Traffic and Attack Metrics of the NGINX Node¶
The NGINX Node's core filtering counters report processed traffic, detected attacks, blocked requests, and detection health. This page describes the metrics you are most likely to monitor.
The traffic and attack counters are reported both as an aggregate across all applications (no label) and per Wallarm application via the app_id label. For example, wallarm_requests is the total, while wallarm_requests{app_id="23"} is the count for application 23. The value app_id="-1" denotes traffic not assigned to any application.
The exact list of metrics may vary depending on the NGINX Node version. Changes are reflected in the NGINX Node changelog.
Limitations¶
Traffic and attack metrics are not yet available for Sidecar.
Metrics endpoint¶
Starting from NGINX Node 7.1.0, the traffic and attack metrics are returned on the following aggregated endpoint by default:
The same counters are also available via the wallarm_status endpoint of the Statistics service.
To change the port, see Configuring the ports.
Traffic metrics¶
wallarm_requests¶
The number of requests processed by the node.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_streams¶
The number of processed gRPC/WebSocket streams.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_messages¶
The number of processed gRPC/WebSocket messages.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_abnormal¶
The number of abnormal requests — requests the node could not process normally.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_bytes_in¶
The total number of bytes received by listening servers from clients (incoming traffic). Collected regardless of the filtration mode.
Type: Gauge
Labels: None
Unit: Bytes
Example:
wallarm_bytes_out¶
The total number of bytes sent from listening servers to clients (outgoing traffic). Collected regardless of the filtration mode.
Type: Gauge
Labels: None
Unit: Bytes
Example:
Attacks and blocking metrics¶
wallarm_attacks¶
The number of recorded attacks.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_blocked¶
The number of blocked requests, including those originating from denylisted IPs.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_blocked_by_acl¶
The number of requests blocked due to denylisted request sources.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_blocked_by_antibot¶
The number of requests blocked by the API Abuse Prevention module.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_bytes_blocked_in, wallarm_bytes_blocked_out¶
The total number of bytes received in blocked requests and sent in blocked responses.
Type: Counter
Labels: None
Unit: Bytes
Example:
wallarm_bytes_blocked_by_acl_in, wallarm_bytes_blocked_by_acl_out¶
The total number of bytes received and sent in ACL-blocked requests and responses.
Type: Counter
Labels: None
Unit: Bytes
Example:
Metrics on detection resources and health¶
wallarm_db_id¶
The ID of the currently loaded proton.db (attack detection rules) file.
Type: Gauge
Labels: None
Unit: ID
Example:
wallarm_lom_id¶
The ID of the currently loaded LOM file.
Type: Gauge
Labels: None
Unit: ID
Example:
wallarm_custom_ruleset_id¶
The ID of the currently loaded custom ruleset file.
Type: Gauge
Labels: None
Unit: ID
Example:
wallarm_db_apply_time, wallarm_lom_apply_time, wallarm_custom_ruleset_apply_time¶
The Unix timestamps when the proton.db, LOM, and custom ruleset files were last applied.
Type: Gauge
Labels: None
Unit: Unix timestamp (seconds)
Example:
wallarm_db_apply_time 1784907369
wallarm_lom_apply_time 1784907370
wallarm_custom_ruleset_apply_time 1784907370
wallarm_proton_instances_total, wallarm_proton_instances_success, wallarm_proton_instances_fallback, wallarm_proton_instances_failed¶
The number of libproton instances — in total and by status: successfully loaded, running in fallback, or failed.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_proton_instances_total 4
wallarm_proton_instances_success 4
wallarm_proton_instances_fallback 0
wallarm_proton_instances_failed 0
wallarm_proton_errors¶
The number of non-memory-related libproton faults.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_time_detect¶
Time spent on attack detection.
Type: Gauge
Labels: app_id
Unit: Seconds
Example:
wallarm_config_revision¶
The revision number of the applied node configuration.
Type: Gauge
Labels: None
Unit: Revision number
Example:
wallarm_startid¶
A unique identifier generated each time the node starts.
Type: Gauge
Labels: None
Unit: ID
Example:
Error and fault metrics¶
wallarm_tnt_errors¶
The number of wstore (Postanalytics) write errors.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_api_errors¶
The number of API write errors.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_requests_lost¶
The number of requests lost before analysis.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_overlimits_time¶
The number of requests that exceeded the processing time limit.
Type: Gauge
Labels: app_id
Unit: Count
Example:
wallarm_segfaults¶
The number of segmentation faults.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_memfaults¶
The number of events where the virtual memory limit was reached.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_softmemfaults¶
The number of events where the per-request memory limit was reached.
Type: Gauge
Labels: None
Unit: Count
Example:
wallarm_stalled_workers¶
The number of workers stalled in libproton.
Type: Gauge
Labels: None
Unit: Count
Example: