Files

T

check / check (push) Successful in 8m31s

Details

servewaf always answers rproxy well within its time limit (closes #182 )

A question waits on GeoJS at most 800ms, the new default of
SWWAF_LOOKUP_TIMEOUT. In enforce mode it does not wait at all when it is
over the header limits, on a fetched blocklist with deny, on the CrowdSec
decision list, or over a whole rate limit. Not waiting never lowers a
client's limit. Just before the Core Rule Set, servewaf refuses more than
50 cookies or 100 header fields with 431.

Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf
with no command.
Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits
on the DNS blocklists or AbuseIPDB.

Model: opus-5-5

2026-11-05 05:48:50 +01:00

3.4 KiB

Raw Blame History

The metrics

What GET /_smallwebwaf/metrics answers with. "Metrics endpoint" in SPEC.md describes the endpoint. Prometheus keeps the instance label as exported_instance unless the scrape sets honor_labels: true.

Traffic

smallwebwaf_requests_total, smallwebwaf_request_bytes_total and smallwebwaf_response_bytes_total, by status_class such as 2xx and by action;
smallwebwaf_request_duration_seconds and smallwebwaf_upstream_duration_seconds, as histograms;
smallwebwaf_requests_in_flight.

Limits and bans

smallwebwaf_rate_limit_hits_total, by window and by kind (requests, bytes or refusals);
smallwebwaf_size_and_time_limit_hits_total, by limit, the setting passed. servewaf's header limits have no setting, so it leaves them out;
smallwebwaf_offences_total, by kind;
smallwebwaf_bans_made_total, by cause;
smallwebwaf_active_bans and smallwebwaf_permanent_bans.

Attack detection

smallwebwaf_rule_matches_total, by rule_id and action, and smallwebwaf_rules_loaded;
smallwebwaf_waf_matches_total, by mode and rule_id, for the rules that fired.

Countries and AS numbers

For the SWWAF_METRICS_TOP_N busiest of each, the rest as other:

smallwebwaf_country_requests_total, smallwebwaf_country_request_bytes_total, smallwebwaf_country_response_bytes_total and smallwebwaf_country_list_refusals_total, by country;
smallwebwaf_asn_requests_total, smallwebwaf_asn_request_bytes_total and smallwebwaf_asn_response_bytes_total, by asn.

Lookups

smallwebwaf_geojs_requests_total and smallwebwaf_geojs_failures_total;
smallwebwaf_geojs_unanswered_total: the requests that needed an answer and went on without it;
with the file source, smallwebwaf_lookup_database_last_read_timestamp_seconds and smallwebwaf_lookup_database_read_failures_total.

Reputation sources

By source: each list's URL, each zone, and abuseipdb:

smallwebwaf_reputation_hits_total, smallwebwaf_reputation_queries_total and smallwebwaf_reputation_failures_total;
smallwebwaf_reputation_last_fetch_timestamp_seconds, for a list;
smallwebwaf_reputation_daily_budget_remaining, for AbuseIPDB.

State files

By file:

smallwebwaf_state_file_writes_total, smallwebwaf_state_file_write_failures_total, smallwebwaf_state_file_last_write_timestamp_seconds and smallwebwaf_state_file_size_bytes;
smallwebwaf_state_file_edits_taken_in_total and smallwebwaf_state_file_edits_set_aside_total;
smallwebwaf_tracked_clients: the clients in the table.

Remote log, alerts and the process

while a syslog server is set, smallwebwaf_remote_log_lines_sent_total, smallwebwaf_remote_log_lines_dropped_total and smallwebwaf_remote_log_buffer_depth;
by destination, smallwebwaf_alerts_sent_total, smallwebwaf_alerts_failed_total, smallwebwaf_alerts_suppressed_total and smallwebwaf_alerts_dropped_total;
Go's own go_ metrics and the process's process_ metrics.

`servewaf`

smallwebwaf servewaf counts a denied request at its decision. It counts an allowed request when its report comes, with the status, bytes and times the report gives. These are not counted:

a report itself;
an allowed request whose report never comes;
a question refused with 400;
a question whose body stopped arriving.

3.4 KiB Raw Blame History