Monitoring the NGINX Node Metrics and Health¶

The NGINX Node exposes metrics in the Prometheus format, which you can use to monitor its performance, traffic, and detected attacks, along with health endpoints for orchestration. This page gives an overview of the available metrics and health endpoints.

Metric groups¶

The recommended way to read most Node metrics is the single aggregated endpoint served by the wd (Wallarm Daemon) service at http://127.0.0.1:9445/metrics. It combines the following groups of metrics:

• Traffic and attack metrics — the node's core filtering counters such as wallarm_requests, wallarm_attacks, and wallarm_blocked that report processed traffic, detected attacks, blocked requests, and detection health.

• Postanalytics metrics — Postanalytics module (wstore) metrics covering network activity, request processing, queue states, and storage.

• wcli Controller metrics — data from the service that runs most Wallarm functional components (e.g., brute-force detection or attack export to the Cloud).

• Wallarm Daemon (wd) metrics — the wd service's own wallarm_wd_* metrics describing process supervision and wd scrape/push housekeeping.

These services also still expose their own endpoints, but reading from the aggregated 9445 endpoint is the recommended approach.

The http://127.0.0.1:9445/metrics endpoint also carries the managed services' runtime metrics (go_*, process_*) and the internal scraper's self-metrics (vm_*, scrape_*). To focus on Wallarm data, filter on the wallarm_.* prefix — for example, with a Prometheus metric_relabel_configs rule.

Health endpoints¶

In addition to metrics, readiness and liveness endpoints are exposed at http://127.0.0.1:9446:

• http://127.0.0.1:9446/health — liveness. Returns 200 while the node is running.

• http://127.0.0.1:9446/ready — readiness. Returns 200 only after the node finishes initialization, or while it keeps operating on the last known configuration during a Wallarm Cloud outage. Returns 503 while the node is still starting or is in a degraded or failed state.

Configuring the ports¶

The node uses the following ports to expose its metrics and health endpoints:

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send