Skip to main content

Host Sysctl

Host Sysctl Collector​

To collect information about the configured kernel parameters you can use the sysctl collector. This will read the Kernel's parameters at runtime through the sysctl utility, similar to what you would get by running sysctl -a.

Parameters​

None.

Example Collector Definition​

apiVersion: troubleshoot.sh/v1beta2
kind: SupportBundle
metadata:
  name: sysctl
spec:
  hostCollectors:
    - sysctl: {}

Included Resources​

The results of the sysctl collector are stored in the host-collectors/system directory of the support bundle.

sysctl.json​

Example of the resulting JSON file:

{
  (...)
  "net.ipv4.conf.all.arp_accept": "0",
  "net.ipv4.conf.all.arp_announce": "0",
  "net.ipv4.conf.all.arp_evict_nocarrier": "1",
  "net.ipv4.conf.all.arp_filter": "0",
  "net.ipv4.conf.all.arp_ignore": "0",
  "net.ipv4.conf.all.arp_notify": "0",
  "net.ipv4.conf.all.drop_gratuitous_arp": "0",
  "net.ipv4.conf.all.proxy_arp": "0",
  "net.ipv4.conf.all.proxy_arp_pvlan": "0",
  "net.netfilter.nf_log.0": "NONE",
  "net.netfilter.nf_log.1": "NONE",
  "net.netfilter.nf_log.10": "nf_log_ipv6",
  "net.netfilter.nf_log.2": "nf_log_ipv4",
  "net.netfilter.nf_log.3": "nf_log_arp",
  (...)
}

Host Sysctl Analyzer​

The sysctl analyzer supports multiple outcomes by validating the values of multiple properties. For example:

  • net.ipv4.conf.all.arp_ignore > 2: Value for the net.ipv4.conf.all.arp_ignore property is greater than 2.
  • net.ipv4.conf.all.arp_filter = 0: Value for the net.ipv4.conf.all.arp_filter equals 0.

Note: inequality operators (>, >=, < and <=) will only work when the type of the value being analyzed can be converted to int.

Example Analyzer Definition​

apiVersion: troubleshoot.sh/v1beta2
kind: SupportBundle
metadata:
  name: sysctl
spec:
  hostCollectors:
    - sysctl: {}
  hostAnalyzers:
    - sysctl:
        checkName: "ARP parameters"
        outcomes:
          - fail:
              when: "net.ipv4.conf.all.arp_ignore > 0"
              message: "ARP ignore is enabled for all interfaces on the host. Disable it by running 'sysctl net.ipv4.conf.all.arp_ignore=0'."
          - warn:
              when: "net.ipv4.conf.all.arp_filter = 1"
              message: "ARP filtering is enabled for all interfaces on the host. Disable it by running 'sysctl net.ipv4.conf.all.arp_filter=0'."