audisp-statsd(8)
| AUDISP-STATSD(8) | System Administration Utilities | AUDISP-STATSD(8) |
NAME
audisp-statsd - plugin to push audit metrics to a statsd service
SYNOPSIS
audisp-statsd [ OPTIONS ]
DESCRIPTION
audisp-statsd is a plugin for the audit event dispatcher that pushes audit metrics to a statsd service using UDP. It reads auditd's state report at regular intervals and forwards the data. Generation of the state report must be enabled in auditd.conf.
CONFIGURATION
The plugin's configuration file is /etc/audit/audisp-statsd.conf. The following parameters are recognized:
- address
- The name or address of the statsd server.
- port
- The UDP port of the statsd service.
- interval
- Time interval between reading auditd's report. The value is a time string such as 10m, 1h, 2d, or 6M where the suffix is s for seconds, m for minutes, h for hours, d for days, and M for months. The default is 15s.
REPORT METRICS
The plugin collects the following metrics as gauges:
- backlog
- number of kernel events pending transfer to user space
- lost
- number of kernel events dropped
- free_space
- how much disk free space auditd sees in MiB
- plugin_current_depth
- number of events in auditd pending transfer to plugins
- plugin_max_depth
- historical maximum number of events backlogged while pending transfer to plugins
- total_memory
- current total memory in use by glibc in KiB
- memory_in_use
- how much of the total memory is actively used in KiB
- memory_free
- amount of free memory available in the glibc arenas in KiB
The following metrics are counters:
- events_total_count
- total number of events seen during interval
- events_total_failed
- total number of events seen during interval with failed outcome
- events_avc_count
- total number of AVC events seen during interval
- events_fanotify_count
- total number of FANOTIFY events seen during interval
- events_logins_success
- total number of successful login events seen during interval
- events_logins_failed
- total number of failed login events seen during interval
- events_anamoly_count
- total number of anamoly events seen during interval
- events_response_count
- total number of anamoly response events seen during interval
FILES
/etc/audit/audisp-statsd.conf /etc/audit/plugins/au-statsd.conf
SEE ALSO
auditd.conf(8), auditd-plugins(5).
AUTHOR
Steve Grubb
| June 2025 | Red Hat |