Perl Script: Squid Throughput for Nagios

unix:/ # crontab -l|fgrep squid-t
0 0 * * * /web/server/etc/squid-throughput-cleanup.sh > /var/adm/squid-throughput-cleanup.log 2>&1

#!/bin/sh
#
# we only want to keep stats for this day only.
# so we start from scratch each day by removing the
# Storable files. at about midnight is a good time
#
set -x

cd /var/squid-throughput || exit 2

/bin/rm -f /var/squid-throughput/*.store

#!/usr/bin/perl -w
#-------------------------------------------------------------------
#
# $Header: /web/server/etc/RCS/squid-throughput.pl-edit,v 1.38 2014/03/11 03:52:57 mwd Exp mwd $
#
# Michael Dean - 2013
#
#-------------------------------------------------------------------

use strict;
use Storable qw(lock_store lock_retrieve);
use Time::localtime qw( ctime );
use Time::HiRes qw( gettimeofday sleep );

use Getopt::Long;

#-------------------------------------------------------------------

my $VERSION = substr( q$Revision: 1.38 $, 10 );

#--------------------------------------------------------options----
my $opt_debug    = 0;
my $opt_warning  = 0;
my $opt_critical = 0;

my $opt_ranklimit     = 1000;               # just so we don't step through a billion elements
my $opt_bytelimit     = 1024 * 1024;        # 1 MEGABYTE
my $opt_durationlimit = 30;                 # 30 seconds

# reporting options
my $opt_users     = 0;
my $opt_websites  = 1;
my $opt_clientips = 1;

my $opt_syslogtag = $0;
$opt_syslogtag =~ s!^/.*/!!soig;

my $opt_logger    = '/usr/bin/logger';
my $opt_logtail   = '/usr/local/bin/logtail';
my $opt_logfile   = '/web/squid/logs/access.log';
my $opt_logoffset = '';
my $opt_hostname  = '';                               # only used for a unique logoffset file and totals

# Store persistent totals here
my $opt_vardir = '/var/squid-throughput';

# use persistent totals
my $opt_persistent = 0;

GetOptions(
'debug|d|v+'  => \$opt_debug,
'warning=s'   => \$opt_warning,
'critical=s'  => \$opt_critical,
'syslogtag=s' => \$opt_syslogtag,
'vardir=s'    => \$opt_vardir,
'logger=s'    => \$opt_logger,
'logtail=s'   => \$opt_logtail,
'logfile=s'   => \$opt_logfile,
'logoffset=s' => \$opt_logoffset,

'hostname|h=s' => \$opt_hostname,

'persistent!' => \$opt_persistent,
'clientips!'  => \$opt_clientips,
'websites!'   => \$opt_websites,
'users!'      => \$opt_users,
'ranklimit=n' => \$opt_ranklimit, );

die "$opt_logger: required executable not found"  if ( !-x $opt_logger );
die "$opt_logtail: required executable not found" if ( !-x $opt_logtail );
die "$opt_logfile: required logfile not found"    if ( !-f $opt_logfile );

#-----------------------------------------------------clean-up-----
# clean up the opt_vardir by removing all extra trailing /'s
# we add the / ourselves in the lines just below
$opt_vardir =~ s!/+$!!soig;

# chop out non-word chars from the hostname
$opt_hostname =~ s!\W+!!soig;

# TODO: Need to make this unique to the host that is calling it
if ( $opt_logoffset eq '' ) {
$opt_logoffset = $opt_vardir . "/${opt_hostname}-squid-throughput.offset";
}

#-----------------------------------------------------persistent---

my $total_clientipurls_store  = $opt_vardir . "/${opt_hostname}-clientipurls.store";
my $total_clientipbytes_store = $opt_vardir . "/${opt_hostname}-clientipbytes.store";
my $total_userurls_store      = $opt_vardir . "/${opt_hostname}-userurls.store";
my $total_userbytes_store     = $opt_vardir . "/${opt_hostname}-userbytes.store";

