CrowdSec Metrics

CrowdSec is instrumented with Prometheus to provide detailed metrics and traceability. cscli metrics lets you view a subset of the metrics exposed by CrowdSec. For production-grade dashboards, use the Grafana integration.

The best way to see available metrics is cscli metrics list:

Type	Title	Description
acquisition	Acquisition Metrics	Measures lines read, parsed, and unparsed per datasource. Zero read lines indicate a misconfigured or inactive datasource. Zero parsed lines mean the parser(s) failed. Non-zero parsed lines are fine as CrowdSec selects relevant lines.
alerts	Local API Alerts	Tracks the total number of past and present alerts for the installed scenarios.
appsec-engine	Appsec Metrics	Measures the number of parsed and blocked requests by the AppSec Component.
appsec-rule	Appsec Rule Metrics	Provides “per AppSec Component” information about the number of matches for loaded AppSec Rules.
decisions	Local API Decisions	Provides information about all currently active decisions. Includes both local (crowdsec) and global decisions (CAPI), and lists subscriptions (lists).
lapi	Local API Metrics	Monitors the requests made to local API routes.
lapi-bouncer	Local API Bouncers Metrics	Tracks total hits to remediation component related API routes.
lapi-decisions	Local API Bouncers Decisions	Tracks the number of empty/non-empty answers from LAPI to bouncers that are working in "live" mode.
lapi-machine	Local API Machines Metrics	Tracks the number of calls to the local API from each registered machine.
parsers	Parser Metrics	Tracks the number of events processed by each parser and indicates success or failure. Zero parsed lines mean the parser(s) failed. Non-zero unparsed lines are fine as CrowdSec selects relevant lines.
scenarios	Scenario Metrics	Measures events in different scenarios. Current count is the number of buckets during metrics collection. Overflows are past event-producing buckets, while Expired are ones that did not receive enough events to overflow.
stash	Parser Stash Metrics	Tracks the status of stashes that might be created by various parsers and scenarios.
whitelists	Whitelist Metrics	Tracks the number of events processed and possibly whitelisted by each parser whitelist.

Metrics sections

You can use aliases to view metrics related to specific areas (cscli metrics show $alias):

engine : Security Engine metrics (acquisition, parsers, scenarios, whitelists)
lapi : Local API metrics (bouncer API calls, local API decisions, machine decisions)
appsec : AppSec metrics (requests processed, rules evaluated and triggered)

You can combine sections listed in cscli metrics list.

Example: Security Engine metrics

cscli metrics show engine displays the metrics sections related to the Security Engine: acquisition, parsers, scenarios, whitelists, and stash.

Command Output
Acquisition Metrics:
╭────────────────────────────────┬────────────┬──────────────┬────────────────┬────────────────────────┬───────────────────╮
│             Source             │ Lines read │ Lines parsed │ Lines unparsed │ Lines poured to bucket │ Lines whitelisted │
├────────────────────────────────┼────────────┼──────────────┼────────────────┼────────────────────────┼───────────────────┤
│ file:/var/log/auth.log         │ 636        │ -            │ 636            │ -                      │ -                 │
│ file:/var/log/nginx/access.log │ 24         │ 24           │ -              │ 1                      │ -                 │
│ file:/var/log/syslog           │ 1.55k      │ -            │ 1.55k          │ -                      │ -                 │
╰────────────────────────────────┴────────────┴──────────────┴────────────────┴────────────────────────┴───────────────────╯

Parser Metrics:
╭─────────────────────────────────┬───────┬────────┬──────────╮
│             Parsers             │ Hits  │ Parsed │ Unparsed │
├─────────────────────────────────┼───────┼────────┼──────────┤
│ child-crowdsecurity/http-logs   │ 72    │ 48     │ 24       │
│ child-crowdsecurity/nginx-logs  │ 24    │ 24     │ -        │
│ child-crowdsecurity/syslog-logs │ 2.18k │ 2.18k  │ -        │
│ crowdsecurity/dateparse-enrich  │ 24    │ 24     │ -        │
│ crowdsecurity/geoip-enrich      │ 24    │ 24     │ -        │
│ crowdsecurity/http-logs         │ 24    │ 24     │ -        │
│ crowdsecurity/nginx-logs        │ 24    │ 24     │ -        │
│ crowdsecurity/non-syslog        │ 24    │ 24     │ -        │
│ crowdsecurity/syslog-logs       │ 2.18k │ 2.18k  │ -        │
╰─────────────────────────────────┴───────┴────────┴──────────╯

Scenario Metrics:
╭──────────────────────────────────────┬───────────────┬───────────┬──────────────┬────────┬─────────╮
│               Scenario               │ Current Count │ Overflows │ Instantiated │ Poured │ Expired │
├──────────────────────────────────────┼───────────────┼───────────┼──────────────┼────────┼─────────┤
│ crowdsecurity/http-crawl-non_statics │ -             │ -         │ 1            │ 1      │ 1       │
╰──────────────────────────────────────┴───────────────┴───────────┴──────────────┴────────┴─────────╯

Parser Stash Metrics:
╭──────┬──────┬───────╮
│ Name │ Type │ Items │
╰──────┴──────┴───────╯

Whitelist Metrics:
╭──────────────────────────┬─────────────────────────────┬──────┬─────────────╮
│        Whitelist         │           Reason            │ Hits │ Whitelisted │
├──────────────────────────┼─────────────────────────────┼──────┼─────────────┤
│ crowdsecurity/whitelists │ private ipv4/ipv6 ip/ranges │ 12   │ 12          │
╰──────────────────────────┴─────────────────────────────┴──────┴─────────────╯

Metrics sections

Example: Security Engine metrics​

Example: Security Engine metrics