499 lines
18 KiB
Rust
499 lines
18 KiB
Rust
//! Aggregate metrics: no attacker-controlled labels or unbounded series.
|
|
use serde::Serialize;
|
|
use std::sync::atomic::{AtomicU64, Ordering};
|
|
#[derive(Default)]
|
|
pub struct Metrics {
|
|
pub admin_requests: AtomicU64,
|
|
pub admin_response_headers: AtomicU64,
|
|
pub admin_header_duration_us: AtomicU64,
|
|
pub admin_status: [AtomicU64; 5],
|
|
pub compression_gzip: AtomicU64,
|
|
pub compression_br: AtomicU64,
|
|
pub compression_zstd: AtomicU64,
|
|
pub compression_deflate: AtomicU64,
|
|
pub status_1xx: AtomicU64,
|
|
pub http1_requests: AtomicU64,
|
|
pub http3_requests: AtomicU64,
|
|
pub http3_connections: AtomicU64,
|
|
pub http3_active_connections: AtomicU64,
|
|
pub http3_rejected_connections: AtomicU64,
|
|
pub http2_requests: AtomicU64,
|
|
pub http2_connections: AtomicU64,
|
|
pub http2_active_connections: AtomicU64,
|
|
pub tls_connections: AtomicU64,
|
|
pub tls_handshake_errors: AtomicU64,
|
|
pub websocket_total: AtomicU64,
|
|
pub websocket_active: AtomicU64,
|
|
pub websocket_h1_total: AtomicU64,
|
|
pub websocket_h1_active: AtomicU64,
|
|
pub websocket_h2_total: AtomicU64,
|
|
pub websocket_h2_active: AtomicU64,
|
|
pub websocket_h3_total: AtomicU64,
|
|
pub websocket_h3_active: AtomicU64,
|
|
pub websocket_closed: AtomicU64,
|
|
pub websocket_errors: AtomicU64,
|
|
pub websocket_handshake_errors: AtomicU64,
|
|
pub websocket_bytes_in: AtomicU64,
|
|
pub websocket_bytes_out: AtomicU64,
|
|
pub websocket_duration_us: AtomicU64,
|
|
pub requests: AtomicU64,
|
|
pub completed: AtomicU64,
|
|
pub active: AtomicU64,
|
|
pub errors: AtomicU64,
|
|
pub rejected_requests: AtomicU64,
|
|
pub connections: AtomicU64,
|
|
pub active_connections: AtomicU64,
|
|
pub rejected_connections: AtomicU64,
|
|
pub bytes_in: AtomicU64,
|
|
pub bytes_out: AtomicU64,
|
|
pub duration_us: AtomicU64,
|
|
pub status_2xx: AtomicU64,
|
|
pub status_3xx: AtomicU64,
|
|
pub status_4xx: AtomicU64,
|
|
pub status_5xx: AtomicU64,
|
|
}
|
|
#[derive(Serialize)]
|
|
pub struct View {
|
|
pub http1_requests: u64,
|
|
pub http3_requests: u64,
|
|
pub http3_connections: u64,
|
|
pub http3_active_connections: u64,
|
|
pub http3_rejected_connections: u64,
|
|
|
|
pub compression_gzip: u64,
|
|
pub compression_br: u64,
|
|
pub compression_zstd: u64,
|
|
pub compression_deflate: u64,
|
|
pub http2_requests: u64,
|
|
pub http2_connections: u64,
|
|
pub http2_active_connections: u64,
|
|
pub tls_connections: u64,
|
|
pub tls_handshake_errors: u64,
|
|
pub websocket_total: u64,
|
|
pub websocket_active: u64,
|
|
pub websocket_h1_total: u64,
|
|
pub websocket_h1_active: u64,
|
|
pub websocket_h2_total: u64,
|
|
pub websocket_h2_active: u64,
|
|
pub websocket_h3_total: u64,
|
|
pub websocket_h3_active: u64,
|
|
pub websocket_errors: u64,
|
|
pub websocket_handshake_errors: u64,
|
|
pub websocket_bytes_in: u64,
|
|
pub websocket_bytes_out: u64,
|
|
pub requests: u64,
|
|
pub completed: u64,
|
|
pub active: u64,
|
|
pub errors: u64,
|
|
pub rejected_requests: u64,
|
|
pub connections: u64,
|
|
pub active_connections: u64,
|
|
pub rejected_connections: u64,
|
|
pub bytes_in: u64,
|
|
pub bytes_out: u64,
|
|
pub mean_duration_ms: f64,
|
|
}
|
|
