sneak
5a278949d7
check / check (push) Failing after 15m18s
A question waits on GeoJS at most 800ms, the new default of SWWAF_LOOKUP_TIMEOUT. In enforce mode it does not wait at all when it is over the header limits, on a fetched blocklist with deny, on the CrowdSec decision list, or over a whole rate limit. Not waiting never lowers a client's limit. Just before the Core Rule Set, servewaf refuses more than 50 cookies or 100 header fields with 431. Shared default changed: SWWAF_LOOKUP_TIMEOUT also applies to smallwebwaf with no command. Judgement call: SWWAF_REPUTATION_TIMEOUT stays 2s, since no request waits on the DNS blocklists or AbuseIPDB. Model: opus-5-5
94 lines
3.4 KiB
Markdown
94 lines
3.4 KiB
Markdown
# The metrics
|
|
|
|
What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
|
|
[`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
|
|
label as `exported_instance` unless the scrape sets `honor_labels: true`.
|
|
|
|
## Traffic
|
|
|
|
- `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
|
|
`smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
|
|
`action`;
|
|
- `smallwebwaf_request_duration_seconds` and
|
|
`smallwebwaf_upstream_duration_seconds`, as histograms;
|
|
- `smallwebwaf_requests_in_flight`.
|
|
|
|
## Limits and bans
|
|
|
|
- `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
|
|
`bytes` or `refusals`);
|
|
- `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed.
|
|
`servewaf`'s header limits have no setting, so it leaves them out;
|
|
- `smallwebwaf_offences_total`, by `kind`;
|
|
- `smallwebwaf_bans_made_total`, by `cause`;
|
|
- `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
|
|
|
|
## Attack detection
|
|
|
|
- `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
|
|
`smallwebwaf_rules_loaded`;
|
|
- `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
|
|
fired.
|
|
|
|
## Countries and AS numbers
|
|
|
|
For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
|
|
|
|
- `smallwebwaf_country_requests_total`,
|
|
`smallwebwaf_country_request_bytes_total`,
|
|
`smallwebwaf_country_response_bytes_total` and
|
|
`smallwebwaf_country_list_refusals_total`, by `country`;
|
|
- `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
|
|
`smallwebwaf_asn_response_bytes_total`, by `asn`.
|
|
|
|
## Lookups
|
|
|
|
- `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
|
|
- `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
|
|
went on without it;
|
|
- with the file source,
|
|
`smallwebwaf_lookup_database_last_read_timestamp_seconds` and
|
|
`smallwebwaf_lookup_database_read_failures_total`.
|
|
|
|
## Reputation sources
|
|
|
|
By `source`: each list's URL, each zone, and `abuseipdb`:
|
|
|
|
- `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
|
|
and `smallwebwaf_reputation_failures_total`;
|
|
- `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
|
|
- `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
|
|
|
|
## State files
|
|
|
|
By `file`:
|
|
|
|
- `smallwebwaf_state_file_writes_total`,
|
|
`smallwebwaf_state_file_write_failures_total`,
|
|
`smallwebwaf_state_file_last_write_timestamp_seconds` and
|
|
`smallwebwaf_state_file_size_bytes`;
|
|
- `smallwebwaf_state_file_edits_taken_in_total` and
|
|
`smallwebwaf_state_file_edits_set_aside_total`;
|
|
- `smallwebwaf_tracked_clients`: the clients in the table.
|
|
|
|
## Remote log, alerts and the process
|
|
|
|
- while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
|
|
`smallwebwaf_remote_log_lines_dropped_total` and
|
|
`smallwebwaf_remote_log_buffer_depth`;
|
|
- by `destination`, `smallwebwaf_alerts_sent_total`,
|
|
`smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
|
|
`smallwebwaf_alerts_dropped_total`;
|
|
- Go's own `go_` metrics and the process's `process_` metrics.
|
|
|
|
## `servewaf`
|
|
|
|
`smallwebwaf servewaf` counts a denied request at its decision. It counts an
|
|
allowed request when its report comes, with the status, bytes and times the
|
|
report gives. These are not counted:
|
|
|
|
- a report itself;
|
|
- an allowed request whose report never comes;
|
|
- a question refused with `400`;
|
|
- a question whose body stopped arriving.
|