@ibbetsion said in Telegraf's built-in ping plugin showing higher latency since v2.5:

Since upgrading to 2.5, the built-in Telegraf ping plugin is reporting results with a higher latency then what I get if I were to ping the same system from the pfsense CLI. And the diff is 2x, sometimes more. This wasn't an issue in 2.4.5x. Is this a known issue?

For more clarity, I'm pinging a system on LAN, so am expecting <0.3ms response time. Telegraf shows >0.8ms, sometimes even >2ms.

The next update to the Suricata 5.x package on pfSense will contain a new option for configuring Suricata to export performance stats over a Unix socket to Telegraf. It will support the input.suricata plugin.

Suricata can produce EVE JSON logs, and that data can be either written to a conventional text file or it can be made available to a Unix socket. So if someone produces a log data parser for EVE JSON, then Suricata can easily be adapted to feed data over the Unix socket. I am not familiar with Telegraf since I've never used it. So I don't know what it is capable of in terms of digesting Suricata's EVE JSON logs. The new feature I mentioned came from a Redmine Feature Request submitted a while back. And that request was specifically for Suricata performance stats (things like packets processed, packets dropped due to load, etc.).