audisp/plugins/statsd/audisp-statsd.8 - master - githubmirror/audit-userspace

audisp/plugins/statsd/audisp-statsd.8
92 строки2 KB
Steve Grubb
Fix inconsistent MB and MiB terminology in man pages
06 июл 2025, 06:14
06 июл 2025, 06:146d9278d
.TH AUDISP-STATSD "8" "June 2025" "Red Hat" "System Administration Utilities"
.SH NAME
audisp-statsd \- plugin to push audit metrics to a statsd service
.SH SYNOPSIS
.B audisp-statsd
[ \fIOPTIONS\fP ]
.SH DESCRIPTION
\fBaudisp-statsd\fP is a plugin for the audit event dispatcher that pushes
audit metrics to a statsd service using UDP. It reads auditd's state report
at regular intervals and forwards the data. Generation of the state report
must be enabled in \fBauditd.conf\fP.

.SH CONFIGURATION
The plugin's configuration file is \fB/etc/audit/audisp-statsd.conf\fP.  The
following parameters are recognized:
.TP
.I address
The name or address of the statsd server.
.TP
.I port
The UDP port of the statsd service.
.TP
.I interval
Time interval between reading auditd's report. The value is a time string such
as 10m, 1h, 2d, or 6M where the suffix is s for seconds, m for minutes, h for
hours, d for days, and M for months.  The default is 15s.

.SH REPORT METRICS
The plugin collects the following metrics as gauges:
.RS
.TP
.B backlog
number of kernel events pending transfer to user space
.TP
.B lost
number of kernel events dropped
.TP
.B free_space
how much disk free space auditd sees in MiB
.TP
.B plugin_current_depth
number of events in auditd pending transfer to plugins
.TP
.B plugin_max_depth
historical maximum number of events backlogged while pending transfer to plugins
.TP
.B total_memory
current total memory in use by glibc in KiB
.TP
.B memory_in_use
how much of the total memory is actively used in KiB
.TP
.B memory_free
amount of free memory available in the glibc arenas in KiB
.RE

The following metrics are counters:
.RS
.TP
.B events_total_count
total number of events seen during interval
.TP
.B events_total_failed
total number of events seen during interval with failed outcome
.TP
.B events_avc_count
total number of AVC events seen during interval
.TP
.B events_fanotify_count
total number of FANOTIFY events seen during interval
.TP
.B events_logins_success
total number of successful login events seen during interval
.TP
.B events_logins_failed
total number of failed login events seen during interval
.TP
.B events_anamoly_count
total number of anamoly events seen during interval
.TP
.B events_response_count
total number of anamoly response events seen during interval
.RE

.SH FILES
/etc/audit/audisp-statsd.conf
/etc/audit/plugins/au-statsd.conf
.SH "SEE ALSO"
.BR auditd.conf (8),
.BR auditd-plugins (5).
.SH AUTHOR
Steve Grubb