Finding the culprit for TCP_StatsCollector ConnectionsEstablished alert for Windows collectors | Product Discussions

Cole McDonald · 2024-01-08T17:45:44Z

From the collector’s device page in the LM Portal or the collectors page, get to a debug console, then here’s your !POSH one-liner to get info about the destination device that is holding your ports captive.netstat -an | sls establish | foreach { ($_ -split "\s+")[3] } | group | sort count | select count, name -last 10In the Netstat, a shows all, n shows IP addresses rather than solving the DNS for it.The Select-String (aliased as sls) passes only the “Established” connection entries from the netstat down the pipeline.The foreach{} splits each line ($_ is the current object being iterated by the foreach loop) on contiguous whitespace (I use this a lot!) and takes the third element (remote address:port) to pass down the pipelineIt then passes Group-Object (aliased as group) which bundles identical strings and Sort-Object (aliased as sort) by the count property of the group object.The select displays grabs the calculated match count and the name properties to limit display and just shows the -last 10 of them (which are the biggest number of matched lines due to the sort previously applied.This should give you the target/s for troubleshooting further.

MoreDiscussions

Finding the culprit for TCP_StatsCollector ConnectionsEstablished alert for Windows collectors | Product Discussions | LogicMonitor Community