MikroSuricata Grafana dashboard

mikrosuricata-prometheus.json is an importable Grafana dashboard for the Prometheus metrics exposed by MikroSuricata at /metrics.

The exporter is intentionally scrape-only and lightweight: it serializes already available in-memory counters and the last Suricata EVE stats snapshot. A scrape does not query SQLite, Redis, RouterOS, the Suricata control socket, or analytics endpoints.

The dashboard also uses monotonic TZSP traffic counters exported directly from the in-memory flow tracker:

mikrosuricata_traffic_bytes_total{direction="total|inbound|outbound|internal|external"}
mikrosuricata_traffic_packets_total{direction="total|inbound|outbound|internal|external"}

Grafana calculates bandwidth with PromQL rate() and converts bytes/s to bits/s. The top of the dashboard therefore shows current total, inbound and outbound throughput, packet rate, capture drops, a large throughput chart and traffic volume by direction for the selected time range.

/metrics is protected by an IP/CIDR ACL configured through environment variables. The default allows loopback only:

METRICS_ALLOWED_IPS=127.0.0.1/32,::1/128
METRICS_BASIC_AUTH_USERNAME=
METRICS_BASIC_AUTH_PASSWORD=

For a remote Prometheus, set METRICS_ALLOWED_IPS to its source IP or subnet. Multiple entries are comma-separated. Leaving both Basic Auth values empty enables IP-only mode. Setting both enables IP + Basic Auth. Setting only one credential is invalid and prevents the web server from starting. An empty METRICS_ALLOWED_IPS denies all scrapes. The ACL uses the actual TCP peer address and does not trust X-Forwarded-For.

Example IP-only Prometheus scrape configuration:

scrape_configs:
  - job_name: mikrosuricata
    scrape_interval: 30s
    metrics_path: /metrics
    static_configs:
      - targets: ["mikrosuricata:8080"]

Example IP + Basic Auth configuration in the application:

METRICS_ALLOWED_IPS=10.20.30.40/32
METRICS_BASIC_AUTH_USERNAME=prometheus
METRICS_BASIC_AUTH_PASSWORD=change-this-secret

and in Prometheus:

scrape_configs:
  - job_name: mikrosuricata
    scrape_interval: 30s
    metrics_path: /metrics
    basic_auth:
      username: prometheus
      password: change-this-secret
    static_configs:
      - targets: ["mikrosuricata:8080"]

Import mikrosuricata-prometheus.json in Grafana and select the Prometheus datasource from the dashboard variable. Rate, percentage and ratio panels are calculated in PromQL, not by MikroSuricata.

2.5 KiB Raw Blame History

MikroSuricata Grafana dashboard

2.5 KiB

Raw Blame History