ca1e25b21e
A domain variable, the destination host from the proxy's access log, sits beside the agent one and every query on the board filters on both, so one domain and its agents show which agents queried it and when.
2038 lines
68 KiB
JSON
2038 lines
68 KiB
JSON
{
|
|
"apiVersion": "dashboard.grafana.app/v2beta1",
|
|
"kind": "Dashboard",
|
|
"metadata": {
|
|
"name": "hyperhive-egress"
|
|
},
|
|
"spec": {
|
|
"title": "hyperhive · egress",
|
|
"description": "What agents send through the egress proxy: totals, refused, would-deny. Filter by agent and domain.",
|
|
"editable": true,
|
|
"cursorSync": "Off",
|
|
"liveNow": false,
|
|
"preload": false,
|
|
"tags": ["hyperhive", "swarm", "egress", "squid"],
|
|
"links": [],
|
|
"annotations": [
|
|
{
|
|
"kind": "AnnotationQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "grafana",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "-- Grafana --"
|
|
},
|
|
"spec": {}
|
|
},
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"builtIn": true,
|
|
"legacyOptions": {
|
|
"type": "dashboard"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"variables": [
|
|
{
|
|
"kind": "QueryVariable",
|
|
"spec": {
|
|
"name": "agent",
|
|
"current": {
|
|
"text": "All",
|
|
"value": "$__all"
|
|
},
|
|
"label": "Agent",
|
|
"hide": "dontHide",
|
|
"refresh": "onTimeRangeChanged",
|
|
"skipUrlSync": false,
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"refId": "agent",
|
|
"type": "fieldValue",
|
|
"field": "agent",
|
|
"query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\"",
|
|
"limit": 200
|
|
}
|
|
},
|
|
"regex": "",
|
|
"sort": "alphabeticalAsc",
|
|
"options": [],
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"allowCustomValue": true
|
|
}
|
|
},
|
|
{
|
|
"kind": "QueryVariable",
|
|
"spec": {
|
|
"name": "domain",
|
|
"current": {
|
|
"text": "All",
|
|
"value": "$__all"
|
|
},
|
|
"label": "Domain",
|
|
"hide": "dontHide",
|
|
"refresh": "onTimeRangeChanged",
|
|
"skipUrlSync": false,
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"refId": "domain",
|
|
"type": "fieldValue",
|
|
"field": "dest",
|
|
"query": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url",
|
|
"limit": 1000
|
|
}
|
|
},
|
|
"regex": "",
|
|
"sort": "alphabeticalAsc",
|
|
"options": [],
|
|
"multi": true,
|
|
"includeAll": true,
|
|
"allowCustomValue": true
|
|
}
|
|
}
|
|
],
|
|
"timeSettings": {
|
|
"timezone": "utc",
|
|
"from": "now-24h",
|
|
"to": "now",
|
|
"autoRefresh": "1m",
|
|
"autoRefreshIntervals": [
|
|
"5s",
|
|
"10s",
|
|
"30s",
|
|
"1m",
|
|
"5m",
|
|
"15m",
|
|
"30m",
|
|
"1h",
|
|
"2h",
|
|
"1d"
|
|
],
|
|
"hideTimepicker": false,
|
|
"fiscalYearStartMonth": 0
|
|
},
|
|
"elements": {
|
|
"panel-1": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 1,
|
|
"title": "Requests",
|
|
"description": "Every request squid logged in the range; zero means the log feed is down.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-2": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 2,
|
|
"title": "Agents active",
|
|
"description": "Distinct agents that sent a request through the proxy in the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-3": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 3,
|
|
"title": "Refused (403)",
|
|
"description": "Requests the proxy refused: a destination that is not allowed.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-4": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 4,
|
|
"title": "Credential challenges (407)",
|
|
"description": "First requests answered with a login challenge, before the client retried.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:407 | stats count() as challenges",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-5": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 5,
|
|
"title": "Data transferred",
|
|
"description": "Bytes squid sent back to agents in the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats sum(bytes) as bytes",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bytes",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-6": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 6,
|
|
"title": "Would-deny requests",
|
|
"description": "Requests let through that restricted mode would refuse; see the would-deny tab.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-7": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 7,
|
|
"title": "Requests over time by status",
|
|
"description": "Requests per HTTP status the proxy answered with.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (status) count() as requests",
|
|
"queryType": "statsRange",
|
|
"legendFormat": "{{status}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "timeseries",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"drawStyle": "bars",
|
|
"lineWidth": 1,
|
|
"fillOpacity": 60,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"axisSoftMin": 0