fn n(value: &AtomicU64) -> u64 {
|
|
value.load(Ordering::Relaxed)
|
|
}
|
|
impl Metrics {
|
|
pub fn record_compression(&self, encoding: crate::compression::AppliedEncoding) {
|
|
let counter = match encoding {
|
|
crate::compression::AppliedEncoding::Gzip => &self.compression_gzip,
|
|
crate::compression::AppliedEncoding::Brotli => &self.compression_br,
|
|
crate::compression::AppliedEncoding::Zstd => &self.compression_zstd,
|
|
crate::compression::AppliedEncoding::Deflate => &self.compression_deflate,
|
|
};
|
|
counter.fetch_add(1, Ordering::Relaxed);
|
|
}
|
|
|
|
pub fn view(&self) -> View {
|
|
let completed = n(&self.completed);
|
|
View {
|
|
http1_requests: n(&self.http1_requests),
|
|
http3_requests: n(&self.http3_requests),
|
|
http3_connections: n(&self.http3_connections),
|
|
http3_active_connections: n(&self.http3_active_connections),
|
|
http3_rejected_connections: n(&self.http3_rejected_connections),
|
|
|
|
compression_gzip: n(&self.compression_gzip),
|
|
compression_br: n(&self.compression_br),
|
|
compression_zstd: n(&self.compression_zstd),
|
|
compression_deflate: n(&self.compression_deflate),
|
|
http2_requests: n(&self.http2_requests),
|
|
http2_connections: n(&self.http2_connections),
|
|
http2_active_connections: n(&self.http2_active_connections),
|
|
tls_connections: n(&self.tls_connections),
|
|
tls_handshake_errors: n(&self.tls_handshake_errors),
|
|
websocket_total: n(&self.websocket_total),
|
|
websocket_active: n(&self.websocket_active),
|
|
websocket_h1_total: n(&self.websocket_h1_total),
|
|
websocket_h1_active: n(&self.websocket_h1_active),
|
|
websocket_h2_total: n(&self.websocket_h2_total),
|
|
websocket_h2_active: n(&self.websocket_h2_active),
|
|
websocket_h3_total: n(&self.websocket_h3_total),
|
|
websocket_h3_active: n(&self.websocket_h3_active),
|
|
websocket_errors: n(&self.websocket_errors),
|
|
websocket_handshake_errors: n(&self.websocket_handshake_errors),
|
|
websocket_bytes_in: n(&self.websocket_bytes_in),
|
|
websocket_bytes_out: n(&self.websocket_bytes_out),
|
|
requests: n(&self.requests),
|
|
completed,
|
|
active: n(&self.active),
|
|
errors: n(&self.errors),
|
|
rejected_requests: n(&self.rejected_requests),
|
|
connections: n(&self.connections),
|
|
active_connections: n(&self.active_connections),
|
|
rejected_connections: n(&self.rejected_connections),
|
|
bytes_in: n(&self.bytes_in),
|
|
bytes_out: n(&self.bytes_out),
|
|
mean_duration_ms: if completed > 0 {
|
|
n(&self.duration_us) as f64 / completed as f64 / 1000.0
|
|
} else {
|
|
0.0
|
|
},
|
|
}
|
|
}
|
|
pub fn prometheus(&self, logs_dropped: u64, revision: u64) -> String {
|
|
let mut out = String::new();
|
|
let entries = [
|
|
(
|
|
"http1_requests_total",
|
|
"counter",
|
|
"Public requests received using HTTP/1.1.",
|
|
n(&self.http1_requests),
|
|
),
|
|
(
|
|
"http3_requests_total",
|
|
"counter",
|
|
"HTTP/3 requests",
|
|
n(&self.http3_requests),
|
|
),
|
|
(
|
|
"http3_connections_total",
|
|
"counter",
|
|
"HTTP/3 connections",
|
|
n(&self.http3_connections),
|
|
),
|
|
(
|
|
"http3_active_connections",
|
|
"gauge",
|
|
"HTTP/3 active connections",
|
|
n(&self.http3_active_connections),
|
|
),
|
|
(
|
|
"http3_rejected_connections_total",
|
|
"counter",
