Section 8 · System administration
audisp-statsd.8
Package: audispd-plugins
AUDISP-STATSD
NAME
SYNOPSIS
DESCRIPTION
FILES
SEE ALSO
AUTHOR
NAME
audisp-statsd − plugin to push audit metrics to a statsd service
SYNOPSIS
audisp-statsd [ OPTIONS ]
DESCRIPTION
audisp-statsd is a plugin for the audit event dispatcher that pushes various audit metrics to a statsd service using UDP. Currently it collects the following metrics as gauges:
backlog
number of kernel events pending transfer to user space
| lost | number of kernel events dropped |
free_space
how much disk free space auditd sees in MB
plugin_current_depth
number of events in auditd pending transfer to plugins
plugin_max_depth
historical maximum number of events backlogged while pending transfer to plugins
as counters:
events_total_count
total number of events seen during interval
events_total_failed
total number of events seen during interval with failed outcome
events_avc_count
total number of AVC events seen during interval
events_fanotify_count
total number of FANOTIFY events seen during interval
events_logins_success
total number of successful login events seen during interval
events_logins_failed
total number of failed login events seen during interval
events_anamoly_count
total number of anamoly events seen during interval
events_response_count
total number of anamoly response events seen during interval
FILES
/etc/audit/audisp-statsd.conf /etc/audit/plugins/au-statsd.conf
SEE ALSO
auditd.conf(8), auditd-plugins(5).
AUTHOR
Steve Grubb