Input Displaying recent top IPs with reverse IP lookups on Plesk Dashboard or Health screen

[pleskpanel]

Server operating system version

All

Plesk version and microupdate number

All

Instead of relying on Linux commands, it might be helpful to add these to the home dashboard and/or the health screen, and even more so with corresponding reverse lookups!

Top external addresses with open connections:

# netstat -nt | awk '/^tcp/ {print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n

Top recent external IPs:

# tail -50000 /var/log/httpd/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail

 

[Bitpalast]

I like these directives. For the dashboard it should also be OK, because they cause limited load only. The reverse lookups should be an option. These could take a lot of time.

What's the exact benefit for the administrator seeing the outputs? (What's the business case where the information is helpful?)

 

[pleskpanel]

For a limited number of top IPs, the reverse lookups should be relatively quick and the real benefit to the service provider view would be quickly identifying potential sources of abusive traffic. CloudFlare and other products do a very good job of providing "At a glance" type dashboards like this.

 

[Bitpalast]

Yes, but what could I use the information for?

 

[Kaspar]

Instead of relying on Linux commands, it might be helpful to add these to the home dashboard and/or the health screen, and even more so with corresponding reverse lookups!

Top external addresses with open connections:

# netstat -nt | awk '/^tcp/ {print $5}' | awk -F: '{print $1}' | sort | uniq -c | sort -n

Top recent external IPs:

# tail -50000 /var/log/httpd/access_log | awk '{print $1}' | sort | uniq -c | sort -n | tail

I don't want to depreciate your suggestion/request but in case your wasn't aware yet, it is possible to create your own Home Dashboard widgets. Plesk published a code example with explanation on GitHub which is a great starting point. This does of course requires a bit of PHP knowledge and getting started with creating Plesk extensions definitely has a learning curve. In return it opens a world of possibilities to extensively customize and automate your Plesk setup.

To make your life easier I've created additional widget (see attachment to this post) as an example which shows the current connections from your netstat command on the home Dashboard. Adapt and improve for your own need.

Install instructions

# wget https://talk.plesk.com/attachments/ext-dashboard-open-connections-zip.28696/
# unzip ext-dashboard-open-connections.zip
# cd ext-dashboard-open-connections
# /opt/plesk/php/8.3/bin/php /usr/lib64/plesk-9.0/composer.phar install
# cd ..
# zip -r ext-dashboard-open-connections.zip ext-dashboard-open-connections/
# plesk bin extension -i ext-dashboard-open-connections.zip