#-------------------------------------------------------globals----
my $linecounter = 0;

my $totalsize        = 0;
my $totalurls        = 0;
my %userurls         = ();
my %userbytes        = ();
my %siteurls         = ();
my %sitebytes        = ();
my %siteduration     = ();
my %sitebyterate     = ();
my %clientipurls     = ();
my %clientipbytes    = ();
my %clientipduration = ();
my %clientipbyterate = ();

my $main_summary     = '';
my $warning_summary  = '';
my $critical_summary = '';

#------------------------------------------------------------------

my $critical_urlrate  = 0;
my $critical_byterate = 0;
my $warning_urlrate   = 0;
my $warning_byterate  = 0;

# persistent options
my $total_criticalurls  = 0;
my $total_criticalbytes = 0;
my $total_warningurls   = 0;
my $total_warningbytes  = 0;

my $starttime  = 0;
my $finishtime = 0;

# backwards compatible
( $warning_urlrate, $warning_byterate ) = ( $1, $2 * 1024 ) if ( $opt_warning =~ m!^(\d+),(\d+)$!soig );
( $critical_urlrate, $critical_byterate ) = ( $1, $2 * 1024 )
if ( $opt_critical =~ m!^(\d+),(\d+)$!soig );

( $warning_urlrate, $warning_byterate, $total_warningurls, $total_warningbytes ) =
( $1, $2 * 1024, $3, $4 * 1024 )
if ( $opt_warning =~ m!^(\d+),(\d+),(\d+),(\d+)$!soig );
( $critical_urlrate, $critical_byterate, $total_criticalurls, $total_criticalbytes ) =
( $1, $2 * 1024, $3, $4 * 1024 )
if ( $opt_critical =~ m!^(\d+),(\d+),(\d+),(\d+)$!soig );

printf
"WARNING-URLS=%d WARNING-BYTES=%dKB TOTAL-WARNING-URLS=%d TOTAL-WARNING-BYTES=%d CRITICAL-URLS=%d CRITICAL-BYTES=%dKB TOTAL-CRITICAL-URLS=%d TOTAL-CRITICAL-BYTES=%d\n",
$warning_urlrate, $warning_byterate, $total_warningurls, $total_warningbytes, $critical_urlrate,
$critical_byterate, $total_criticalurls, $total_criticalbytes
if ( $opt_debug > 6 );

#----------------------------------------------------initialise----
# UNBUFFER IT
$| = 1;

#------------------------------------------------------------GO----
my $logtail_cmd = "$opt_logtail $opt_logfile $opt_logoffset";

open( LOGTAILOUT, "$logtail_cmd|" ) or die "$!: $logtail_cmd";

#-COLLECTION-------------------------------------------------------
# 1377810326.845  60891 167.123.61.100 TCP_MISS/200 4834 CONNECT h.live.com:443 sumuser FIRSTUP_PARENT/167.123.240.35 -
while (<logtailout>) {

if (m!^(\S+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$!soig) {

my ( $reqtime, $duration, $clientip, $status, $size,
$method,  $request,  $username, $parent, $mimetype )
= ( $1, $2, $3, lc $4, lc $5, lc $6, $7, $8, $9, $10 );

# Seems to be a valid line, so tick over the counter
$linecounter++;

# convert milliseconds to seconds
if ( $duration > 0 ) {
$duration = $duration / 1000;
} else {
$duration = 1;        # default the duration to a millisecond to avoid divide by zero errors
}

# not sure how useful this is now that i am monitor actual byte rates as specified in the
# log file as to calculating throughput speed, which doesn't account for long established
# connections that could transfer much data, apparently in the last five minutes when in
# fact that connection has been established for much longer
$finishtime = $reqtime;
$starttime = $finishtime if ( $starttime == 0 );

print STDERR "$starttime = $finishtime\n" if ( $opt_debug > 8 );

