Metrics — system and traffic measurements 📈

EN | FR | 🟣 MIND | module secubox-metrics

Metrics tells you, at a glance, whether the box is healthy and who is visiting your sites. It has two pages (an overview and a per-site page), two world maps, a PDF attendance report in the Aurora reference style, a daily security report, and optional delivery by mail.

Overview page (/metrics/)

Sections, top to bottom:

Section	What it shows
Global health	one verdict for the box, also used by the portal banner
Resources	CPU, memory, disk, load, uptime, gauges and 24 h curves
Memory and load	memory and load history
Services and containers	state of services and LXC containers
Established TCP connections	live connection table
Traffic and WAF protection	requests and threats seen by the WAF
Origin of attacks / of visitors	world maps (see below)
Recent campaigns	attack campaigns detected by the WAF
Certificates	expiry of TLS certificates
Module health	one line per SecuBox module

A figure with no measurement behind it is shown as « — », never as a reassuring zero. Temperature is shown as « — » because no route provides it. ?embed=1 hides the page chrome for use inside the Hall; ?demo=1 shows a demonstration notice.

The WAF state follows sbxwaf

The global health marks the WAF as running when the secubox-waf-ng service is active and port 8085 answers. The older check (a mitmproxy container or process) no longer exists and wrongly reported « WAF out of service » while sbxwaf was running. It is kept only as a fallback. See WAF.

Sites page (/metrics/vhosts.html)

Block	Content
Site ranking	sorted and filterable list of vhosts
HTTP statuses	donut of response codes
Requests per site	bars per vhost
Origin and country of visits	world map and country list
Day-by-day attendance	histogram
Live hosts	requests per vhost over a recent window
Certificates	per-site expiry
Site detail (click a row)	visits and probes, return codes, browsers, visitor countries, most viewed pages, referrers, cumulative visits

Periods are jour (1 day), semaine (7) and mois (30). Related domains of one site can be grouped into a single « family ». The page also offers log re-reading and the PDF report.

World maps

Both pages draw the same dot map as the WAF page of the Hall: a 120 × 60 grid of 3-degree cells and one bubble per country. The overview map « Origin of attacks » stays at « — » as long as the metrics API supplies no attack country.

The visitor countries over 7 days also feed the "inputs" map of the Interceptor page, drawn with the same dot map (secubox-interceptor 2.1.0). If the source is missing, that map stays empty and shows "—".

PDF attendance report

Built in the Aurora style: dark background, tiles (visits, visitors, requests, errors, bandwidth), day-by-day histogram, status donut, world map, site bars, browsers, referrers, countries and per-vhost detail.

• On demand: button on the Sites page, or POST /api/v1/metrics/vhost-stats/rapport?periode=semaine (administrator token). Without envoyer=true the PDF is returned as a download; with it, the report is mailed.
• Scheduled: secubox-metrics-rapport-quotidien.timer (every day 05:00, last 7 days) and secubox-metrics-rapport.timer (Mondays 07:00, last month). Nothing is sent until /etc/secubox/metrics.toml declares a family and a recipient:

[rapport.planifie]
famille = "exemple"
destinataire = "[email protected]"
periode = "semaine"

Daily security report

secubox-metrics-rapport-waf.timer runs every day at 05:30. The PDF has three sections: WAF, Actor Intelligence and DPI, in the style of the Hall views. Only real data appears: a silent source is shown as a dash with a « Measurements unavailable » line, and each section ends with definitions (unit, window, source). A stale DPI summary is flagged.

[rapport.waf]
destinataire = "[email protected]"
jours = 7
format = "securite"   # "waf" keeps the older single-topic PDF

Mail delivery

Reports go through the local mail relay (the mail container) on port 25, without authentication, to an internal recipient. Setting smtp_user switches to authenticated submission. The SMTP timeout is 200 s because the relay may wait for the antivirus container to wake up. See Messagerie. There is no default recipient: a fresh box sends nothing.

Other features

Feature	Detail
Memory history	GET /api/v1/metrics/memory/history?heures=24; one sample every 5 min (7 days), alerts on kernel memory growth
Visitor origin	GET /api/v1/metrics/visitor-origin (ASN, refreshed weekly)
Live hosts	GET /api/v1/metrics/live-hosts
Certificates	GET /api/v1/metrics/cert-status (warning from 30 days)
Global health	GET /api/v1/metrics/health/summary

Read routes are guarded by require_lecture; actions such as the report use require_jwt.

See also

WAF · Interceptor · ThreatMesh · Messagerie · Cartes-du-Hall · MODULES-EN