DLPX-96312 Resolved Slack Review comments

Author: dbshah12

telegraf/connstat-stats.sh

@@ -1,4 +1,68 @@
 #!/bin/sh
+#
+# Collect per-connection TCP stats from connstat and aggregate by remote
+# endpoint (laddr:raddr:rport) to bound cardinality on engines with many
+# connections — e.g. Oracle dNFS (hundreds of connections per VDB host) or
+# Elastic Data (many connections per object storage endpoint IP).
+# Mirrors the aggregation done by LocalTCPStatsCollector in the mgmt stack.
+#
+# Service name lookup reads from /etc/services, matching LocalTCPStatsCollector
+# exactly. lport is checked before rport so that listening services (where the
+# engine is the server) are identified correctly. Falls back to "unknown".
+#
+# Output fields per aggregated endpoint:
+#   laddr, raddr, rport, service
+#   inbytes, outbytes, retranssegs, suna, unsent  (summed across connections)
+#   swnd, cwnd, rwnd, rtt                          (averaged across connections)
+#   connections                                    (count of aggregated conns)
+#
 /usr/bin/connstat -PLe -i 10 -T u \
     -o laddr,lport,raddr,rport,inbytes,outbytes,retranssegs,suna,unsent,swnd,cwnd,rwnd,rtt \
-    | grep --line-buffered -v "^="
+    | awk -F',' '
+BEGIN {
+    # Load port->service mapping from /etc/services, same as LocalTCPStatsCollector.
+    # Pattern matches lines of the form: "servicename  port/tcp"
+    while ((getline line < "/etc/services") > 0) {
+        sub(/^[[:space:]]+/, "", line)
+        if (line ~ /^(#|$)/) continue
+        n = split(line, f, /[[:space:]]+/)
+        if (n >= 2 && f[2] ~ /\/tcp/) {
+            split(f[2], pf, "/")
+            port = pf[1] + 0
+            if (!(port in svc)) svc[port] = f[1]
+        }
+    }
+    close("/etc/services")
+    # Delphix DSP (Session Protocol) port — not present in /etc/services.
+    # Matches the ServiceProtocol special-case in LocalTCPStatsCollector.
+    svc[50001] = "dlpx-sp"
+}
+/^=/ {
+    for (key in cnt) {
+        n = cnt[key]
+        split(key, k, SUBSEP)
+        print k[1] "," k[2] "," k[3] "," k[4] "," \
+              inb[key] "," outb[key] "," ret[key] "," sun[key] "," uns[key] "," \
+              int(sw[key]/n) "," int(cw[key]/n) "," int(rw[key]/n) "," int(rt[key]/n) "," n
+    }
+    delete cnt; delete inb; delete outb; delete ret
+    delete sun; delete uns; delete sw; delete cw; delete rw; delete rt
+    next
+}
+NF == 13 {
+    lport = $2 + 0
+    rport = $4 + 0
+    if (lport in svc) {
+        service = svc[lport]
+    } else if (rport in svc) {
+        service = svc[rport]
+    } else {
+        service = "unknown"
+    }
+    key = $1 SUBSEP $3 SUBSEP rport SUBSEP service
+    inb[key] += $5;  outb[key] += $6;  ret[key] += $7
+    sun[key] += $8;  uns[key]  += $9
+    sw[key]  += $10; cw[key]   += $11; rw[key]  += $12; rt[key] += $13
+    cnt[key]++
+}
+'

telegraf/telegraf.base

@@ -20,9 +20,11 @@
 #                            INPUT PLUGINS                                    #
 ###############################################################################
 
-# Get CPU usage
+# Get CPU usage — only cpu-total, not per-core (reduces data volume on
+# many-CPU engines; agg_cpu automatically inherits this restriction).
+# percpu defaults to true so must be explicitly set to false.
 [[inputs.cpu]]
-  percpu = true
+  percpu = false
   totalcpu = true
   collect_cpu_time = false
   report_active = false
@@ -34,8 +36,10 @@
 
 # Get disk I/O stats, excluding ZFS zvol devices (zd*) which are internal
 # ZFS block devices not useful for performance diagnostics.
+# wwid is a redundant 100+ char tag; the short-form name tag is sufficient.
 [[inputs.diskio]]
   tagdrop = {name = ["zd*"]}
+  tagexclude = ["wwid"]
 
 # Get Memory stats
 [[inputs.mem]]
@@ -44,8 +48,13 @@
 [[inputs.net]]
   fieldpass = ["tcp*","bytes*","packets*","err*","drop*"]
 
-# Per-connection TCP stats (bytes, RTT, window sizes) via connstat.
-# Mirrors the TCP_STATS collected by the mgmt stack into analytics_datapoint.
+# Per-endpoint TCP stats (bytes, RTT, window sizes) via connstat.
+# Aggregated by remote endpoint (laddr:raddr:rport) to mirror the aggregation
+# in LocalTCPStatsCollector — avoids cardinality explosion on Oracle dNFS
+# engines (hundreds of connections per VDB host) and Elastic Data engines
+# (many connections per object storage endpoint IP).
+# Cumulative fields (inbytes, outbytes, etc.) are summed; window/RTT fields
+# are averaged; connections = number of TCP connections aggregated.
 [[inputs.execd]]
   command = ["/etc/telegraf/connstat-stats.sh"]
   name_override = "tcp_stats"
@@ -54,9 +63,9 @@
   data_format = "csv"
   csv_delimiter = ","
   csv_trim_space = true
-  csv_column_names = ["laddr", "lport", "raddr", "rport", "inbytes", "outbytes", "retranssegs", "suna", "unsent", "swnd", "cwnd", "rwnd", "rtt"]
-  csv_column_types = ["string", "int", "string", "int", "int", "int", "int", "int", "int", "int", "int", "int", "int"]
-  csv_tag_columns = ["laddr", "lport", "raddr", "rport"]
+  csv_column_names = ["laddr", "raddr", "rport", "service", "inbytes", "outbytes", "retranssegs", "suna", "unsent", "swnd", "cwnd", "rwnd", "rtt", "connections"]
+  csv_column_types = ["string", "string", "int", "string", "int", "int", "int", "int", "int", "int", "int", "int", "int", "int"]
+  csv_tag_columns = ["laddr", "raddr", "rport", "service"]
 
 # Track CPU and Memory for the "delphix-mgmt" service (and children).
 [[inputs.procstat]]
@@ -79,8 +88,10 @@
 [[inputs.system]]
 
 # ZFS kstats (arcstat, abdstat, zfetch, etc)
+# arcstats_l2_* fields are L2ARC stats — unused on all appliances (no L2ARC).
 [[inputs.zfs]]
   interval = "1m"
+  fielddrop = ["arcstats_l2_*"]
 
 # Detailed ZFS pool metrics from "zpool_influxdb" (noisy)
 #[[inputs.exec]]