# avoid negative sizes
$size = 0 if ( $size < 0 );

        # tidy up the URL, as we don't want the whole thing, the website is sufficient
        my $website = $request || '';
        $website =~ s!^(http://[^/]+/).*$!$1!oig;
        if ( $website =~ s!:443$!/!oig ) {
            $website = "https://$website" if ( $website !~ m!^http!io );
        }

        my $fileext = $1 if ( $request =~ m!//.*/.*?(\.[\w]+).?$!oig );
        $fileext ||= '-';

        $fileext = 'html' if ( $fileext eq 'htm' );

        $userurls{$username}         ||= 0;
        $userbytes{$username}        ||= 0;
        $clientipurls{$clientip}     ||= 0;
        $clientipbytes{$clientip}    ||= 0;
        $clientipduration{$clientip} ||= 0;

        $totalurls++;
        $totalsize += $size;

        $siteurls{$website}++;
        $sitebytes{$website}    += $size;
        $siteduration{$website} += $duration;
        $sitebyterate{$website} = $sitebytes{$website} / $siteduration{$website};

        $userurls{$username}++;
        $userbytes{$username} += $size;

        $clientipurls{$clientip}++;
        $clientipbytes{$clientip}    += $size;
        $clientipduration{$clientip} += $duration;
        $clientipbyterate{$clientip} = $clientipbytes{$clientip} / $clientipduration{$clientip};
        print
          "$clientipbyterate{$clientip} = $clientipbytes{$clientip} / $clientipduration{$clientip};\n"
          if ( $opt_debug > 8 );
} ## end if (m!^(\S+)\s+(\d+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)$!soig)
} ## end while (<logtailout>)

close(LOGTAILOUT);

#------------------------------------------------------------------
#-PROCESSING-------------------------------------------------------
#------------------------------------------------------------------
# load the running totals
if ($opt_persistent) {
my %TOTAL_CLIENTIPURLS = %{ lock_retrieve $total_clientipurls_store }
if ( -f $total_clientipurls_store );
my %TOTAL_CLIENTIPBYTES = %{ lock_retrieve $total_clientipbytes_store }
if ( -f $total_clientipbytes_store );
my %TOTAL_USERURLS  = %{ lock_retrieve $total_userurls_store }  if ( -f $total_userurls_store );
my %TOTAL_USERBYTES = %{ lock_retrieve $total_userbytes_store } if ( -f $total_userbytes_store );

# add the current totals to the running totals of the stats
foreach my $key ( keys %clientipurls ) {
$TOTAL_CLIENTIPURLS{$key} ||= 0;
$TOTAL_CLIENTIPURLS{$key} += $clientipurls{$key};
}
foreach my $key ( keys %clientipbytes ) {
$TOTAL_CLIENTIPBYTES{$key} ||= 0;
$TOTAL_CLIENTIPBYTES{$key} += $clientipbytes{$key};
}
foreach my $key ( keys %userurls ) {
next if ( $key eq '-' );
$TOTAL_USERURLS{$key} ||= 0;
$TOTAL_USERURLS{$key} += $userurls{$key};
}
foreach my $key ( keys %userbytes ) {
next if ( $key eq '-' );
$TOTAL_USERBYTES{$key} ||= 0;
$TOTAL_USERBYTES{$key} += $userbytes{$key};
}

# write out those running totals
lock_store \%TOTAL_CLIENTIPURLS,  $total_clientipurls_store;
lock_store \%TOTAL_CLIENTIPBYTES, $total_clientipbytes_store;
lock_store \%TOTAL_USERURLS,      $total_userurls_store;
lock_store \%TOTAL_USERBYTES,     $total_userbytes_store;