|
|
"HTTP/3 rejected connections",
|
|
n(&self.http3_rejected_connections),
|
|
),
|
|
(
|
|
"compression_gzip_total",
|
|
"counter",
|
|
"Gzip encoded responses.",
|
|
n(&self.compression_gzip),
|
|
),
|
|
(
|
|
"compression_br_total",
|
|
"counter",
|
|
"Brotli encoded responses.",
|
|
n(&self.compression_br),
|
|
),
|
|
(
|
|
"compression_zstd_total",
|
|
"counter",
|
|
"Zstd encoded responses.",
|
|
n(&self.compression_zstd),
|
|
),
|
|
(
|
|
"compression_deflate_total",
|
|
"counter",
|
|
"Deflate encoded responses.",
|
|
n(&self.compression_deflate),
|
|
),
|
|
(
|
|
"http2_requests_total",
|
|
"counter",
|
|
"Public requests received using HTTP/2.",
|
|
n(&self.http2_requests),
|
|
),
|
|
(
|
|
"http2_connections_total",
|
|
"counter",
|
|
"Public HTTP/2 connections over TLS or opt-in cleartext h2c prior knowledge.",
|
|
n(&self.http2_connections),
|
|
),
|
|
(
|
|
"http2_active_connections",
|
|
"gauge",
|
|
"Currently open public HTTP/2 connections.",
|
|
n(&self.http2_active_connections),
|
|
),
|
|
(
|
|
"tls_connections_total",
|
|
"counter",
|
|
"Successful public TLS handshakes.",
|
|
n(&self.tls_connections),
|
|
),
|
|
(
|
|
"tls_handshake_errors_total",
|
|
"counter",
|
|
"Failed or timed-out public TLS handshakes.",
|
|
n(&self.tls_handshake_errors),
|
|
),
|
|
(
|
|
"websocket_tunnels_total",
|
|
"counter",
|
|
"Established WebSocket tunnels across HTTP/1.1, HTTP/2 RFC 8441 and HTTP/3 RFC 9220.",
|
|
n(&self.websocket_total),
|
|
),
|
|
(
|
|
"websocket_tunnels_active",
|
|
"gauge",
|
|
"Open WebSocket tunnels, counted until byte transport ends.",
|
|
n(&self.websocket_active),
|
|
),
|
|
(
|
|
"websocket_h1_tunnels_total",
|
|
"counter",
|
|
"Established HTTP/1.1 Upgrade WebSocket tunnels.",
|
|
n(&self.websocket_h1_total),
|
|
),
|
|
(
|
|
"websocket_h1_tunnels_active",
|
|
"gauge",
|
|
"Active HTTP/1.1 Upgrade WebSocket tunnels.",
|
|
n(&self.websocket_h1_active),
|
|
),
|
|
(
|
|
"websocket_h2_rfc8441_tunnels_total",
|
|
"counter",
|
|
"Established HTTP/2 RFC 8441 WebSocket tunnels.",
|
|
n(&self.websocket_h2_total),
|
|
),
|
|
(
|
|
"websocket_h2_rfc8441_tunnels_active",
|
|
"gauge",
|
|
"Active HTTP/2 RFC 8441 WebSocket tunnels.",
|
|
n(&self.websocket_h2_active),
|
|
),
|
|
(
|
|
"websocket_h3_rfc9220_tunnels_total",
|
|
"counter",
|
|
"Established HTTP/3 RFC 9220 WebSocket tunnels.",
|
|
n(&self.websocket_h3_total),
|
|
),
|
|
(
|
|
"websocket_h3_rfc9220_tunnels_active",
|
|
"gauge",
|
|
"Active HTTP/3 RFC 9220 WebSocket tunnels.",
|
|
n(&self.websocket_h3_active),
|
|
),
|
|
(
|
|
"websocket_errors_total",
|
|
"counter",
|
|
"Upgrade transport, I/O or idle-timeout failures.",
|
|
n(&self.websocket_errors),
|
|
),
|
|
(
|
|
"websocket_handshake_errors_total",
|
|
"counter",
|
|
"WebSocket upgrade requests not answered with 101.",
|
|
n(&self.websocket_handshake_errors),
|
|
),
|
|
(
|
|
"websocket_client_bytes_total",
|
|
"counter",
|
|
"Client WebSocket frame bytes, including framing but excluding TLS/TCP.",
|
|
n(&self.websocket_bytes_in),
|
|
),
|
|
(
|
|
"websocket_backend_bytes_total",
|
|
"counter",
|
|
"Backend WebSocket frame bytes, including framing but excluding TLS/TCP.",
|
|
n(&self.websocket_bytes_out),
|
|
),
|
|
(
|
|
"requests_total",
|
|
"counter",
|
|
"Requests entering the public proxy, including capacity rejects.",
|
|
n(&self.requests),
|
|
),
|
|
(
|
|
"requests_completed_total",
|
|
"counter",
|
|
"Admitted exchanges released after their bodies finish or drop.",
|
|
n(&self.completed),
|
|
),
|
|
(
|
|
"requests_active",
|
|
"gauge",
|
|
"Admitted exchanges with a live request or response body.",
|
|
n(&self.active),
|
|
),
|
|
(
|
|
"errors_total",
|
|
"counter",
|
|
"Completed 5xx, timed-out, failed or aborted exchanges.",
|
|
n(&self.errors),
|
|
),
|
|
(
|
|
"requests_rejected_total",
|
|
"counter",
|
|
"Requests rejected by the in-flight limit.",
|
|
n(&self.rejected_requests),
|
|
),
|
|
(
|
|
"connections_total",
|
|
"counter",
|
|
"Accepted public TCP/QUIC connections.",
|
|
n(&self.connections),
|
|
),
|
|
(
|
|
"connections_active",
|
|
"gauge",
|
|
"Open public TCP/QUIC connections.",
|
|
n(&self.active_connections),
|
|
),
|
|
(
|
|
"connections_rejected_total",
|
|
"counter",
|
|
"Public TCP/QUIC connections rejected at the connection limit.",
|
|
n(&self.rejected_connections),
|
|
),
|
|
(
|
|
"request_body_bytes_total",
|
|
"counter",
|
|
"Request payload bytes pulled through the proxy, not wire bytes.",
|
|
n(&self.bytes_in),
|
|
),
|
|
(
|
|
"response_body_bytes_total",
|
|
"counter",
|
|
"Response payload bytes yielded by the proxy, not acknowledged wire bytes.",
|
|
n(&self.bytes_out),
|
|
),
|
|
(
|
|
"logs_dropped_total",
|
|
"counter",
|
|
"Access entries dropped due to contention, excluding ring eviction.",
|
|
logs_dropped,
|
|
),
|
|
(
|
|
"config_revision",
|
|
"gauge",
|
|
"Currently applied configuration revision.",
|
|
revision,
|
|
),
|
|
];
|
|
for (name, kind, help, value) in entries {
|
|
out.push_str(&format!("# HELP rust_proxy_{name} {help}\n# TYPE rust_proxy_{name} {kind}\nrust_proxy_{name} {value}\n"));
|
|
}
|
|
out.push_str("# HELP rust_proxy_exchange_duration_seconds Lifetime through body completion or cancellation.\n# TYPE rust_proxy_exchange_duration_seconds summary\n");
|
|
out.push_str(&format!("rust_proxy_exchange_duration_seconds_count {}\nrust_proxy_exchange_duration_seconds_sum {:.6}\n", n(&self.completed), n(&self.duration_us) as f64 / 1_000_000.0));
|
|
out.push_str("# HELP rust_proxy_responses_total Completed responses by status class.\n# TYPE rust_proxy_responses_total counter\n");
|
|
for (class, value) in [
|
|
("1xx", &self.status_1xx),
|
|
("2xx", &self.status_2xx),
|
|
("3xx", &self.status_3xx),
|
|
("4xx", &self.status_4xx),
|
|
("5xx", &self.status_5xx),
|
|
] {
|
|
out.push_str(&format!(
|
|
"rust_proxy_responses_total{{class=\"{class}\"}} {}\n",
|
|
n(value)
|
|
));
|
|
}
|
|
out.push_str("# HELP rust_proxy_websocket_duration_seconds Lifetime of closed WebSocket byte transports.\n# TYPE rust_proxy_websocket_duration_seconds summary\n");
|
|
out.push_str(&format!("rust_proxy_websocket_duration_seconds_count {}\nrust_proxy_websocket_duration_seconds_sum {:.6}\n",
|
|
n(&self.websocket_closed), n(&self.websocket_duration_us) as f64 / 1_000_000.0));
|
|
out
|
|
}
|
|
}
|
|
|
|
/// Fixed-cardinality per-vhost counters. Retained across config updates by ID,
|
|
/// released when a vhost is removed, and finalized after complete body lifetime.
