sneak
ed6ba53747
check / check (push) Successful in 4m27s
`smallwebwaf servewaf` runs today's checks on the visitor's request a question carries and answers allow, deny or close, instead of passing it to an app. rproxy's report then counts the bytes toward the byte limits and adds the request to the client's history. SPEC.md gives the exact question, answer and report, which rproxy follows. `smallwebwaf` with no command is unchanged. Judgement call: a third disposition, close, since closing the question's connection would read as servewaf down and let the request through. Judgement call: allow can answer a new request id, since a visitor behind a trusted proxy can choose its own. Model: opus-5-5
87 lines
3.2 KiB
Markdown
87 lines
3.2 KiB
Markdown
# The metrics
|
|
|
|
What `GET /_smallwebwaf/metrics` answers with. "Metrics endpoint" in
|
|
[`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps the `instance`
|
|
label as `exported_instance` unless the scrape sets `honor_labels: true`.
|
|
|
|
`smallwebwaf servewaf` counts a denied request at its decision. It counts an
|
|
allowed request when its report comes, with the status, bytes and times the
|
|
report gives. A report itself is not counted, and neither is a request whose
|
|
report never comes.
|
|
|
|
## Traffic
|
|
|
|
- `smallwebwaf_requests_total`, `smallwebwaf_request_bytes_total` and
|
|
`smallwebwaf_response_bytes_total`, by `status_class` such as `2xx` and by
|
|
`action`;
|
|
- `smallwebwaf_request_duration_seconds` and
|
|
`smallwebwaf_upstream_duration_seconds`, as histograms;
|
|
- `smallwebwaf_requests_in_flight`.
|
|
|
|
## Limits and bans
|
|
|
|
- `smallwebwaf_rate_limit_hits_total`, by `window` and by `kind` (`requests`,
|
|
`bytes` or `refusals`);
|
|
- `smallwebwaf_size_and_time_limit_hits_total`, by `limit`, the setting passed;
|
|
- `smallwebwaf_offences_total`, by `kind`;
|
|
- `smallwebwaf_bans_made_total`, by `cause`;
|
|
- `smallwebwaf_active_bans` and `smallwebwaf_permanent_bans`.
|
|
|
|
## Attack detection
|
|
|
|
- `smallwebwaf_rule_matches_total`, by `rule_id` and `action`, and
|
|
`smallwebwaf_rules_loaded`;
|
|
- `smallwebwaf_waf_matches_total`, by `mode` and `rule_id`, for the rules that
|
|
fired.
|
|
|
|
## Countries and AS numbers
|
|
|
|
For the `SWWAF_METRICS_TOP_N` busiest of each, the rest as `other`:
|
|
|
|
- `smallwebwaf_country_requests_total`,
|
|
`smallwebwaf_country_request_bytes_total`,
|
|
`smallwebwaf_country_response_bytes_total` and
|
|
`smallwebwaf_country_list_refusals_total`, by `country`;
|
|
- `smallwebwaf_asn_requests_total`, `smallwebwaf_asn_request_bytes_total` and
|
|
`smallwebwaf_asn_response_bytes_total`, by `asn`.
|
|
|
|
## Lookups
|
|
|
|
- `smallwebwaf_geojs_requests_total` and `smallwebwaf_geojs_failures_total`;
|
|
- `smallwebwaf_geojs_unanswered_total`: the requests that needed an answer and
|
|
went on without it;
|
|
- with the file source,
|
|
`smallwebwaf_lookup_database_last_read_timestamp_seconds` and
|
|
`smallwebwaf_lookup_database_read_failures_total`.
|
|
|
|
## Reputation sources
|
|
|
|
By `source`: each list's URL, each zone, and `abuseipdb`:
|
|
|
|
- `smallwebwaf_reputation_hits_total`, `smallwebwaf_reputation_queries_total`
|
|
and `smallwebwaf_reputation_failures_total`;
|
|
- `smallwebwaf_reputation_last_fetch_timestamp_seconds`, for a list;
|
|
- `smallwebwaf_reputation_daily_budget_remaining`, for AbuseIPDB.
|
|
|
|
## State files
|
|
|
|
By `file`:
|
|
|
|
- `smallwebwaf_state_file_writes_total`,
|
|
`smallwebwaf_state_file_write_failures_total`,
|
|
`smallwebwaf_state_file_last_write_timestamp_seconds` and
|
|
`smallwebwaf_state_file_size_bytes`;
|
|
- `smallwebwaf_state_file_edits_taken_in_total` and
|
|
`smallwebwaf_state_file_edits_set_aside_total`;
|
|
- `smallwebwaf_tracked_clients`: the clients in the table.
|
|
|
|
## Remote log, alerts and the process
|
|
|
|
- while a syslog server is set, `smallwebwaf_remote_log_lines_sent_total`,
|
|
`smallwebwaf_remote_log_lines_dropped_total` and
|
|
`smallwebwaf_remote_log_buffer_depth`;
|
|
- by `destination`, `smallwebwaf_alerts_sent_total`,
|
|
`smallwebwaf_alerts_failed_total`, `smallwebwaf_alerts_suppressed_total` and
|
|
`smallwebwaf_alerts_dropped_total`;
|
|
- Go's own `go_` metrics and the process's `process_` metrics.
|