# $total_warningurls, $total_warningbytes
# $total_criticalurls, $total_criticalbytes

# now report on there being any clients/users over the daily limits
if ($opt_clientips) {
foreach my $key ( keys %TOTAL_CLIENTIPURLS ) {
print "CRITICAL CLIENTIPURLS TEST ( $TOTAL_CLIENTIPURLS{$key} > $total_criticalurls )\n"
if ($opt_debug);
print "WARNING CLIENTIPURLS TEST ( $TOTAL_CLIENTIPURLS{$key} > $total_warningurls )\n"
if ($opt_debug);
print "$key == $TOTAL_CLIENTIPURLS{$key}\n" if ($opt_debug);
if ( $TOTAL_CLIENTIPURLS{$key} > $total_criticalurls ) {
$critical_summary .= sprintf "%s=%durls; ", $key, $TOTAL_CLIENTIPURLS{$key};
} elsif ( $TOTAL_CLIENTIPURLS{$key} > $total_warningurls ) {
$warning_summary .= sprintf "%s=%durls; ", $key, $TOTAL_CLIENTIPURLS{$key};
}
} ## end foreach my $key ( keys %TOTAL_CLIENTIPURLS)
} ## end if ($opt_clientips)
if ($opt_clientips) {
foreach my $key ( keys %TOTAL_CLIENTIPBYTES ) {
print "CRITICAL CLIENTIPBYTE TEST ( $TOTAL_CLIENTIPBYTES{$key} > $total_criticalbytes )\n"
if ($opt_debug);
print "WARNING CLIENTIPBYTE TEST ( $TOTAL_CLIENTIPBYTES{$key} > $total_warningbytes )\n"
if ($opt_debug);
print "$key == $TOTAL_CLIENTIPBYTES{$key}\n" if ($opt_debug);
if ( $TOTAL_CLIENTIPBYTES{$key} > $total_criticalbytes ) {
$critical_summary .= sprintf "%s=%s; ", $key, print_bytes( $TOTAL_CLIENTIPBYTES{$key} );
} elsif ( $TOTAL_CLIENTIPBYTES{$key} > $total_warningbytes ) {
$warning_summary .= sprintf "%s=%s; ", $key, print_bytes( $TOTAL_CLIENTIPBYTES{$key} );
}
} ## end foreach my $key ( keys %TOTAL_CLIENTIPBYTES)
} ## end if ($opt_clientips)
if ($opt_users) {
foreach my $key ( keys %TOTAL_USERURLS ) {
print "CRITICAL USERURLS TEST ( $TOTAL_USERURLS{$key} > $total_criticalurls )\n"
if ($opt_debug);
print "WARNING USERURLS TEST ( $TOTAL_USERURLS{$key} > $total_warningurls )\n"
if ($opt_debug);
print "$key == $TOTAL_USERURLS{$key}\n" if ($opt_debug);
if ( $TOTAL_USERURLS{$key} > $total_criticalurls ) {
$critical_summary .= sprintf "%s=%durls; ", $key, $TOTAL_USERURLS{$key};
} elsif ( $TOTAL_USERURLS{$key} > $total_warningurls ) {
$warning_summary .= sprintf "%s=%durls; ", $key, $TOTAL_USERURLS{$key};
}
} ## end foreach my $key ( keys %TOTAL_USERURLS)
} ## end if ($opt_users)
if ($opt_users) {
foreach my $key ( keys %TOTAL_USERBYTES ) {
print "CRITICAL USERBYTE TEST ( $TOTAL_USERBYTES{$key} > $total_criticalbytes )\n"
if ($opt_debug);
print "WARNING USERBYTE TEST ( $TOTAL_USERBYTES{$key} > $total_warningbytes )\n"
if ($opt_debug);
print "$key == $TOTAL_USERBYTES{$key}\n" if ($opt_debug);
if ( $TOTAL_USERBYTES{$key} > $total_criticalbytes ) {
$critical_summary .= sprintf "%s=%s; ", $key, print_bytes( $TOTAL_USERBYTES{$key} );
} elsif ( $TOTAL_USERBYTES{$key} > $total_warningbytes ) {
$warning_summary .= sprintf "%s=%s; ", $key, print_bytes( $TOTAL_USERBYTES{$key} );
}
} ## end foreach my $key ( keys %TOTAL_USERBYTES)
} ## end if ($opt_users)
} ## end if ($opt_persistent)

