Skip to content

Add metrics support#113

Merged
hslatman merged 13 commits intomainfrom
metrics
Apr 13, 2026
Merged

Add metrics support#113
hslatman merged 13 commits intomainfrom
metrics

Conversation

@hslatman
Copy link
Copy Markdown
Owner

@hslatman hslatman commented Apr 4, 2026

This PR adds support for sending metrics to the CrowdSec LAPI, and integrates with Caddy's metrics.

Example configuration, enabling pushing metrics to the LAPI every 15 minutes (minimum recommended by CrowdSec), and adding CrowdSec module metrics to the Caddy metrics served on the /metrics endpoint.

	crowdsec {
        ...
		metrics_interval 15m
		enable_caddy_metrics
        ...
	}

After enabling the metrics, adding two decisions manually, and hitting from those IPs, the reported values should look like this:

Bouncer Metrics (TestBouncer) since 2026-04-13 10:10:19 +0000 UTC:
╭────────────────────────────┬──────────────────┬─────────┬───────────╮
│ Origin                     │ active_decisions │ dropped │ processed │
│                            │        IPs       │ request │  request  │
├────────────────────────────┼──────────────────┼─────────┼───────────┤
│ CAPI (community blocklist) │            2.08k │       - │         - │
│ appsec                     │                0 │       - │         - │
│ console                    │                0 │       - │         - │
│ crowdsec (security engine) │                0 │       - │         - │
│ cscli (manual decisions)   │                2 │       6 │         - │
│ cscli-import               │                0 │       - │         - │
│ remediation_sync           │                0 │       - │         - │
├────────────────────────────┼──────────────────┼─────────┼───────────┤
│                      Total │            2.08k │       6 │        45 │
╰────────────────────────────┴──────────────────┴─────────┴───────────╯

And part of the /metrics endpoint:

$ curl http://127.0.0.1:2019/metrics | grep -i crowdsec_

# HELP crowdsec_appsec_lapi_requests_total The total number of calls to the CrowdSec LAPI AppSec component
# TYPE crowdsec_appsec_lapi_requests_total counter
crowdsec_appsec_lapi_requests_total 24
# HELP crowdsec_bouncer_lapi_requests_total The total number of calls to CrowdSec LAPI
# TYPE crowdsec_bouncer_lapi_requests_total counter
crowdsec_bouncer_lapi_requests_total{mode="stream"} 71
# HELP crowdsec_decisions_active The current number of active decisions
# TYPE crowdsec_decisions_active gauge
crowdsec_decisions_active{ip_type="ipv4",origin="CAPI"} 1947
crowdsec_decisions_active{ip_type="ipv4",origin="appsec"} 0
crowdsec_decisions_active{ip_type="ipv4",origin="console"} 0
crowdsec_decisions_active{ip_type="ipv4",origin="crowdsec"} 0
crowdsec_decisions_active{ip_type="ipv4",origin="cscli"} 0
crowdsec_decisions_active{ip_type="ipv4",origin="cscli-import"} 0
crowdsec_decisions_active{ip_type="ipv4",origin="remediation_sync"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="CAPI"} 129
crowdsec_decisions_active{ip_type="ipv6",origin="appsec"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="console"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="crowdsec"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="cscli"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="cscli-import"} 0
crowdsec_decisions_active{ip_type="ipv6",origin="remediation_sync"} 0
# HELP crowdsec_requests_blocked The total number of requests blocked
# TYPE crowdsec_requests_blocked counter
crowdsec_requests_blocked{ip_type="ipv6",origin="cscli",remediation="ban",server="layer4-[::1]:4444"} 4
crowdsec_requests_blocked{ip_type="ipv6",origin="cscli",remediation="ban",server="srv3"} 2
# HELP crowdsec_requests_processed The total number of requests handled
# TYPE crowdsec_requests_processed counter
crowdsec_requests_processed{ip_type="ipv6",server="layer4-[::1]:4444"} 5
crowdsec_requests_processed{ip_type="ipv6",server="srv2"} 14
crowdsec_requests_processed{ip_type="ipv6",server="srv3"} 26
# HELP crowdsec_requests_processed_per_module The total number of requests handled per module
# TYPE crowdsec_requests_processed_per_module counter
crowdsec_requests_processed_per_module{ip_type="ipv6",module="appsec",server="srv3"} 24
crowdsec_requests_processed_per_module{ip_type="ipv6",module="http",server="srv2"} 14
crowdsec_requests_processed_per_module{ip_type="ipv6",module="http",server="srv3"} 26
crowdsec_requests_processed_per_module{ip_type="ipv6",module="layer4",server="layer4-[::1]:4444"} 5

geneccx and others added 5 commits April 4, 2026 18:01
If the streaming bouncer is not used, it will never get initialized. This ends up causing the metrics provider to use an APIClient with the wrong values configured. Use the liveBouncer's APIClient instead, as it's guaranteed to be initialized.
The metrics provider in the CrowdSec package wasn't flexible enough
to accomplish what's needed to make the metrics work, so the metrics
provider is now provided in this repo instead of being imported.
@hslatman hslatman force-pushed the metrics branch 6 times, most recently from 4d2abd2 to 1e9fde1 Compare April 8, 2026 12:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants