iptables and MariaDB Integration

Input and output integration overview

The iptables plugin for Telegraf collects metrics on packet and byte counts for specified iptables rules, providing insights into firewall activity and performance.

This plugin writes metrics from Telegraf directly into MariaDB using parameterized SQL INSERT statements, offering a flexible way to store metrics in structured, relational tables.

Integration details

iptables

The iptables plugin gathers packets and bytes counters for rules within a set of table and chain from the Linux iptables firewall. The plugin monitors rules identified by associated comments, as rules without comments are ignored. This approach ensures a unique identification for the monitored rules, which is particularly important since the rule number can change dynamically as rules are modified. To use this plugin effectively, users must name their rules with unique comments. The plugin also requires elevated permissions (CAP_NET_ADMIN and CAP_NET_RAW) to run, which can be configured either by running Telegraf as root (discouraged), using systemd capabilities, or by configuring sudo appropriately. Additionally, defining multiple instances of the plugin might lead to conflicts; thus, using locking mechanisms in the configuration is recommended to avoid errors during concurrent accesses.

MariaDB

The SQL output plugin in Telegraf enables direct writing of metrics into SQL-compatible databases like MariaDB by executing parameterized SQL statements. With support for the MySQL driver, the plugin seamlessly integrates with MariaDB for reliable, structured metric storage. This setup is ideal for users who prefer SQL-based analytics or want to store metrics alongside business data for unified querying. MariaDB is a community-developed, enterprise-grade fork of MySQL that emphasizes performance, security, and openness. The plugin supports inserting time series metrics into custom schemas, enabling flexible analytics and integrations with BI tools like Metabase or Grafana using SQL connectors.

Configuration

iptables

[[inputs.iptables]]
  ## iptables require root access on most systems.
  ## Setting 'use_sudo' to true will make use of sudo to run iptables.
  ## Users must configure sudo to allow telegraf user to run iptables with
  ## no password.
  ## iptables can be restricted to only list command "iptables -nvL".
  use_sudo = false
  ## Setting 'use_lock' to true runs iptables with the "-w" option.
  ## Adjust your sudo settings appropriately if using this option
  ## ("iptables -w 5 -nvl")
  use_lock = false
  ## Define an alternate executable, such as "ip6tables". Default is "iptables".
  # binary = "ip6tables"
  ## defines the table to monitor:
  table = "filter"
  ## defines the chains to monitor.
  ## NOTE: iptables rules without a comment will not be monitored.
  ## Read the plugin documentation for more information.
  chains = [ "INPUT" ]

MariaDB

[[outputs.sql]]
  ## Database driver
  ## Valid options: mssql (Microsoft SQL Server), mysql (MySQL), pgx (Postgres),
  ##  sqlite (SQLite3), snowflake (snowflake.com) clickhouse (ClickHouse)
  driver = "mysql"

  ## Data source name
  ## The format of the data source name is different for each database driver.
  ## See the plugin readme for details.
  data_source_name = "username:password@tcp(host:port)/dbname"

  ## Timestamp column name
  timestamp_column = "timestamp"

  ## Table creation template
  ## Available template variables:
  ##  {TABLE} - table name as a quoted identifier
  ##  {TABLELITERAL} - table name as a quoted string literal
  ##  {COLUMNS} - column definitions (list of quoted identifiers and types)
  table_template = "CREATE TABLE {TABLE}({COLUMNS})"

  ## SQL INSERT statement with placeholders. Telegraf will substitute values at runtime.
  ## table_template = "INSERT INTO metrics (timestamp, name, value, tags) VALUES (?, ?, ?, ?)"