#------------------------------------------------------------------

my $timediff = $finishtime - $starttime;
$timediff = 1 if ( $timediff < 1 );        # prevent a divide by zero

printf "lines processed=%d at %.2f lines per second over %dseconds\n", $linecounter,
  $linecounter / $timediff, $timediff
  if ( $opt_debug > 4 );

#------------------------------------------------------------------
#------------------------------------------------------------------

#------------------------------------------------------------------
# Step through the list of hits
if ($opt_websites) {

# top sites by url count
{
my $rank  = 0;
my $title = "TOP WEB SITES by URLs";
$main_summary .= sprintf "$title\n\n";
$main_summary .= sprintf "%6s  %8s      %s\n\n", 'Rank', 'URLs', 'Web Site';
foreach my $key ( sort { $siteurls{$b} <=> $siteurls{$a} } keys %siteurls ) {
$rank++;
$main_summary .= sprintf "%6d %9d      %s\n", $rank, $siteurls{$key}, $key;
my $hitrate = $siteurls{$key} / $timediff;
if ( $hitrate > $critical_urlrate ) {
$critical_summary .= sprintf "'%s' hitrate=%.1furls/s, ", $key, $hitrate;
}
if ( $hitrate > $warning_urlrate ) {
$warning_summary .= sprintf "'%s' hitrate=%.1furls/s, ", $key, $hitrate;
}
last if ( $rank >= $opt_ranklimit );
} ## end foreach my $key ( sort { $siteurls...})
}

$main_summary .= sprintf "\n\n\n";

#------------------------------------------------------------------

# top sites by bytes downloaded
{
my $rank  = 0;
my $title = "TOP WEB SITES by BYTEs";
$main_summary .= sprintf "$title\n\n";
$main_summary .= sprintf "%6s  %10s    %s\n\n", 'Rank', 'Bytes', 'Web Site';
foreach my $key ( sort { $sitebyterate{$b} <=> $sitebyterate{$a} } keys %sitebyterate ) {
$rank++;
$main_summary .= sprintf "%6d   %s    %s\n", $rank, print_bytes( $sitebyterate{$key} ),
$key;

# my $byterate = $sitebytes{$key} / $timediff;
if ( $sitebyterate{$key} > $critical_byterate ) {
$critical_summary .= sprintf "'%s' byterate=%s/s, ", $key,
print_bytes( $sitebyterate{$key} )
if (    ( $sitebytes{$key} > $opt_bytelimit )
&& ( $siteduration{$key} > $opt_durationlimit ) );
}
if ( $sitebyterate{$key} > $warning_byterate ) {
$warning_summary .= sprintf "'%s' byterate=%s/s, ", $key,
print_bytes( $sitebyterate{$key} )
if (    ( $sitebytes{$key} > $opt_bytelimit )
&& ( $siteduration{$key} > $opt_durationlimit ) );
}
last if ( $rank >= $opt_ranklimit );
} ## end foreach my $key ( sort { $sitebyterate...})
}

$main_summary .= sprintf "\n\n\n";

} ## end if ($opt_websites)

#------------------------------------------------------------------
if ($opt_clientips) {