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-8": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 8,
|
|
"title": "Requests by agent",
|
|
"description": "Requests per agent in the range, busiest first.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests | sort by (requests) desc | limit 15",
|
|
"queryType": "stats",
|
|
"legendFormat": "{{agent}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "bargauge",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"displayMode": "basic",
|
|
"orientation": "horizontal",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showUnfilled": true,
|
|
"valueMode": "text"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"value": null,
|
|
"color": "blue"
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "blue"
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-9": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 9,
|
|
"title": "Data transferred by agent",
|
|
"description": "Bytes sent back to each agent in the range, most first.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (agent) sum(bytes) as bytes | sort by (bytes) desc | limit 15",
|
|
"queryType": "stats",
|
|
"legendFormat": "{{agent}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "bargauge",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"displayMode": "basic",
|
|
"orientation": "horizontal",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"showUnfilled": true,
|
|
"valueMode": "text"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bytes",
|
|
"decimals": 0,
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"value": null,
|
|
"color": "blue"
|
|
}
|
|
]
|
|
},
|
|
"color": {
|
|
"mode": "fixed",
|
|
"fixedColor": "blue"
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-10": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 10,
|
|
"title": "Top destinations",
|
|
"description": "Hosts agents reached, with requests, bytes and distinct agents.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | stats by (dest) count() as requests, sum(bytes) as bytes, count_uniq(agent) as agents | sort by (requests) desc | limit 25",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"kind": "joinByLabels",
|
|
"spec": {
|
|
"id": "joinByLabels",
|
|
"options": {
|
|
"join": ["dest"],
|
|
"value": "__name__"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "organize",
|
|
"spec": {
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"renameByName": {
|
|
"dest": "Host",
|
|
"requests": "Requests",
|
|
"bytes": "Bytes",
|
|
"agents": "Agents"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "table",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "Requests",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-11": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 11,
|
|
"title": "Refused (403)",
|
|
"description": "Requests the proxy refused: a destination that is not allowed.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count() as refused",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-12": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 12,
|
|
"title": "Agents refused",
|
|
"description": "Distinct agents with at least one refused request in the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats count_uniq(agent) as agents",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-13": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 13,
|
|
"title": "Refused hosts by agent",
|
|
"description": "Each host an agent was refused, with its request count.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent, dest) count() as requests | sort by (requests) desc",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"kind": "joinByLabels",
|
|
"spec": {
|
|
"id": "joinByLabels",
|
|
"options": {
|
|
"join": ["agent", "dest"],
|
|
"value": "__name__"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "organize",
|
|
"spec": {
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"renameByName": {
|
|
"agent": "Agent",
|
|
"dest": "Host",
|
|
"requests": "Requests"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "table",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "Requests",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-14": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 14,
|
|
"title": "Refused requests over time",
|
|
"description": "Refused requests per agent over the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403 | stats by (agent) count() as requests",
|
|
"queryType": "statsRange",
|
|
"legendFormat": "{{agent}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "timeseries",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"drawStyle": "bars",
|
|
"lineWidth": 1,
|
|
"fillOpacity": 60,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"axisSoftMin": 0
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-15": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 15,
|
|
"title": "Recent refused requests",
