smallwebwaf/docs/metrics.md

The metrics

What GET /_smallwebwaf/metrics answers with. "Metrics endpoint" in SPEC.md describes the endpoint. Prometheus keeps the instance label as exported_instance unless the scrape sets honor_labels: true.

Traffic

• smallwebwaf_requests_total, smallwebwaf_request_bytes_total and smallwebwaf_response_bytes_total, by status_class such as 2xx and by action;
• smallwebwaf_request_duration_seconds and smallwebwaf_upstream_duration_seconds, as histograms;
• smallwebwaf_requests_in_flight.

Limits and bans

• smallwebwaf_rate_limit_hits_total, by window and by kind (requests, bytes or refusals);
• smallwebwaf_size_and_time_limit_hits_total, by limit, the setting passed;
• smallwebwaf_offences_total, by kind;
• smallwebwaf_bans_made_total, by cause;
• smallwebwaf_active_bans and smallwebwaf_permanent_bans.

Attack detection

• smallwebwaf_rule_matches_total, by rule_id and action, and smallwebwaf_rules_loaded;
• smallwebwaf_waf_matches_total, by mode and rule_id, for the rules that fired.

Countries and AS numbers

For the SWWAF_METRICS_TOP_N busiest of each, the rest as other:

• smallwebwaf_country_requests_total, smallwebwaf_country_request_bytes_total, smallwebwaf_country_response_bytes_total and smallwebwaf_country_list_refusals_total, by country;
• smallwebwaf_asn_requests_total, smallwebwaf_asn_request_bytes_total and smallwebwaf_asn_response_bytes_total, by asn.

Lookups

• smallwebwaf_geojs_requests_total and smallwebwaf_geojs_failures_total;
• smallwebwaf_geojs_unanswered_total: the requests that needed an answer and went on without it;
• with the file source, smallwebwaf_lookup_database_last_read_timestamp_seconds and smallwebwaf_lookup_database_read_failures_total.

Reputation sources

By source: each list's URL, each zone, and abuseipdb:

• smallwebwaf_reputation_hits_total, smallwebwaf_reputation_queries_total and smallwebwaf_reputation_failures_total;
• smallwebwaf_reputation_last_fetch_timestamp_seconds, for a list;
• smallwebwaf_reputation_daily_budget_remaining, for AbuseIPDB.

State files

By file:

• smallwebwaf_state_file_writes_total, smallwebwaf_state_file_write_failures_total, smallwebwaf_state_file_last_write_timestamp_seconds and smallwebwaf_state_file_size_bytes;
• smallwebwaf_state_file_edits_taken_in_total and smallwebwaf_state_file_edits_set_aside_total;
• smallwebwaf_tracked_clients: the clients in the table.

Remote log, alerts and the process

• while a syslog server is set, smallwebwaf_remote_log_lines_sent_total, smallwebwaf_remote_log_lines_dropped_total and smallwebwaf_remote_log_buffer_depth;
• by destination, smallwebwaf_alerts_sent_total, smallwebwaf_alerts_failed_total, smallwebwaf_alerts_suppressed_total and smallwebwaf_alerts_dropped_total;
• Go's own go_ metrics and the process's process_ metrics.