HashiCorp Vault — Telemetry

1 minute read

Vault exposes detailed operational metrics via telemetry — request rates, latency, token counts, storage operations, and more.

Telemetry Backends

Backend Configuration Use Case
Prometheus /v1/sys/metrics endpoint Pull-based monitoring
StatsD Push to StatsD server General monitoring
DogStatsD Push to Datadog agent Datadog integration
Stackdriver Push to GCP Google Cloud monitoring

Enable Prometheus Metrics

# vault.hcl

telemetry {
  # Prometheus metrics endpoint
  prometheus_retention_time = "30s"
  disable_hostname          = true

  # Optional: also send to StatsD
  # statsd_address = "statsd.internal:8125"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true

  # Enable unauthenticated metrics endpoint
  telemetry {
    unauthenticated_metrics_access = true
  }
}

Access Metrics

# Unauthenticated (if enabled)
curl -s "$VAULT_ADDR/v1/sys/metrics?format=prometheus"

# Authenticated
curl -s -H "X-Vault-Token: $VAULT_TOKEN" \
    "$VAULT_ADDR/v1/sys/metrics?format=prometheus"

Key Metrics

Request Metrics

Metric Description
vault.core.handle_request.count Total API requests
vault.core.handle_request.duration Request latency
vault.audit.log_request.count Audit log writes
vault.audit.log_response.count Audit log responses

Token Metrics

Metric Description
vault.token.create.count Tokens created
vault.token.revoke.count Tokens revoked
vault.token.lookup.count Token lookups

Auth Metrics

Metric Description
vault.core.handle_login_request.count Login attempts
vault.core.handle_login_request.duration Login latency

Storage Metrics

Metric Description
vault.raft.commitTime Raft commit latency
vault.raft.leader.lastContact Time since follower heard from leader
vault.raft.applied_index Last applied Raft log index

Secrets Engine Metrics

Metric Description
vault.secret.kv.count KV secret count
vault.database.*.create Dynamic credential generation
vault.pki.sign.count Certificates issued

StatsD Configuration

telemetry {
  statsd_address = "statsd.internal:8125"
  
  # Prefix all metrics
  metrics_prefix = "vault"
}

DogStatsD (Datadog)

telemetry {
  dogstatsd_addr = "127.0.0.1:8125"
  dogstatsd_tags = [
    "env:production",
    "service:vault",
    "cluster:us-east"
  ]
}

Sample Prometheus Output

# HELP vault_core_handle_request Request handling time
# TYPE vault_core_handle_request summary
vault_core_handle_request{quantile="0.5"} 0.002
vault_core_handle_request{quantile="0.9"} 0.005
vault_core_handle_request{quantile="0.99"} 0.015
vault_core_handle_request_count 15423

# HELP vault_token_count Current number of tokens
# TYPE vault_token_count gauge
vault_token_count 234

# HELP vault_raft_leader_lastContact Last contact from leader
# TYPE vault_raft_leader_lastContact gauge
vault_raft_leader_lastContact 0.05

Quick Reference

Config Purpose
prometheus_retention_time How long to keep metrics in memory
disable_hostname Remove hostname from metric names
unauthenticated_metrics_access Allow metrics without auth
statsd_address StatsD server address
dogstatsd_addr Datadog agent address

Next: Prometheus & Grafana

You may also enjoy