|
|
"description": "The refused request lines themselves, newest first.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter status:403",
|
|
"queryType": "instant"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "logs",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"showTime": true,
|
|
"wrapLogMessage": true,
|
|
"prettifyLogMessage": false,
|
|
"enableLogDetails": true,
|
|
"sortOrder": "Descending",
|
|
"dedupStrategy": "none"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-16": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 16,
|
|
"title": "Would-deny requests",
|
|
"description": "Requests let through that restricted mode would have refused, in the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count() as requests",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "orange",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-17": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 17,
|
|
"title": "Agents logging",
|
|
"description": "Agents with at least one would-deny request in the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats count_uniq(agent) as agents",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "stat",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"justifyMode": "auto",
|
|
"reduceOptions": {
|
|
"calcs": ["lastNotNull"],
|
|
"fields": "",
|
|
"values": false
|
|
},
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "thresholds"
|
|
},
|
|
"thresholds": {
|
|
"mode": "absolute",
|
|
"steps": [
|
|
{
|
|
"color": "green",
|
|
"value": null
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-18": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 18,
|
|
"title": "Hosts by agent",
|
|
"description": "Each host an agent reached that restricted mode would refuse, with its request count.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats by (agent, dest, port) count() as requests | sort by (requests) desc",
|
|
"queryType": "stats"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [
|
|
{
|
|
"kind": "joinByLabels",
|
|
"spec": {
|
|
"id": "joinByLabels",
|
|
"options": {
|
|
"join": ["agent", "dest", "port"],
|
|
"value": "__name__"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "organize",
|
|
"spec": {
|
|
"id": "organize",
|
|
"options": {
|
|
"excludeByName": {
|
|
"Time": true
|
|
},
|
|
"renameByName": {
|
|
"agent": "Agent",
|
|
"dest": "Host",
|
|
"port": "Port",
|
|
"requests": "Requests"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "table",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"showHeader": true,
|
|
"sortBy": [
|
|
{
|
|
"displayName": "Requests",
|
|
"desc": true
|
|
}
|
|
]
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-19": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 19,
|
|
"title": "Would-deny requests over time",
|
|
"description": "Would-deny requests per agent over the range.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain | stats by (agent) count() as requests",
|
|
"queryType": "statsRange",
|
|
"legendFormat": "{{agent}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "timeseries",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"decimals": 0,
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"drawStyle": "bars",
|
|
"lineWidth": 1,
|
|
"fillOpacity": 60,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"axisSoftMin": 0
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-20": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 20,
|
|
"title": "Recent would-deny requests",
|
|
"description": "The would-deny lines themselves, newest first.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"would_deny user=\" | extract \"would_deny user=<agent> method=<method> host=<dest> port=<port> result=<result>\" | filter agent:$agent | filter dest:$domain",
|
|
"queryType": "instant"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "logs",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"showTime": true,
|
|
"wrapLogMessage": true,
|
|
"prettifyLogMessage": false,
|
|
"enableLogDetails": true,
|
|
"sortOrder": "Descending",
|
|
"dedupStrategy": "none"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"panel-21": {
|
|
"kind": "Panel",
|
|
"spec": {
|
|
"id": 21,
|
|
"title": "Data transferred by domain over time",
|
|
"description": "Bytes per top-10 domain, rest as other, in 5 minute bars. A tunnel counts when it closes.",
|
|
"links": [],
|
|
"data": {
|
|
"kind": "QueryGroup",
|
|
"spec": {
|
|
"queries": [
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats by (dest) sum(bytes) as bytes",
|
|
"queryType": "statsRange",
|
|
"legendFormat": "{{dest}}"
|
|
}
|
|
},
|
|
"refId": "A",
|
|
"hidden": false
|
|
}
|
|
},
|
|
{
|
|
"kind": "PanelQuery",
|
|
"spec": {
|
|
"query": {
|
|
"kind": "DataQuery",
|
|
"group": "victoriametrics-logs-datasource",
|
|
"version": "v0",
|
|
"datasource": {
|
|
"name": "@logsDatasourceUid@"
|
|
},
|
|
"spec": {
|
|
