Files

T

check / check (push) Waiting to run

Details

servewaf answers rproxy's question about each request and takes its report (closes #170 )

`smallwebwaf servewaf` runs today's checks on the visitor's request each
question carries, answers rproxy, and passes nothing to an app. rproxy reports
every request servewaf answered. A report counts an allowed request's bytes and
writes servewaf's second log line. The table holds a copy of what a report
needs, never the request, so a report cannot reach a request being handled.

Judgement call: a question's body is read before any check; over 64 KiB gets 400.
Judgement call: a report's bytes and durations have ceilings, so they cannot overflow.
Judgement call: a `close` disposition for SWWAF_BAN_RESPONSE=close.

Model: opus-5-5

2026-11-04 22:12:46 +00:00

3.3 KiB

Raw Blame History

The metrics

What GET /_smallwebwaf/metrics answers with. "Metrics endpoint" in SPEC.md describes the endpoint. Prometheus keeps the instance label as exported_instance unless the scrape sets honor_labels: true.

Traffic

smallwebwaf_requests_total, smallwebwaf_request_bytes_total and smallwebwaf_response_bytes_total, by status_class such as 2xx and by action;
smallwebwaf_request_duration_seconds and smallwebwaf_upstream_duration_seconds, as histograms;
smallwebwaf_requests_in_flight.

Limits and bans

smallwebwaf_rate_limit_hits_total, by window and by kind (requests, bytes or refusals);
smallwebwaf_size_and_time_limit_hits_total, by limit, the setting passed;
smallwebwaf_offences_total, by kind;
smallwebwaf_bans_made_total, by cause;
smallwebwaf_active_bans and smallwebwaf_permanent_bans.

Attack detection

smallwebwaf_rule_matches_total, by rule_id and action, and smallwebwaf_rules_loaded;
smallwebwaf_waf_matches_total, by mode and rule_id, for the rules that fired.

Countries and AS numbers

For the SWWAF_METRICS_TOP_N busiest of each, the rest as other:

smallwebwaf_country_requests_total, smallwebwaf_country_request_bytes_total, smallwebwaf_country_response_bytes_total and smallwebwaf_country_list_refusals_total, by country;
smallwebwaf_asn_requests_total, smallwebwaf_asn_request_bytes_total and smallwebwaf_asn_response_bytes_total, by asn.

Lookups

smallwebwaf_geojs_requests_total and smallwebwaf_geojs_failures_total;
smallwebwaf_geojs_unanswered_total: the requests that needed an answer and went on without it;
with the file source, smallwebwaf_lookup_database_last_read_timestamp_seconds and smallwebwaf_lookup_database_read_failures_total.

Reputation sources

By source: each list's URL, each zone, and abuseipdb:

smallwebwaf_reputation_hits_total, smallwebwaf_reputation_queries_total and smallwebwaf_reputation_failures_total;
smallwebwaf_reputation_last_fetch_timestamp_seconds, for a list;
smallwebwaf_reputation_daily_budget_remaining, for AbuseIPDB.

State files

By file:

smallwebwaf_state_file_writes_total, smallwebwaf_state_file_write_failures_total, smallwebwaf_state_file_last_write_timestamp_seconds and smallwebwaf_state_file_size_bytes;
smallwebwaf_state_file_edits_taken_in_total and smallwebwaf_state_file_edits_set_aside_total;
smallwebwaf_tracked_clients: the clients in the table.

Remote log, alerts and the process

while a syslog server is set, smallwebwaf_remote_log_lines_sent_total, smallwebwaf_remote_log_lines_dropped_total and smallwebwaf_remote_log_buffer_depth;
by destination, smallwebwaf_alerts_sent_total, smallwebwaf_alerts_failed_total, smallwebwaf_alerts_suppressed_total and smallwebwaf_alerts_dropped_total;
Go's own go_ metrics and the process's process_ metrics.

`servewaf`

smallwebwaf servewaf counts a denied request at its decision. It counts an allowed request when its report comes, with the status, bytes and times the report gives. These are not counted:

a report itself;
an allowed request whose report never comes;
a question refused with 400;
a question whose body stopped arriving.

3.3 KiB Raw Blame History