AUDISP-STATSD(8)

💅 AUDISP-STATSD 💅

okay bestie, so this is audisp-statsd, from section 8 of the system administration utilities manual (you know, the admin commands girlies 👑). it's the plugin that pushes audit metrics to a statsd service, and honestly? she ate. let's get into it.

---

✨ NAME ✨

audisp-statsd — the plugin that pushes audit metrics to a statsd service 🦋

---

🌸 SYNOPSIS 🌸

audisp-statsd [ OPTIONS ]

---

💖 DESCRIPTION 💖

so audisp-statsd is a plugin for the audit event dispatcher, and what she does is push audit metrics to a statsd service over UDP. literally. she reads auditd's state report at regular intervals and forwards all that data along. 🫶

lowkey important: generation of the state report must be enabled in auditd.conf. no state report, no metrics, no vibes. 💀

---

🎀 CONFIGURATION 🎀

her config file lives at /etc/audit/audisp-statsd.conf and these are the parameters she recognizes, no cap:

• address — the name or address of the statsd server. that's it, that's the whole thing. 💅
• port — the UDP port of the statsd service.
• interval — the time interval between reading auditd's report. the value is a time string like 10m, 1h, 2d, or 6M, where the suffix is s for seconds, m for minutes, h for hours, d for days, and M for months. the default is 15s. ⏰

---

📊 REPORT METRICS 📊

the gauges 🫧

the plugin collects the following metrics as gauges:

• backlog — number of kernel events pending transfer to user space
• lost — number of kernel events dropped 😭
• free_space — how much disk free space auditd sees in MiB
• plugin_current_depth — number of events in auditd pending transfer to plugins
• plugin_max_depth — historical maximum number of events backlogged while pending transfer to plugins
• total_memory — current total memory in use by glibc in KiB
• memory_in_use — how much of the total memory is actively used in KiB
• memory_free — amount of free memory available in the glibc arenas in KiB

the counters 🔢

and the following metrics are counters:

• events_total_count — total number of events seen during interval
• events_total_failed — total number of events seen during interval with failed outcome
• events_avc_count — total number of AVC events seen during interval
• events_fanotify_count — total number of FANOTIFY events seen during interval
• events_logins_success — total number of successful login events seen during interval
• events_logins_failed — total number of failed login events seen during interval
• events_anamoly_count — total number of anamoly events seen during interval
• events_response_count — total number of anamoly response events seen during interval

---

🗂️ FILES 🗂️

• /etc/audit/audisp-statsd.conf
• /etc/audit/plugins/au-statsd.conf

---

👀 SEE ALSO 👀

auditd.conf(8), auditd-plugins(5).

---

💜 AUTHOR 💜

Steve Grubb

---

and that's the whole page, bestie. this one came from Red Hat, dated June 2025 — so go forth, enable that state report, and let her push those metrics. slay. ✨💅🦋