"expr": "_SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | filter dest:$domain | filter dest:!in(_time:$__range _SYSTEMD_UNIT:\"squid.service\" \"TCP_\"* !\"would_deny user=\" | extract_regexp \"(?P<result>TCP_[A-Z_]+)/(?P<status>[0-9]{3}) (?P<bytes>[0-9]+) (?P<method>[A-Z]+) (?P<url>\\\\S+) (?P<agent>\\\\S+)\" | extract_regexp \"^(?:[a-z]+://)?(?P<dest>[^/:]+)\" from url | filter agent:$agent | stats by (dest) sum(bytes) as b | sort by (b) desc | limit 10 | fields dest) | stats sum(bytes) as bytes",
|
|
"queryType": "statsRange",
|
|
"legendFormat": "other"
|
|
}
|
|
},
|
|
"refId": "B",
|
|
"hidden": false
|
|
}
|
|
}
|
|
],
|
|
"transformations": [],
|
|
"queryOptions": {
|
|
"interval": "5m"
|
|
}
|
|
}
|
|
},
|
|
"vizConfig": {
|
|
"kind": "VizConfig",
|
|
"group": "timeseries",
|
|
"version": "",
|
|
"spec": {
|
|
"options": {
|
|
"legend": {
|
|
"displayMode": "list",
|
|
"placement": "bottom",
|
|
"showLegend": true
|
|
},
|
|
"tooltip": {
|
|
"mode": "multi",
|
|
"sort": "desc"
|
|
}
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "bytes",
|
|
"color": {
|
|
"mode": "palette-classic"
|
|
},
|
|
"custom": {
|
|
"drawStyle": "bars",
|
|
"lineWidth": 1,
|
|
"fillOpacity": 60,
|
|
"showPoints": "never",
|
|
"spanNulls": false,
|
|
"axisSoftMin": 0
|
|
}
|
|
},
|
|
"overrides": []
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"layout": {
|
|
"kind": "TabsLayout",
|
|
"spec": {
|
|
"tabs": [
|
|
{
|
|
"kind": "TabsLayoutTab",
|
|
"spec": {
|
|
"title": "overview",
|
|
"layout": {
|
|
"kind": "GridLayout",
|
|
"spec": {
|
|
"items": [
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-1"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 4,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-2"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 8,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-3"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 12,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-4"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 16,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-5"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 20,
|
|
"y": 0,
|
|
"width": 4,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-6"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 4,
|
|
"width": 24,
|
|
"height": 8,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-7"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 12,
|
|
"width": 12,
|
|
"height": 9,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-8"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 12,
|
|
"y": 12,
|
|
"width": 12,
|
|
"height": 9,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-9"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 21,
|
|
"width": 24,
|
|
"height": 9,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-21"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 30,
|
|
"width": 24,
|
|
"height": 12,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-10"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "TabsLayoutTab",
|
|
"spec": {
|
|
"title": "refused",
|
|
"layout": {
|
|
"kind": "GridLayout",
|
|
"spec": {
|
|
"items": [
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"width": 12,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-11"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 12,
|
|
"y": 0,
|
|
"width": 12,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-12"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 4,
|
|
"width": 24,
|
|
"height": 12,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-13"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 16,
|
|
"width": 24,
|
|
"height": 8,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-14"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 24,
|
|
"width": 24,
|
|
"height": 10,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-15"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "TabsLayoutTab",
|
|
"spec": {
|
|
"title": "would-deny",
|
|
"layout": {
|
|
"kind": "GridLayout",
|
|
"spec": {
|
|
"items": [
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 0,
|
|
"width": 12,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-16"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 12,
|
|
"y": 0,
|
|
"width": 12,
|
|
"height": 4,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-17"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 4,
|
|
"width": 24,
|
|
"height": 12,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-18"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 16,
|
|
"width": 24,
|
|
"height": 8,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-19"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"kind": "GridLayoutItem",
|
|
"spec": {
|
|
"x": 0,
|
|
"y": 24,
|
|
"width": 24,
|
|
"height": 10,
|
|
"element": {
|
|
"kind": "ElementReference",
|
|
"name": "panel-20"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|