory Tree

check_netstat / check_snmp_netstat

Current Version
Last Release Date
Compatible With
  • Nagios 1.x
  • Nagios 2.x
  • Nagios 3.x
  • Nagios XI
  • Nagios Fusion
check_netstat.plcheck_netstat.pl version 0.34 (stable)
check_netstat.plcheck_netstat.pl version 0.353 (beta)
Network Monitoring Software - Download Nagios XI
Log Management Software - Nagios Log Server - Download
Netflow Analysis Software - Nagios Network Analyzer - Download
This plugin checks number of open tcp connections and can send warnings or critical alert of there are too many or too few. Can run either directly on the box or use SNMP.
Documentation is part of plugin code on top. Below from there (and it is the not most current!):


This is a nagios plugin that checks number of TCP connections from or to the system. The plugin gets the data either from local computer with 'netstast' or from remote system using 'snmpnetstat' (if '-H' and '-C'
are not specified then its local).

You can set this up to provide warning and critical values if number of connections for specific port out or in is too low or too high. Data is also made available for nagios 2.0 post-processing based on specified ports.


1. Make sure to check and if necessary adjust the the path to utils.pm
2. Make sure you have snmpnetstat in /usr/bin or adjust the path below
3. Beware that all service port names are ALWAYS retrieved from system
running plugin and in case of SNMP check this might not be the same
as what is set on remote system.

TCP Port names are specified with '-p' or '-a' option for checking number of connections based on specified warning and critical values and with '-A' for those ports which you want in performance output. Each TCP port name (or number) should be prefixed with either '>' or 'smtp' means you want to check on number of outgoing SMTP (port 25) connections. Special value of '@' (or just '>') allow to check check on total number connections (they will be reported as port 'all').

The values retrieved are compared to specified warning and critical levels. Warning and critical levels are specified with '-w' and '-c' and each one must have exact same number of values (separated by ',') as number of attribute (tcp port names) specified with '-p'. Any values you dont want to compare you specify as ~. There are also number of other one-letter modifiers that can be used before actual data value to direct how data is to be checked. These are as follows:

> : issue alert if data is above this value (default)
< : issue alert if data is below this value
= : issue alert if data is equal to this value
! : issue alert if data is NOT equal to this value

A special modifier '^' can also be used to disable checking that warn values are less then (or greater then) critical values (it is rarely needed).

Additionally if you want performance output then use '-f' option to get all the ports specified with '-p' or specify particular list of of ports for performance data with '-A' (this list can include names not found in '-p'). Note that when reporting for in perfomance data instead of saying ">smtp' or "15,>10"!">40,>20"

The second example is for a webserver to check HTTP connections. In this case the server is always little loaded (i.e. you have busy website) so not only is their upper bound of 30 for warning and 100 for critical but also a bound to send alert if there are <5 connections (and to specify this http name is repeated twice at '-p'; the result is a little strange though as it will report "http in connections" twice - its on my "todo list" to get this taken care of and only report same port/direction information once).

define command {

command_name check_http_connections
command_line $USER1$/check_netstat.pl -L "HTTP Load" -H $HOSTADDRESS$ -C $ARG1$ -2 -p "http,http" -w $ARG2$ -c $ARG3$ -A "http,@"


define service{

use std-service
service_description HTTP Load
hostgroups webserv
check_command check_http_connections!public!"30"!"~,100"


Note: those who want to minimize load on nagios server and number of extra lookups should really combine above into one command if your server is doing both HTTP and SMTP (but of course then it might not look as nice in the services list)
Reviews (3)
byleymar, December 13, 2022
for correct the error 256, need to correct the code at line 592 :
change argument "CP" by "Cp"
bykendaukcat, December 28, 2015
UNKNOWN ERROR - execution of /usr/bin/snmpnetstat x.x.x.x -t 10 -Cn -CP tcp -v 2c resulted in an error 256 - [root@netsaint plugins]#
bySreekanthreddy, February 24, 2014
1 of 1 people found this review helpful
exactly i required no of connections count of webserver.
by this script am getting below error:
UNKNOWN ERROR - execution of /usr/bin/snmpnetstat -t 10 -Cn -CP tcp resulted in an error 256