Metrics & Logging

Overview

coreX Manager provides real-time metrics dashboards and configurable logging for HAProxy, WAF, and cache subsystems. All metrics are sampled periodically and stored in the database for historical analysis.

HAProxy Metrics

HAProxy process info and stats are sampled every 30 seconds and stored in MetricSnapshot records.

Configuration

Setting	Default	Description
METRICS_SAMPLE_INTERVAL_SECONDS	30	How often to sample metrics
METRICS_RETENTION_DAYS	30	How long to retain metric data
HAPROXY_MAXCONN	4096	HAProxy max connections

API

GET /metrics?from=<timestamp>&to=<timestamp>&step=<seconds>

Frontend

The metrics dashboard renders:

• Recharts line and area charts for traffic, connections, and response times
• Server status table with up/down state and connection counts
• Time range selector (1h, 6h, 24h, 7d, custom)

WAF Metrics

WAF events are logged by Coraza SPOA and sampled into the WafMetric table.

Configuration

Setting	Default	Description
CORAZA_SPOA_LOG_PATH	/app/data/coraza-spoa.log	Path to the Coraza SPOA log
WAF_METRICS_SAMPLE_INTERVAL_SECONDS	30	How often to sample WAF events
WAF_METRICS_RETENTION_DAYS	30	How long to retain WAF metric data

API

GET /waf/metrics?from=<timestamp>&to=<timestamp>&step=<seconds>&breakdown=<field>

Breakdowns: action, rule_id, severity, msg

Frontend

The WAF metrics panel shows:

• Stacked bar chart of WAF events over time
• Totals table with counts per breakdown category
• Dropdown to switch between breakdown dimensions

Cache Metrics

Cache metrics are sampled every 30 seconds:

• Hit rate
• Number of cached objects
• Total bytes cached

API

GET /cache/metrics?from=<timestamp>&to=<timestamp>&step=<seconds>

JSON Access Logs

coreX Manager captures structured JSON access logs with the following fields:

Field	Description
frontend	HAProxy frontend name
backend	HAProxy backend name
server	Upstream server name
client_ip	Client IP address
method	HTTP method
uri	Request URI
status	HTTP status code
bytes	Response bytes
timing	Request timing (Tq, Tw, Tc, Tr, Tt)
termination	HAProxy termination state
risk_score	Risk score (0-99)
risk_rules_hit	Matched risk rule names
rate_limit_action	Rate limit action taken
waf_action	WAF action taken
waf_anomaly_score	WAF anomaly score
security_rule_action	Security rule action taken

The access logs page shows expandable rows with full details and inline search filtering.

Log Destinations

Configure where logs are sent:

Destination	Description
File	Write to a local file
Syslog	Send to a syslog server
HTTP	POST to an HTTP endpoint

Each destination can have its own format configuration.

Logged Fields

Select which fields are included in the log format. This lets you reduce log volume by omitting fields you don’t need, or include additional fields for debugging.

Step-by-Step: View the Metrics Dashboard

1. Navigate to Observability > Metrics
2. Select a time range (1h, 6h, 24h, 7d, or custom)
3. View the HAProxy metrics charts:
   • Requests per second
   • Active connections
   • Response time percentiles
   • Server status table
4. Switch to the WAF tab to view WAF event metrics
5. Switch to the Cache tab to view cache hit rates

Step-by-Step: Configure a Log Destination

1. Navigate to Observability > Log Destinations
2. Click Add Destination
3. Type: Syslog
4. Host: syslog.example.com
5. Port: 514
6. Facility: local0
7. Select the fields to include
8. Save and Apply

Step-by-Step: Review Access Logs

1. Navigate to Observability > Access Logs
2. Use the search bar to filter by any field (e.g. status:403, client_ip:1.2.3.4)
3. Click a row to expand it and see full details
4. Look for:
   • risk_score to see risk scoring in action
   • waf_action to see WAF blocks
   • security_rule_action to see security rule matches
   • rate_limit_action to see rate-limited requests

Verification

1. Check metrics are being sampled:

   curl -k https://localhost/api/metrics?step=30 | python3 -m json.tool | head

   Expect JSON with recent metric data.

2. Check WAF metrics:

   curl -k "https://localhost/api/waf/metrics?breakdown=action" | python3 -m json.tool | head

3. Generate test traffic and check logs:

   for i in $(seq 1 100); do curl -k -s -o /dev/null https://localhost/; done

   Then check the access logs page for the 100 requests.

4. Verify log destination:

   • If using syslog, check the syslog server for incoming messages
   • If using HTTP, check the endpoint for POST requests
   • If using file, check the configured file path

Next Steps

• Audit & Snapshots — Track config changes and revert
• WAF — Configure WAF rules that generate WAF events
• Risk Scoring — Score requests and view scores in logs