# top clientip by url count
{
my $rank  = 0;
my $title = "TOP CLIENTIPs by URLs";
$main_summary .= sprintf "$title\n\n";
$main_summary .= sprintf "%6s  %7s    %s\n\n", 'Rank', 'URLs', 'Client IP Address';
foreach my $key ( sort { $clientipurls{$b} <=> $clientipurls{$a} } keys %clientipurls ) {
$rank++;
$main_summary .= sprintf "%6d  %7d    %s\n", $rank, $clientipurls{$key}, $key;
my $hitrate = $clientipurls{$key} / $timediff;
if ( $hitrate > $critical_urlrate ) {
$critical_summary .= sprintf "'%s' hitrate=%.1furls/s, ", $key, $hitrate;
}
if ( $hitrate > $warning_urlrate ) {
$warning_summary .= sprintf "'%s' hitrate=%.1furls/s, ", $key, $hitrate;
}
last if ( $rank >= $opt_ranklimit );
} ## end foreach my $key ( sort { $clientipurls...})
}

$main_summary .= sprintf "\n\n\n";

#------------------------------------------------------------------

# top usernames by bytes downloaded
{
my $rank  = 0;
my $title = "TOP CLIENTIPs by BYTES";
$main_summary .= sprintf "$title\n\n";
$main_summary .= sprintf "%6s  %9s    %s\n\n", 'Rank', 'Bytes', 'Client IP Address';
foreach
my $key ( sort { $clientipbyterate{$b} <=> $clientipbyterate{$a} } keys %clientipbyterate )
{
$rank++;
$main_summary .= sprintf "%6d  %s    %s\n", $rank, print_bytes( $clientipbytes{$key} ),
$key;

# my $byterate = $clientipbytes{$key} / $timediff;
if ( $clientipbyterate{$key} > $critical_byterate ) {
$critical_summary .= sprintf "'%s' byterate=%s/s, ", $key,
print_bytes( $clientipbyterate{$key} )
if (    ( $clientipbytes{$key} > $opt_bytelimit )
&& ( $clientipduration{$key} > $opt_durationlimit ) );
}
if ( $clientipbyterate{$key} > $warning_byterate ) {
$warning_summary .= sprintf "'%s' byterate=%s/s, ", $key,
print_bytes( $clientipbyterate{$key} )
if (    ( $clientipbytes{$key} > $opt_bytelimit )
&& ( $clientipduration{$key} > $opt_durationlimit ) );
}
last if ( $rank >= $opt_ranklimit );
} ## end foreach my $key ( sort { $clientipbyterate...})
}

$main_summary .= sprintf "\n\n\n";
} ## end if ($opt_clientips)

print $main_summary if ( $opt_debug > 6 );

my $perfdata = sprintf "urls-per-sec=%.2f;;;;", $linecounter / $timediff;

# if critical alerts have been found, print them
if ( $critical_summary ne '' ) {
print "CRITICAL: $critical_summary|$perfdata\n";
exit 2;
}

# if warning alerts have been found, print them
if ( $warning_summary ne '' ) {
print "WARNING: $warning_summary|$perfdata\n";
exit 1;
}

print "OK|$perfdata\n";
exit 0;

#------------------------------------------------------------------
# main program ends
#------------------------------------------------------------------

#-S-U-B-R-O-U-T-I-N-E-S--------------------------------------------

sub print_bytes {
my $bytes = shift;

my $divideby  = 1;
my $bytelabel = 'b ';
if ( $bytes > 1024 * 1024 * 1024 ) {
$divideby  = 1024 * 1024 * 1024;
$bytelabel = 'gb';
} elsif ( $bytes > 1024 * 1024 ) {
$divideby  = 1024 * 1024;
$bytelabel = 'mb';
} elsif ( $bytes > 1024 ) {
$divideby  = 1024;
$bytelabel = 'kb';
}
return sprintf "%.2f%s", $bytes / $divideby, $bytelabel;
} ## end sub print_bytes

