{"id":13561689,"url":"https://github.com/sergeymakinen/ipsec_exporter","last_synced_at":"2025-04-03T17:31:24.057Z","repository":{"id":46048465,"uuid":"394416858","full_name":"sergeymakinen/ipsec_exporter","owner":"sergeymakinen","description":"Export strongswan/libreswan IPsec stats to Prometheus","archived":true,"fork":false,"pushed_at":"2023-06-17T22:17:50.000Z","size":180,"stargazers_count":21,"open_issues_count":8,"forks_count":16,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-02T04:37:07.173Z","etag":null,"topics":["go","golang","ipsec","libreswan","prometheus","prometheus-exporter","strongswan"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sergeymakinen.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2021-08-09T19:37:20.000Z","updated_at":"2024-12-02T06:08:38.000Z","dependencies_parsed_at":"2024-01-16T18:59:20.856Z","dependency_job_id":"f3e901c7-f57a-4bc2-8c96-1a50d777cf6f","html_url":"https://github.com/sergeymakinen/ipsec_exporter","commit_stats":null,"previous_names":[],"tags_count":11,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergeymakinen%2Fipsec_exporter","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergeymakinen%2Fipsec_exporter/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergeymakinen%2Fipsec_exporter/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sergeymakinen%2Fipsec_exporter/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sergeymakinen","download_url":"https://codeload.github.com/sergeymakinen/ipsec_exporter/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247046921,"owners_count":20874740,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["go","golang","ipsec","libreswan","prometheus","prometheus-exporter","strongswan"],"created_at":"2024-08-01T13:00:59.984Z","updated_at":"2025-04-03T17:31:20.338Z","avatar_url":"https://github.com/sergeymakinen.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"\u003e **Note**\n\u003e \n\u003e This repository is no longer supported or updated. If you wish to continue to develop this code yourself, consider forking it.\n\n# IPsec Exporter\n\n[![tests](https://github.com/sergeymakinen/ipsec_exporter/workflows/tests/badge.svg)](https://github.com/sergeymakinen/ipsec_exporter/actions?query=workflow%3Atests)\n[![Go Reference](https://pkg.go.dev/badge/github.com/sergeymakinen/ipsec_exporter.svg)](https://pkg.go.dev/github.com/sergeymakinen/ipsec_exporter)\n[![Go Report Card](https://goreportcard.com/badge/github.com/sergeymakinen/ipsec_exporter)](https://goreportcard.com/report/github.com/sergeymakinen/ipsec_exporter)\n[![codecov](https://codecov.io/gh/sergeymakinen/ipsec_exporter/branch/main/graph/badge.svg)](https://codecov.io/gh/sergeymakinen/ipsec_exporter)\n\nExport strongswan/libreswan IPsec stats to Prometheus.\n\nTo run it:\n\n```bash\nmake\n./ipsec_exporter [flags]\n```\n\n## Exported metrics\n\n### Exported for both strongswan/libreswan\n\n| Metric | Meaning | Labels\n| --- | --- | ---\n| ipsec_up | Was the last scrape successful. |\n| ipsec_ike_sas | Number of currently registered IKE SAs. |\n| ipsec_half_open_ike_sas | Number of IKE SAs in half-open state. |\n| ipsec_ike_sa_state | IKE SA state. | name, uid, version, local_host, local_id, remote_host, remote_id, remote_identity, vips\n| ipsec_child_sa_state | Child SA state. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n| ipsec_child_sa_bytes_in | Number of input bytes processed. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n| ipsec_child_sa_bytes_out | Number of output bytes processed. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n\n### Additionally exported for strongswan-only\n\n| Metric | Meaning | Labels\n| --- | --- | ---\n| ipsec_uptime_seconds | Number of seconds since the daemon started. |\n| ipsec_workers_total | Number of worker threads. |\n| ipsec_idle_workers | Number of idle worker threads. |\n| ipsec_active_workers | Number of threads processing jobs. |\n| ipsec_queues | Number of queued jobs. | priority\n| ipsec_pool_ips_total | Number of addresses in the pool. | name, address\n| ipsec_online_pool_ips | Number of leases online. | name, address\n| ipsec_offline_pool_ips | Number of leases offline. | name, address\n| ipsec_ike_sa_established_seconds | Number of seconds since the IKE SA has been established. | name, uid, version, local_host, local_id, remote_host, remote_id, remote_identity, vips\n| ipsec_child_sa_packets_in | Number of input packets processed. