Metrics
Reference for the traffic and enforcement counters, per namespace and per firewall.
Metrics are time-bucketed counters of what the firewall processed and enforced. The dashboard charts them on the namespace overview and on each firewall's page. The CLI has no metrics command. For which record answers which question, see Observability.
Counters
| Counter | Counts |
|---|---|
requests | Package requests handled |
downloads | Artifacts served |
published | Publishes forwarded to the publish target |
processedVersions | Versions the firewall read from upstream metadata responses |
blockedFilteredVersions | Versions filtered out of a metadata response by rules |
blockedDownloads | Downloads blocked by rules, on either the versions or the download phase |
blockedUploads | Publishes blocked by rules |
allowedByException | Package accesses a rule would have blocked but an exception allowed through, counted in every phase |
rules | Rules configured (gauge per bucket) |
exceptions | Exceptions configured (gauge per bucket) |
The enforcement counters describe different outcomes:
blockedFilteredVersionscounts versions the firewall removed from package metadata before the client picked one. The client usually does not notice: a version range resolves to an older version that passed the rules. This counter runs high compared to the other two: it counts filtered versions in metadata responses, not failed installs. See rule evaluation for how filtering plays out per request shape.blockedDownloadsandblockedUploadsare hard stops: a client asked for a specific artifact, or tried to publish one, and a rule refused. Artifact requests run the versions-phase rules too, so a client that skips resolution and fetches a filtered version directly is counted here, not underblockedFilteredVersions. These are the failures users experience, and the firewall log shows which rule and which package.allowedByExceptioncounts requests a rule would have blocked but an exception let through. If it rises steadily, those exceptions carry real traffic every day and are worth a review.
Related
- Concept: Observability
- Reference: Logs
- Per-webhook delivery metrics are separate: Webhooks