  ## Table existence check template
  ## Available template variables:
  ##  {TABLE} - tablename as a quoted identifier
  table_exists_template = "SELECT 1 FROM {TABLE} LIMIT 1"

  ## Initialization SQL
  init_sql = "SET sql_mode='ANSI_QUOTES';"

  ## Maximum amount of time a connection may be idle. "0s" means connections are
  ## never closed due to idle time.
  connection_max_idle_time = "0s"

  ## Maximum amount of time a connection may be reused. "0s" means connections
  ## are never closed due to age.
  connection_max_lifetime = "0s"

  ## Maximum number of connections in the idle connection pool. 0 means unlimited.
  connection_max_idle = 2

  ## Maximum number of open connections to the database. 0 means unlimited.
  connection_max_open = 0

  ## NOTE: Due to the way TOML is parsed, tables must be at the END of the
  ## plugin definition, otherwise additional config options are read as part of the
  ## table

  ## Metric type to SQL type conversion
  ## The values on the left are the data types Telegraf has and the values on
  ## the right are the data types Telegraf will use when sending to a database.
  ##
  ## The database values used must be data types the destination database
  ## understands. It is up to the user to ensure that the selected data type is
  ## available in the database they are using. Refer to your database
  ## documentation for what data types are available and supported.
  #[outputs.sql.convert]
  #  integer              = "INT"
  #  real                 = "DOUBLE"
  #  text                 = "TEXT"
  #  timestamp            = "TIMESTAMP"
  #  defaultvalue         = "TEXT"
  #  unsigned             = "UNSIGNED"
  #  bool                 = "BOOL"
  #  ## This setting controls the behavior of the unsigned value. By default the
  #  ## setting will take the integer value and append the unsigned value to it. The other
  #  ## option is "literal", which will use the actual value the user provides to
  #  ## the unsigned option. This is useful for a database like ClickHouse where
  #  ## the unsigned value should use a value like "uint64".
  #  # conversion_style = "unsigned_suffix"

Input and output integration examples

iptables

1. Monitoring Firewall Performance: Monitor the performance and efficiency of your firewall rules in real time. By tracking packet and byte counters, network administrators can identify which rules are most active and may require optimization. This enables proactive management of firewall configurations to enhance security and performance, especially in environments where dynamic adjustments are frequently made.

2. Understanding Traffic Patterns: Analyze incoming and outgoing traffic patterns based on specific rules. By leveraging the metrics gathered by this plugin, system admins can gain insights into which services are receiving the most traffic, effectively identifying popular services and potential security threats from unusual traffic spikes.

3. Automated Alerting on Traffic Anomalies: Integrate the iptables plugin with an alerting system to notify administrators of unusual activity detected by the firewall. By setting thresholds on the collected metrics, such as sudden increases in packets dropped or unexpected protocol use, teams can automate responses to potential security incidents, enabling swift remediation of threats to the network.

4. Comparative Analysis of Firewall Rules: Conduct comparative analyses of different firewall rules over time. By collecting historical packet and byte metrics, organizations can evaluate the effectiveness of various rules, making data-driven decisions on which rules to modify, reinforce, or remove altogether, thus streamlining their firewall configurations.

MariaDB

1. Business Intelligence Integration: Store application performance metrics directly into MariaDB and connect it to BI tools like Metabase or Apache Superset. This setup allows blending of operational data with business KPIs for unified dashboards, enhancing visibility across departments.

2. Compliance Reporting with Historical Metrics: Use this plugin to log metrics into MariaDB for audit and compliance use cases. The relational model enables precise querying of past performance indicators with timestamped entries, supporting regulatory documentation.

3. Custom Alerting Based on SQL Logic: Insert metrics into MariaDB and use custom SQL queries to define alert thresholds or conditions. Combined with cron jobs or scheduled scripts, this enables advanced alerting workflows not possible with traditional metric platforms.

4. IoT Sensor Metrics Storage: Collect sensor data from IoT devices via Telegraf and store it in MariaDB using a normalized schema. This approach is cost-effective and integrates well with existing SQL-based systems for real-time or historical analysis.

Feedback

Thank you for being part of our community! If you have any general feedback or found any bugs on these pages, we welcome and encourage your input. Please submit your feedback in the InfluxDB community Slack.