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n| ipsec_child_sa_packets_out | Number of output packets processed. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n| ipsec_child_sa_installed_seconds | Number of seconds since the child SA has been installed. | ike_sa_name, ike_sa_uid, ike_sa_version, ike_sa_local_host, ike_sa_local_id, ike_sa_remote_host, ike_sa_remote_id, ike_sa_remote_identity, ike_sa_vips, name, uid, reqid, mode, protocol, local_ts, remote_ts\n\n### strongswan state mapping\n\n#### IKE SA\n\n| Name | State value\n| --- | ---\n| CREATED | 0\n| CONNECTING | 1\n| ESTABLISHED | 2\n| PASSIVE | 3\n| REKEYING | 4\n| REKEYED | 5\n| DELETING | 6\n| DESTROYING | 7\n\n#### Child SA\n\n| Name | State value\n| --- | ---\n| CREATED | 0\n| ROUTED | 1\n| INSTALLING | 2\n| INSTALLED | 3\n| UPDATING | 4\n| REKEYING | 5\n| REKEYED | 6\n| RETRYING | 7\n| DELETING | 8\n| DELETED | 9\n| DESTROYING | 10\n\n### libreswan state mapping\n\n| Name | State value\n| --- | ---\n| STATE_MAIN_R0 | 0\n| STATE_MAIN_I1 | 1\n| STATE_MAIN_R1 | 2\n| STATE_MAIN_I2 | 3\n| STATE_MAIN_R2 | 4\n| STATE_MAIN_I3 | 5\n| STATE_MAIN_R3 | 6\n| STATE_MAIN_I4 | 7\n| STATE_AGGR_R0 | 8\n| STATE_AGGR_I1 | 9\n| STATE_AGGR_R1 | 10\n| STATE_AGGR_I2 | 11\n| STATE_AGGR_R2 | 12\n| STATE_QUICK_R0 | 13\n| STATE_QUICK_I1 | 14\n| STATE_QUICK_R1 | 15\n| STATE_QUICK_I2 | 16\n| STATE_QUICK_R2 | 17\n| STATE_INFO | 18\n| STATE_INFO_PROTECTED | 19\n| STATE_XAUTH_R0 | 20\n| STATE_XAUTH_R1 | 21\n| STATE_MODE_CFG_R0 | 22\n| STATE_MODE_CFG_R1 | 23\n| STATE_MODE_CFG_R2 | 24\n| STATE_MODE_CFG_I1 | 25\n| STATE_XAUTH_I0 | 26\n| STATE_XAUTH_I1 | 27\n| STATE_V2_PARENT_I0 | 29\n| STATE_V2_PARENT_I1 | 30\n| STATE_V2_PARENT_I2 | 31\n| STATE_V2_PARENT_R0 | 32\n| STATE_V2_PARENT_R1 | 33\n| STATE_V2_IKE_AUTH_CHILD_I0 | 34\n| STATE_V2_IKE_AUTH_CHILD_R0 | 35\n| STATE_V2_NEW_CHILD_I0 | 36\n| STATE_V2_NEW_CHILD_I1 | 37\n| STATE_V2_REKEY_IKE_I0 | 38\n| STATE_V2_REKEY_IKE_I1 | 39\n| STATE_V2_REKEY_CHILD_I0 | 40\n| STATE_V2_REKEY_CHILD_I1 | 41\n| STATE_V2_NEW_CHILD_R0 | 42\n| STATE_V2_REKEY_IKE_R0 | 43\n| STATE_V2_REKEY_CHILD_R0 | 44\n| STATE_V2_ESTABLISHED_IKE_SA | 45\n| STATE_V2_ESTABLISHED_CHILD_SA | 46\n| STATE_V2_IKE_SA_DELETE | 47\n| STATE_V2_CHILD_SA_DELETE | 48\n\n## Flags\n\n```bash\n./ipsec_exporter --help\n```\n\n* __`vici.address`:__ VICI socket address. Example: `unix:///var/run/charon.vici` or `tcp://127.0.0.1:4502`.\n* __`vici.timeout`:__ VICI socket connect timeout.\n* __`collector`:__ Collector type to scrape metrics with. `vici` or `ipsec`.\n* __`ipsec.command`:__ Command to scrape IPsec metrics when the collector is configured to an `ipsec` binary. `ipsec statusall` by default.\n  To use with libreswan, set to `ipsec status`.\n* __`web.listen-address`:__ Address to listen on for web interface and telemetry.\n* __`web.telemetry-path`:__ Path under which to expose metrics.\n* __`log.level`:__ Logging level. `info` by default.\n* __`log.format`:__ Set the log target and format. Example: `logger:syslog?appname=bob\u0026local=7`\n  or `logger:stdout?json=true`.\n\n### TLS and basic authentication\n\nThe ipsec_exporter supports TLS and basic authentication.\nTo use TLS and/or basic authentication, you need to pass a configuration file\nusing the `--web.config.file` parameter. The format of the file is described\n[in the exporter-toolkit repository](https://github.com/prometheus/exporter-toolkit/blob/master/docs/web-configuration.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsergeymakinen%2Fipsec_exporter","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsergeymakinen%2Fipsec_exporter","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsergeymakinen%2Fipsec_exporter/lists"}