Skip to content

[inputs.nftables] Monitor set element counts #18133

@niklasf

Description

@niklasf

Use Case

Similar to inputs.ipset for iptables, in nftables named sets can be dynamically modified, for example to ban ip addresses. This is useful to monitor.

Expected behavior

For a set like

$ sudo nft list table inet filter
table inet filter {
	set named_set {
		type ipv6_addr
		size 65536	# count 3
		timeout 5m
		elements = { ::3 expires 4m47s406ms,
			         ::4 expires 4m44s399ms,
			         ::5 expires 4m42s65ms }
	}
    # ...
}

the nftables.input plugin could provide:

nftables,set=named_set,table=filter count=3i 1763040447356078375

Actual behavior

Not yet implemented.

Additional info

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    feature requestRequests for new plugin and for new features to existing plugins

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions