Skip to content

Check strongswan-connections

Overview

Checks IPSec connection states on a strongSwan VPN gateway by connecting to the charon daemon via the VICI (Versatile IKE Control Interface) socket. Reports IKE SA and CHILD SA states, re-authentication/re-keying timers, and traffic counters. "EST" in the output means "Established".

Important Notes:

  • strongSwan with VICI interface (swanctl); tested with VICI protocol versions 5.7 and 5.9
  • Must be run locally on the strongSwan host (needs access to the VICI socket)
  • Requires root or sudo

Data Collection:

  • Connects to the VICI socket (default: /run/strongswan/charon.vici) to enumerate configured and active connections
  • Iterates over all IKE SAs and their CHILD SAs, collecting state, timing, and traffic data
  • --lengthy provides additional columns: established time, IKE version, local/remote endpoints, encryption/integrity details, and per-child local/remote traffic selectors

Fact Sheet

Fact Value
Check Plugin Download https://github.com/Linuxfabrik/monitoring-plugins/tree/main/check-plugins/strongswan-connections
Nagios/Icinga Check Name check_strongswan_connections
Check Interval Recommendation Every minute
Can be called without parameters Yes
Runs on Cross-platform
Compiled for Windows No (runs with Python interpreter)
3rd Party Python modules vici

Help

usage: strongswan-connections [-h] [-V] [--always-ok] [--ignore IGNORE]
                              [--lengthy] [--match MATCH] [--no-perfdata]
                              [--socket SOCKET] [--timeout TIMEOUT]

Checks IPSec connection states on a strongSwan VPN gateway. Connects to the
charon daemon via the VICI interface to retrieve IKE SA and CHILD SA states.
Alerts on connections that are not in the expected established state.
Connection names can be filtered out with --ignore, which is useful for
gateways that mix permanent site-to-site peers with transient remote-access
clients where only the site-to-site peers should drive the alert. Supports
extended reporting via --lengthy. Requires root or sudo.

options:
  -h, --help         show this help message and exit
  -V, --version      show program's version number and exit
  --always-ok        Always returns OK.
  --ignore IGNORE    Ignore connections whose VICI key matches this Python
                     regular expression. Case-sensitive by default; use `(?i)`
                     for case-insensitive matching. Can be specified multiple
                     times. Example: `--ignore="^RA_"` to skip transient
                     remote-access clients on a VPN gateway that also carries
                     permanent site-to-site peers. Example:
                     `--ignore="(?i)test"` (case-insensitive) to skip any
                     connection with "test" in its name. Default: None
  --lengthy          Extended reporting.
  --match MATCH      Only check connections whose VICI key matches this Python
                     regular expression. Case-sensitive by default; use `(?i)`
                     for case-insensitive matching. Can be specified multiple
                     times. If both `--match` and `--ignore` are given, an
                     item must match `--match` AND not match `--ignore` to be
                     reported (include first, exclude second). Example:
                     `--match="^S2S_SITE-XY$"` to pin an Icinga service to one
                     specific site-to-site peer. Example:
                     `--match="(?i)^s2s_"` (case-insensitive) to check every
                     site-to-site peer on a gateway. Default: None
  --no-perfdata      Suppress the performance data section from the output.
                     The status message and the exit code are unaffected, so
                     alerting keeps working while trending data is dropped.
  --socket SOCKET    Path to the Versatile IKE Control Interface (VICI)
                     socket. Must resolve within /run or /var/run, and nobody
                     but root may be able to replace it. Default:
                     /run/strongswan/charon.vici
  --timeout TIMEOUT  Network timeout in seconds. Default: 8 (seconds)

Documentation:
https://linuxfabrik.github.io/monitoring-plugins/check-plugins/strongswan-connections/

Usage Examples

./strongswan-connections

Output:

Everything is ok.

Conn.     ! State ! Re-Authentication   ! Child     ! Mode:State       ! Re-Keying           ! Expires             ! Rx       ! Tx
----------+-------+---------------------+-----------+------------------+---------------------+---------------------+----------+----------
example   ! EST   ! 2022-05-11 13:36:24 ! example   ! TUNNEL:INSTALLED ! 2022-05-11 11:02:36 ! 2022-05-11 11:12:53 ! 0.0B     ! 0.0B
acme      ! EST   ! 2022-05-11 14:57:14 ! acme1     ! TUNNEL:INSTALLED ! 2022-05-11 14:03:57 ! 2022-05-11 15:02:29 ! 1.3MiB   ! 997.0KiB
acme      ! EST   ! 2022-05-11 14:57:14 ! acme2     ! TUNNEL:INSTALLED ! 2022-05-11 13:38:36 ! 2022-05-11 15:10:18 ! 633.2KiB ! 634.5KiB

With --lengthy:

Everything is ok.

