Observability

By default, Tempesta Manager daemon (tempesta_mgr in process list) exposes an HTTP /metrics endpoint on localhost:9090 that return available statistics in text-based Prometheus exposition format.

The listen port and address for the statistics endpoint can be configured as the daemon command-line arguments in the xfw.conf file:

{
    "daemon_args": "--listen 127.0.0.1 --http-port 9090",
    ...
}

All statistics entries, both byte and packet counters, are of counter type. Therefore, they are prefixed with the corresponding TYPE and HELP metadata and look as follows:

# HELP xfw_passed_egress_bytes Total Passed egress bytes.
# TYPE xfw_passed_egress_bytes counter
xfw_passed_egress_bytes 0

All counters are prefixed with xfw_. Byte-related metrics are suffixed with _bytes, and packet-related metrics are suffixed with _packets.

The simplest way to retrieve the statistics is by using curl:

$ curl http://127.0.0.1:9090/metrics
# HELP xfw_syn_cookies_packets Total SYN cookies packets.                                                                                                       
# TYPE xfw_syn_cookies_packets counter                                    
xfw_syn_cookies_packets 0                  
# HELP xfw_syn_cookies_bytes Total SYN cookies bytes.                                                                                                           
# TYPE xfw_syn_cookies_bytes counter                                                                                                                            
xfw_syn_cookies_bytes 0                          
...

Tempesta Escudo uses the open-source tfw_logger daemon with an additional plug-in for logging Tempesta xFW security events into a ClickHouse database. Refer to the Tempesta FW Access Log Analytics page for more information about the tfw_logger daemon.

Tempesta xFW event logging is configured using the xfw_events section in the tfw_logger configuration file. A configuration example can be found at /opt/tempesta/examples/xfw_logger.json.

The Tempesta xFW plug-in for tfw_logger creates the following ClickHouse table:

CREATE TABLE IF NOT EXISTS xfw_events (
    timestamp DateTime64(3, 'UTC'),
    addr IPv6,
    reason UInt64,
    packets UInt64,
    bytes UInt64,
    dropped_events UInt64
) ENGINE = MergeTree()
ORDER BY timestamp;

A single IP address may generate multiple packets that Tempesta xFW blocks for the same reason. Such packets, along with their total size, may be aggregated into a single event. The dropped events count is useful to track the number of events that did not make it into the statistics.

Example of the event log table:

:) SELECT timestamp, addr, bitPositionsToArray(reason), packets, bytes
   FROM xfw_events ORDER BY timestamp DESC LIMIT 10;

┌───────────────timestamp─┬─addr─────────────────┬─bits(reason)─┬─packets─┬─bytes─┬─dropped_events─┐
│ 2026-01-15 21:32:13.979 │ ::ffff:192.168.100.1 │ [8]          │       1 │    70 │             20 │
│ 2026-01-13 15:26:22.618 │ ::ffff:192.168.100.1 │ [8]          │       1 │    54 │             18 │
│ 2026-01-13 15:26:21.608 │ ::ffff:192.168.100.1 │ [8]          │       1 │    54 │             17 │
│ 2026-01-13 15:26:19.596 │ ::ffff:192.168.100.1 │ [8]          │       1 │    54 │             15 │
│ 2026-01-13 15:26:18.589 │ ::ffff:192.168.100.1 │ [8]          │       1 │    54 │             14 │
│ 2026-01-13 14:00:55.076 │ ::ffff:192.168.100.1 │ [8]          │       1 │    54 │             12 │
│ 2026-01-13 14:00:54.061 │ ::ffff:192.168.100.1 │ [2]          │       5 │   270 │             10 │
│ 2026-01-13 13:44:05.385 │ ::ffff:192.168.100.1 │ [2]          │       6 │   324 │              7 │
│ 2026-01-13 13:43:59.344 │ ::ffff:192.168.100.1 │ [2]          │       2 │   108 │              3 │
│ 2026-01-13 13:43:58.337 │ ::ffff:192.168.100.1 │ [2,3]        │       5 │   270 │              0 │
└─────────────────────────┴──────────────────────┴──────────────┴─────────┴───────┴────────────────┘

Bits constituting the reason field:

Dropped events (dropped_events) counter — the total number of dropped events across all CPUs since system startup. The counter is global and is not reset during normal operation. (Since the table is sorted by timestamp in descending order (newest events are shown first), the dropped_events value increases from bottom to top. Older records contain lower counter values, while newer records contain higher values, reflecting the cumulative number of dropped events over time.)

Packets without an Ethernet header cannot be reliably associated with a source IP address in the statistics. Such packets are not reported as separate drop events with a specific source IP address; instead, they contribute only to the global dropped_events counter.

For example, mDNS traffic generated by the Avahi daemon may reach the XDP program without an L2 header when the program is running in SKB mode. In this case, the packet contains only the network-layer header (for example, IPv6), while the original Ethernet header is no longer available. As a result, the source IP address cannot be reliably processed by the L2 parser, and the packet is accounted for only in the global dropped_events counter.