Subject: Re: [vserver] is there a vnetstat?
From: Allan Latham <alatham@flexsys-group.de>
Date: Tue, 07 May 2013 21:43:41 +0200

Hi Herbert

I have no idea where I would set CONFIG_VSERVER_PRIVACY but I am using
the Debian Squeeze vserver kernel and util vserver utils. Is it a kernel
compile option?

I have not knowingly set CONFIG_VSERVER_PRIVACY but the ncontext command
does not give me what I expect:

root@vservers ~ # cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when
retrnsmt   uid  timeout inode

   0: 79D6C658:0016 00000000:0000 0A 00000000:00000000 00:00000000
00000000     0        0 4691 1 ffff88001e748000 300 0 0 2 -1

   1: 79D6C658:0016 A76A04B2:A1BD 01 00000000:00000000 02:000A95D2
00000000     0        0 4462131 3 ffff88001e74c780 23 6 17 4 -1

root@vservers ~ # ncontext --migrate --nid 1 -- cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when
retrnsmt   uid  timeout inode

Nothing is shown - not from the host or the vservers (there are
listening tcp services on some of the vservers).

Interestingly if I use the nid of an actual vserver I do get what I expect:

root@vservers ~ # ncontext --migrate --nid 102 -- cat /proc/net/tcp
  sl  local_address rem_address   st tx_queue rx_queue tr tm->when
retrnsmt   uid  timeout inode

   0: 00000000:0016 00000000:0000 0A 00000000:00000000 00:00000000
00000000     0        0 4378389 1 ffff88001e749380 300 0 0 2 -1

root@vservers ~ # ncontext --migrate --nid 102 -- netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address
State
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN

As a partial solution I can cycle through all the nids but I'd prefer a
complete picture in one command.

Any other idea why nid 1 doesn't work?

All the best

Allan

On 07/05/13 20:24, Herbert Poetzl wrote:
> On Mon, May 06, 2013 at 07:54:04PM +0200, Allan Latham wrote:
>> netstat gets the information from:
> 
>> /proc/net/tcp and /proc/net/udp
> 
>> The trick must be to make this part of the /proc 
>> tree fully visible at the host level.
> 
>> How I do that is a complete mystery!
> 
> it is completely visible from the spectator context
> so for example:
> 
>  ncontext --migrate --nid 1 -- cat /proc/net/tcp
> 
> will show the information for all network contexts,
> given that guest privacy is not enabled, i.e.
> 
>  # CONFIG_VSERVER_PRIVACY is not set
>   
>> My vservers are skeletons containing only the minimum needed
>> for the service running in the vserver. Few (none) will have
>> netstat available to run via 'vserver exec' and its friends.
> 
>> Therefore the need to monitor them from the host.
> 
> for obvious reasons, the host context only sees the
> connections belonging to the host processes, similar
> to the processes (host context = 0) but the spectator
> context (1) has all the information.
> 
> HTC,
> Herbert
> 
>> Greetings to all
>> Allan
> 
>> On 06/05/13 18:38, Ghislain wrote:
>>> would be curious too,
> 
>>> I tried
> 
>>>  sudo ncontext --migrate --nid 1 -- netstat -nlp
> 
>>>  sudo chcontext --silent --ctx 1 netstat -nlp
> 
> 
>>> but none give me all the sockets :), the closer i got was:
> 
>>> sudo vsomething vserver --running -- exec netstat -nlp|sort
> 
>>> perhaps there is not an observer context for network.
> 
> 
>>> Ghislain.
> 
>