|
|
pub const DURATION_BUCKETS_US: [u64; 10] = [
|
|
5_000, 10_000, 25_000, 50_000, 100_000, 250_000, 500_000, 1_000_000, 2_500_000, 5_000_000,
|
|
];
|
|
#[derive(Default, Debug)]
|
|
pub struct VhostMetrics {
|
|
pub requests: AtomicU64,
|
|
pub completed: AtomicU64,
|
|
pub active: AtomicU64,
|
|
pub rejected: AtomicU64,
|
|
pub errors: AtomicU64,
|
|
pub bytes_in: AtomicU64,
|
|
pub bytes_out: AtomicU64,
|
|
pub duration_us: AtomicU64,
|
|
pub status: [AtomicU64; 5],
|
|
pub buckets: [AtomicU64; 11],
|
|
}
|
|
impl VhostMetrics {
|
|
pub fn complete(
|
|
&self,
|
|
status: u16,
|
|
failed: bool,
|
|
duration: std::time::Duration,
|
|
bytes_in: u64,
|
|
bytes_out: u64,
|
|
) {
|
|
self.active.fetch_sub(1, Ordering::Relaxed);
|
|
self.completed.fetch_add(1, Ordering::Relaxed);
|
|
if failed || status >= 500 {
|
|
self.errors.fetch_add(1, Ordering::Relaxed);
|
|
}
|
|
self.bytes_in.fetch_add(bytes_in, Ordering::Relaxed);
|
|
self.bytes_out.fetch_add(bytes_out, Ordering::Relaxed);
|
|
self.status[(status as usize / 100).clamp(1, 5) - 1].fetch_add(1, Ordering::Relaxed);
|
|
let micros = duration.as_micros().min(u64::MAX as u128) as u64;
|
|
self.duration_us.fetch_add(micros, Ordering::Relaxed);
|
|
for (index, threshold) in DURATION_BUCKETS_US.iter().enumerate() {
|
|
if micros <= *threshold {
|
|
self.buckets[index].fetch_add(1, Ordering::Relaxed);
|
|
}
|
|
}
|
|
self.buckets[DURATION_BUCKETS_US.len()].fetch_add(1, Ordering::Relaxed);
|
|
}
|
|
}
|
|
#[cfg(test)]
|
|
mod vhost_tests {
|
|
use super::*;
|
|
#[test]
|
|
fn streaming_completion_and_histogram() {
|
|
let m = VhostMetrics::default();
|
|
m.active.store(1, Ordering::Relaxed);
|
|
m.complete(503, false, std::time::Duration::from_millis(20), 10, 50);
|
|
assert_eq!(n(&m.active), 0);
|
|
assert_eq!(n(&m.errors), 1);
|
|
assert_eq!(n(&m.status[4]), 1);
|
|
assert_eq!(n(&m.buckets[1]), 0);
|
|
assert_eq!(n(&m.buckets[2]), 1);
|
|
assert_eq!(n(&m.buckets[10]), 1);
|
|
}
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod compression_counter_tests {
|
|
use super::*;
|
|
use crate::compression::AppliedEncoding;
|
|
|
|
#[test]
|
|
fn each_codec_has_an_independent_counter() {
|
|
let metrics = Metrics::default();
|
|
for encoding in [
|
|
AppliedEncoding::Gzip,
|
|
AppliedEncoding::Brotli,
|
|
AppliedEncoding::Zstd,
|
|
AppliedEncoding::Deflate,
|
|
] {
|
|
metrics.record_compression(encoding);
|
|
}
|
|
let view = metrics.view();
|
|
assert_eq!(view.compression_gzip, 1);
|
|
assert_eq!(view.compression_br, 1);
|
|
assert_eq!(view.compression_zstd, 1);
|
|
assert_eq!(view.compression_deflate, 1);
|
|
}
|
|
}
|