Skip to main content
Version: v1.6.0

Monitoring

The prometheus instrumentation exposes metrics about acquisition and data sources. Those can as well be view via cscli metrics :

INFO[19-08-2021 06:33:31 PM] Acquisition Metrics:                         
+-----------------------------------------------+------------+--------------+----------------+------------------------+
| SOURCE | LINES READ | LINES PARSED | LINES UNPARSED | LINES POURED TO BUCKET |
+-----------------------------------------------+------------+--------------+----------------+------------------------+
| file:/var/log/auth.log | 1231 | 580 | 651 | 896 |
| file:/var/log/kern.log | 6035 | - | 6035 | - |
| file:/var/log/messages | 6035 | - | 6035 | - |
| file:/var/log/nginx/error.log | 5 | - | 5 | - |
| file:/var/log/nginx/xxxxx.ro-http.access.log | 10 | 5 | 5 | 11 |
| file:/var/log/nginx/xxxxx.ro-https.access.log | 29 | 29 | - | 30 |
| file:/var/log/syslog | 6062 | - | 6062 | - |
+-----------------------------------------------+------------+--------------+----------------+------------------------+

The columns are :

NameExplanation
SOURCEDatasource in the format medium://details. (ie. file:///path/to/log)
LINES READNumber of lines read from the given source since agent startup
LINES PARSEDNumber of lines successfully parsed by every parser the line was submitted to
LINES UNPARSEDNumber of lines unsuccessfully parsed by at least one parser the line was submitted to
LINES POURED TO BUCKETHow many individual events were poured to bucket from this source. One line can be submitted to more than one scenario, and thus can be higher than LINES READ or LINES PARSED
CrowdSec ConsoleCrowdSec Console