Recently we needed a script to report if an interface was passing more than X traffic.
Everything was OK if using the traffic-monitor... but with just 1 second of traffic (traffic peak) I got notified.
So, I've created a script that is triggered by the traffic-monitor to start the analysis.
If its conditions get accomplished, will report to some Telegram account.
And I decided to share it. So, those who need something like this, would be able to use it easily.
Example will consider:
- ether1-wan as interface
WAN as the interface alias
100Mbps as the traffic limit
90 seconds as the limit for continuous traffic and report
10 minutes between one report and another (if traffic continues)
wan-monitor as trigger name (traffic-monitor)
monitor-ether1 as script name
You will need to create a traffic-monitor like this:
This will act like a trigger to the script to run
Code: Select all
/tool traffic-monitor
add interface=ether1-wan name=wan-monitor on-event=monitor-ether1 traffic=received threshold=100M
With this code inside it (replace variables as you need)
Code: Select all
# ------------------- header -------------------------------------------
# Traffic analysis script and report by Telegram
# By Andre Almeida
# Tested in RouterOS 6.40.3
# Created at 23/10/2017
# Please, keep this header if using this script. Thanks
# ------------------- end header ---------------------------------------
#-----------------------------------------------------------------------
# D E F I N E H E R E Y O U R V A R I A B L E S
#-----------------------------------------------------------------------
# Interface name to monitor
:local intmon "ether1-wan";
# A friendly name to the interface above
:local ifalias "WAN";
# The limit in Mbps for the traffic
:local limittraffic "100";
# The time limit in seconds to consider continuous traffic and report
:local limittime "90";
# Define the interval between reports in minutes
:local reportinterval "10";
# Trigger name created inside /tool traffic-monitor
:local triggers "wan-monitor";
# ChatID from telegram that is going to receive reports
:local chat "0123456789";
# API code from Telegram BOT
:local bot "01234567:AbcdEfGhijklmnOPQrstuvXWY-z";
#-----------------------------------------------------------------------
# S T O P E D I T I N G H E R E
#-----------------------------------------------------------------------
# Disabling the TRIGGER
/tool traffic-monitor set [find name="$triggers"] disabled=yes;
#-----------------------------------------------------------------------
#Traffic analysis script starts now
#-----------------------------------------------------------------------
#Reseting counter
:local counter 0;
:local recbits;
#Checking traffic
:set $recbits ([/interface monitor-traffic [find name="$intmon"] as-value once]->"rx-bits-per-second");
:while ($recbits > ($limittraffic * 1000000)) do={
:while ($counter < $limittime) do={
# Checking traffic
:set $recbits ([/interface monitor-traffic [find name="$intmon"] as-value once]->"rx-bits-per-second");
# Checking if traffic is high
:if ($recbits > ($limittraffic * 1000000)) do={
:set $counter ( $counter + 1);
:delay 1s;} else={
:set $counter ($limittime + 10);
};
}; # <--- End of second while condition
# Rechecking traffic
:set $recbits ([/interface monitor-traffic [find name="$intmon"] as-value once]->"rx-bits-per-second");
# Checking counter
:if ($counter < ($limittime + 10)) do={
# Reseting counter
:set $counter 0;
# Send message to telegram if counter is acomplished
# DO NOT REPLACE ANYTHING HERE
# Defining message
:local initel "https://api.telegram.org/bot";
:local endtel "&text=";
:local newline "%0D%0A";
:local who "$[/system identity get name]";
:local datetime "$[/system clock get date] $[/system clock get time]";
:local message "Interface $ifalias surpassed $newline $limittraffic Mbps by $limittime \
seconds$newline Actual traffic $($recbits / 1000000)Mbps";
:local messagefinal " $who REPORT$newline $newline $message $newline $newline $datetime \
$newline $newline If traffic persist a new report will be send within \
$reportinterval minutes";
/tool fetch url="$initel$bot/sendMessage\?chat_id=$chat$endtel$messagefinal" keep-result=no;
:log warning "Interface $ifalias surpassed $limittraffic Mbps by $limittime seconds \
-- Actual traffic is em $($recbits / 1000000)Mbps";
:delay ((($reportinterval * 60) - $limittime) . s);
}; # <--- End of checking counter
}; # <--- End of first while condition
# ENABLING TRIGGER AGAIN
/tool traffic-monitor set [find name="$triggers"] disabled=no;
#-----------------------------------------------------------------------
# T H E E N D
#-----------------------------------------------------------------------
Reports will reach you telegram account (defined in chat ID) like this: