I have a need to monitor my file servers so that if I see a single client with more than X connections, I get an alert.
The use case is some issues we've seen, whereby a single client that exhibits the application error, open thousands of simultaneous SMB connections to the file sever. After a while, this will cause the file server to hang and all shares go offline.
Ideally I would like a monitor that would say:- 'If there are more than 50 SMB connections from a single client source IP, then trigger an email'
Any help great appreciated,