__END__

this nagios script accumulates data on a daily basis that checks for

* users downloading too many URLs and BYTES
* client IP addresses downloading too many URLs and BYTES

and checks to see on a per-scan basis for

* users that are consuming too much bandwidth
* client IP addresses that are consuming too much bandwidth
* web sites that are consuming too much bandwidth


the script that does the magic on NS1 is

wal:/web/server/etc/squid-throughput.pl


it will store its persisten data in - must be writable by 'nagios'

wal:/var/squid-throughput/


the .store files in this directory keep track of the running statistics for the day ... the only thing making this store data on a per day basis is that
there is a crontab entry that deletes these .store files once a day

wal:/ # crontab -l|fgrep squid-t
0 0 * * * /web/server/etc/squid-throughput-cleanup.sh > /var/adm/squid-throughput-cleanup.log 2>&1


it does a simple rm of the *.store files to reset the data

the .offset files in this directory are permanently kept and are used by 'logtail' to indicate where it was up to reading the last time it read the
access.log file

these files in wal:/var/squid-throughput/ are prefixed with the bizarre looking dutyunixfloggerdetirqldgovau or dutyunixmonsterdetirqldgovau this is
done to make sure that flogger and monster have their own set of data to work with but more to make sure that they don't stomp on each other as might
happen if they were sharing the .store files (which to be honest should work as a shared set of data as the script apparently uses routines that are
lock friendly, but that also might change the logic of the script so i'll leave it this inefficient way for the time being) ..

these prefix strings are chosen because it would seem to be the only nagios MACRO that I can use that is set differently for the server that is running
nagios ie. i use the admin email address which i've set to be unique in each nagios config file ie.

flogger:/nagios/local # fgrep admin_e nagios.cfg
admin_email=dutyunix@flogger.detir.qld.gov.au

monster:/nagios/local # fgrep admin_e nagios.cfg
admin_email=dutyunix@monster.detir.qld.gov.au

dutyunix on these boxes is /etc/alias'ed to be sent to us anyway

a "better" solution would be using a nagios macro, which i can't seem to find, that was simply the name of the server running nagios instead of the
$ADMINEMAIL$ macro that I am using...

monster:/nagios/etc # cat checkcommands/check_nrpe_squid_throughput.cfg
define command{
command_name check_nrpe_squid_throughput
command_line $USER1$/check_nrpe2 -t 60 -H $HOSTADDRESS$ -c check_squid_throughput -a $ARG1$ $ARG2$ $ADMINEMAIL$
}


parameters for the checks are set in the service file

monster:/nagios/etc # cat ./services/UNIX/squid-throughput.cfg
define hostgroup{
hostgroup_name squid-throughput
alias Squid Throughput
}

define servicegroup{
servicegroup_name squid-throughput
alias Squid Throughput
}

define service{
use unix-service
name squid-throughput
hostgroups squid-throughput
servicegroups squid-throughput
service_description Squid Throughput
check_command check_nrpe_squid_throughput!50,4096,40000,4000000!25,2048,20000,1000000
}


first set of values are the critical parameters. ie. 50,4096,40000,4000000

50 == 50 urls a second
4096 == 4096 KBytes per second (4MB a sec)
40000 == 40 thousand URLs downloaded (per day)
4000000 == 4 million KBs of data downloaded (4000 MBytes or 4Gbytes)

second set of values are the warning parameters ie. 25,2048,20000,1000000

25 == 25 urls per second
2048 == 2048 KBytes per second (2Mbytes per second)
20000 == 20 thousand URLs downloaded (per day)
1000000 == 1 million Kbytes (1000 MBytes or 1GByte)


association of the service with WAL is set in the host file

monster:/nagios/etc # fgrep squid-throughput hosts/unix/wal.cfg
hostgroups cpu-percent-public,..[snipped]...,squid-throughput



in NRPE, the script configuration is

wal:/ # fgrep squid-t /usr/local/nagios/etc/nrpe.cfg
command[check_squid_throughput]=/web/server/etc/squid-throughput.pl --critical $ARG1$ --warning $ARG2$ --hostname $ARG3$ --persistent


(it would probably would make more sense to call the --hostname option --servername...... but anwyay)