Conn.     ! State ! Established         ! Re-Authentication   ! IKE ! Local               ! Remote             ! Encryption/Integrity/Pseudo Random/DH                     ! Child     ! Mode:State       ! Local         ! Remote        ! Prot:Encryption/Integrity/DH                ! Installed           ! Re-Keying           ! Expires             ! Rx       ! Tx
----------+-------+---------------------+---------------------+-----+---------------------+--------------------+-----------------------------------------------------------+-----------+------------------+---------------+---------------+---------------------------------------------+---------------------+---------------------+---------------------+----------+----------
example   ! EST   ! 2022-05-11 06:08:24 ! 2022-05-11 13:36:24 ! v2  ! 198.51.100.246:500  ! 203.0.113.226:500  ! AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256   ! example   ! TUNNEL:INSTALLED ! 192.0.2.0/24  ! 10.0.11.0/24  ! ESP:AES_GCM_16-256/None/ECP_256             ! 2022-05-11 10:06:53 ! 2022-05-11 11:02:36 ! 2022-05-11 11:12:53 ! 0.0B     ! 0.0B
acme      ! EST   ! 2022-05-10 15:03:43 ! 2022-05-11 14:57:14 ! v2  ! 198.51.100.246:4500 ! 203.0.113.28:4500  ! AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 ! acme1     ! TUNNEL:INSTALLED ! 192.0.2.0/24  ! 172.16.0.0/16 ! ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_1536 ! 2022-05-11 06:14:29 ! 2022-05-11 14:03:57 ! 2022-05-11 15:02:29 ! 1.2MiB   ! 934.5KiB
acme      ! EST   ! 2022-05-10 15:03:43 ! 2022-05-11 14:57:14 ! v2  ! 198.51.100.246:4500 ! 203.0.113.28:4500  ! AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536 ! acme2     ! TUNNEL:INSTALLED ! 192.0.99.0/24 ! 172.16.0.0/16 ! ESP:AES_CBC-256/HMAC_SHA2_256_128/MODP_1536 ! 2022-05-11 06:22:18 ! 2022-05-11 13:38:36 ! 2022-05-11 15:10:18 ! 599.7KiB ! 601.2KiB

States

  • OK if all configured connections are active and all child SAs are connected.
  • WARN if there are no active connections at all.
  • WARN if configured connections do not match active connections.
  • WARN if any child SA is not connected.
  • WARN if charon does not answer on the VICI socket within --timeout.
  • UNKNOWN if no connections are configured.
  • UNKNOWN if --socket resolves outside /run or /var/run, or if anybody but root could replace the socket or a directory above it.
  • --always-ok suppresses all alerts and always returns OK.

Perfdata / Metrics

Name Type Description
\<connname>_established Seconds Seconds the IKE SA has been established. Only reported once the connection is established.
\<connname>_reauth-time Seconds Seconds before the IKE SA gets re-authenticated, negative once it is overdue. Only reported once the connection is established, and only if the peer configuration re-authenticates it.
\<connname>_rekey-time Seconds Seconds before IKE SA gets rekeyed, negative once the rekey is overdue. Only reported once the connection is established, and only if the peer configuration rekeys it.
\<connname>_\<childname>_bytes-in Bytes Number of input bytes processed. Only reported once the CHILD SA is installed.
\<connname>_\<childname>_bytes-out Bytes Number of output bytes processed. Only reported once the CHILD SA is installed.
\<connname>_\<childname>_install-time Seconds Seconds the CHILD SA has been installed. Only reported once the CHILD SA is installed.
\<connname>_\<childname>_life-time Seconds Seconds before CHILD SA expires, negative once it is overdue. Only reported for a CHILD SA that expires.
\<connname>_\<childname>_rekey-time Seconds Seconds before CHILD SA gets rekeyed, negative once the rekey is overdue. Only reported for a CHILD SA that gets rekeyed.

Troubleshooting

[Errno 2] No such file or directory

Check the path to charon.vici, and specify --socket accordingly.

Python module "vici" is not installed.

Install vici: pip install vici.

Credits, License