Linux dropped 监控与预警实战
一、先明确 dropped 的来源与含义
二、快速落地监控方案
三、预警规则与阈值建议
四、一键巡检与告警脚本示例
#!/usr/bin/env bash
IFACE="eth0"
THRESHOLD=10 # 5分钟增量阈值(packets)
LOG="/var/log/drop_warn.log"
TMP="/tmp/ifstat_${IFACE}.prev"
now=$(date '+%F %T')
read rx1 tx1 < <(ip -s -json link show dev "$IFACE" | \
jq -r '[.stats.rx.dropped, .stats.tx.dropped] | @tsv')
if [[ -f "$TMP" ]]; then
read rx0 tx0 < "$TMP"
drx=$((rx1 - rx0)); dtx=$((tx1 - tx0))
if (( drx > THRESHOLD || dtx > THRESHOLD )); then
echo "[$now] WARN $IFACE dropped RX+TX: $drx+$dtx" >> "$LOG"
# 可替换为实际告警方式:curl 调用 webhook / mailx / sendmail
echo "Subject: $IFACE dropped $drx+$dtx" | mailx -s "Net dropped alert" ops@example.com
fi
fi
echo "$rx1 $tx1" > "$TMP"
五、定位与优化要点