https://github.com/corelight/suricata_exporter

A Prometheus Exporter for Suricata
https://github.com/corelight/suricata_exporter

prometheus prometheus-exporter suricata

Last synced: about 2 months ago
JSON representation

A Prometheus Exporter for Suricata

• Host: GitHub
• URL: https://github.com/corelight/suricata_exporter
• Owner: corelight
• License: bsd-3-clause
• Created: 2022-02-22T15:03:44.000Z (over 2 years ago)
• Default Branch: main
• Last Pushed: 2024-03-20T02:07:09.000Z (6 months ago)
• Last Synced: 2024-06-20T12:48:40.269Z (3 months ago)
• Topics: prometheus, prometheus-exporter, suricata
• Language: Go
• Homepage:
• Size: 92.8 KB
• Stars: 13
• Watchers: 4
• Forks: 10
• Open Issues: 3
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-suricata - suricata_exporter - Simple Prometheus exporter written in Go exporting stats metrics scraped from Suricata socket. (Operations, Monitoring and Troubleshooting)

README

        
# Suricata Prometheus Exporter

This is a Prometheus Exporter for Suricata using `dump-counters` via the

[unix socket](https://suricata.readthedocs.io/en/suricata-6.0.0/unix-socket.html#interacting-via-unix-socket)

to query metrics.

## Usage

```bash

$ ./suricata_exporter -h

Usage of ./suricata_exporter:

  -suricata.socket-path string

        Path to the Suricata Command socket. (default "/var/run/suricata.socket")

  -version

        Output version information.

  -web.listen-address string

        Address to listen on (default ":9917")

```

To verify the exporter is working with your Suricata setup, use the

following command to view a subset of the capture metrics.

```bash

$ curl -s localhost:9917/metrics | grep kernel_packets_total

# HELP suricata_capture_kernel_packets_total

# TYPE suricata_capture_kernel_packets_total counter

suricata_capture_kernel_packets_total{thread="W#01-eth1"} 7744

suricata_capture_kernel_packets_total{thread="W#02-eth1"} 8435

suricata_capture_kernel_packets_total{thread="W#03-eth1"} 7564

suricata_capture_kernel_packets_total{thread="W#04-eth1"} 9747

```

You can now configure a [Prometheus server](https://prometheus.io/docs/prometheus/latest/getting_started/)

to scrape the Suricata exporter in regular intervals for later visualization

and analysis.

## Metrics

Currently produces per-thread metrics for `decoder`, `flow`, `flow_bypassed`,

`app_layer` and `tcp`. Metrics for `memuse` are reported globally.

## Compatibility

Developed against Suricata 6.0.4 and af-packet. Most supported metrics are

hard-coded.

Updated for Suricata 7.0.0, but not all new metrics have been added.