DLPX-98742 connstat-stats.sh: preserve connstat timestamps in InfluxDB

[dbshah12]

Background

connstat -T u emits a = <unix_seconds> line before each sample interval. The awk pipeline in connstat-stats.sh used this only as a flush trigger and silently discarded the timestamp value. Since both connstat samples (10 s apart) arrive at Telegraf simultaneously after connstat exits, Telegraf assigned its current ingestion time to every row — causing pairs of tcp_stats data points to land in InfluxDB only ~5 ms apart instead of 10 s apart.

Additionally, sleep 5 between outer loop iterations created an alternating 5 s / 10 s gap pattern even after timestamps were fixed: connstat outputs sample 1 at T=0 and sample 2 at T=10, then sleep 5 meant the next sample 1 arrived at T=15 — giving 10 s within a run but only 5 s between runs.

Problem

Per-second throughput rate calculations (Δbytes / Δseconds) were meaningless: a ~5 ms gap between samples produced wildly inflated apparent rates (e.g. 12 GB/s computed where actual throughput was ~30 MB/s). Root cause confirmed live on a 2026.5.0.0 engine: both sample batches arrive at Telegraf within 5 ms of each other (1788158588814 ms vs 1788158588819 ms), regardless of the 10 s connstat interval.

Solution

• telegraf/connstat-stats.sh: Track the Unix timestamp from each = <ts> separator line in batch_ts; append it as a trailing CSV column on every output row. The sub(/^=[[:space:]]*/, "", ts) strip is needed because the field separator is , so $2 is empty for these lines.
• telegraf/telegraf.base: Add "ts" to csv_column_names/csv_column_types; set csv_timestamp_column = "ts" and csv_timestamp_format = "unix" so Telegraf uses the connstat-provided timestamp rather than ingestion time.
• sleep 5 → sleep 10: Aligns the inter-run gap with the intra-run connstat interval, giving a constant 10 s cadence. connstat -c 2 -i 10 outputs sample 1 at T=0 and sample 2 at T=10, then sleep 10 places the next sample 1 at T=20 — all gaps are 10 s.

Test plan

Deployed to dhruv5.dlpxdc.co (2026.5.0.0 engine) and queried InfluxDB after 15 minutes of collection.

Gap distribution across all series (last 15 min):

Gap	Occurrences	Notes
10s	155	Expected — correct interval
11s	7	Unix-second rounding (connstat timestamps are integers; 10.x rounds to 11)
20s / 30s	4	Connection idle for 1–2 cycles, then reappeared
81s	1	SSH connection dropped and reconnected

155 / 167 gaps (93%) are exactly 10 s. No 5 s gaps anywhere. The alternating 5 s / 10 s pattern is completely gone.

Sample data for raddr=10.43.50.230, service=dlpx-sp over 6 minutes:

08:40:39Z  234,101,356 bytes
08:40:49Z  234,110,072  (+10s)
08:40:59Z  234,118,788  (+10s)
08:41:09Z  234,127,504  (+10s)
08:41:19Z  234,136,220  (+10s)
08:41:29Z  234,144,936  (+10s)
08:41:39Z  234,153,652  (+10s)
08:41:49Z  234,165,874  (+10s)
08:41:59Z  234,174,590  (+10s)
08:42:09Z  234,183,306  (+10s)

Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes timestamp handling for tcp_stats collected via connstat so InfluxDB points reflect the actual connstat sample times (10s apart) rather than Telegraf ingestion time, and it removes an unintended 5s/10s alternating cadence between runs.

Changes:

• Emit the connstat-provided Unix timestamp (= <unix_seconds>) as a trailing ts column on every CSV row produced by connstat-stats.sh.
• Configure Telegraf’s CSV parser to use ts as the measurement timestamp (csv_timestamp_column = "ts", csv_timestamp_format = "unix").
• Change the outer loop delay from sleep 5 to sleep 10 to maintain a consistent 10-second cadence across sample boundaries.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
telegraf/telegraf.base	Adds ts CSV column and instructs Telegraf to use it as the event timestamp (unix seconds).
telegraf/connstat-stats.sh	Tracks connstat batch timestamps and appends them per row; updates loop sleep to keep a steady 10s cadence.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.