Cloudflare Exporter for Prometheus

A very simple Prometheus exporter that exposes metrics from Cloudflare's colocations API as described in the API documentation. Sadly, this is for Cloudflare Enterprise customers only. It'll expose metrics per PoP and shows requests, bandwidth and threats.

Please note that because of how the Cloudflare API works this exporter will only return statistics from now() - 5 minutes.

In addition, the exporter will also fetch DNS analytics. Exporting metrics per records queried at edge resolvers per PoP.

The following roles are required:

Analytics Administrator
Firewall Administrator

Try it

Running the container:

docker run \
 -d \
 -p 9199:9199 \
 -e ZONE=example.com \
 -e AUTH_KEY=deadbeefcafe \
 -e AUTH_EMAIL=admin@example.com \
 wehkamp/prometheus-cloudflare-exporter:1.0

Or if using API Token:

docker run \
 -d \
 -p 9199:9199 \
 -e ZONE=example.com \
 -e AUTH_TOKEN=example-token_1234 \
 wehkamp/prometheus-cloudflare-exporter:1.0

Metrics

The exporter exposes the following metrics, all returned per PoP:

Name	Description	Type
`cloudflare_pop_received_requests`	cached and uncached requests received on an edge-location	gauge
`cloudflare_pop_bandwidth_bytes`	cached and uncached bandwidth sent from an edge-location	gauge
`cloudflare_pop_http_responses_sent`	breakdown of requests per HTTP code	gauge
`cloudflare_pop_threats_seen`	number of threats identified received in at this location	gauge
`cloudflare_pop_threat_types`	types of threats seen	gauge
`cloudflare_pop_threat_countries`	countries causing threats	gauge
`cloudflare_dns_record_queries`	DNS record queries per edge-location	gauge
`cloudflare_waf_uri_hits`	WAF-rule hits at PoP location per uri	gauge
`cloudflare_waf_rules`	WAF-rules in the system and a hit count	gauge

Random scrape result:

# HELP cloudflare_pop_http_responses_sent Breakdown per HTTP response code.
# TYPE cloudflare_pop_http_responses_sent gauge
cloudflare_pop_http_responses_sent{colo_id="BRU",http_status="200",zone="example.com"} 25.0
cloudflare_pop_http_responses_sent{colo_id="BRU",http_status="302",zone="example.com"} 1.0
cloudflare_pop_http_responses_sent{colo_id="BRU",http_status="204",zone="example.com"} 2.0
# HELP cloudflare_pop_threat_countries Threat breakdown per threat country.
# TYPE cloudflare_pop_threat_countries gauge
# HELP cloudflare_pop_threat_types Threat breakdown per threat type.
# TYPE cloudflare_pop_threat_types gauge
# HELP cloudflare_pop_threats_seen Threats identified.
# TYPE cloudflare_pop_threats_seen gauge
cloudflare_pop_threats_seen{colo_id="BRU",zone="example.com"} 0.0
# HELP cloudflare_pop_bandwidth_bytes Bandwidth sent from this PoP location.
# TYPE cloudflare_pop_bandwidth_bytes gauge
cloudflare_pop_bandwidth_bytes{colo_id="BRU",type="cached",zone="example.com"} 404362.0
cloudflare_pop_bandwidth_bytes{colo_id="BRU",type="uncached",zone="example.com"} 68411.0
# HELP cloudflare_pop_received_requests Requests received at this PoP location.
# TYPE cloudflare_pop_received_requests gauge
cloudflare_pop_received_requests{colo_id="BRU",type="cached",zone="example.com"} 10.0
cloudflare_pop_received_requests{colo_id="BRU",type="uncached",zone="example.com"} 18.0
# HELP cloudflare_dns_record_queries DNS queries per record at PoP location.
# TYPE cloudflare_dns_record_queries gauge
cloudflare_dns_record_queries{colo_id="SOF",query_response="NXDOMAIN",record_name="qlgijqgzsd.example.com",record_type="A",zone="example.com"} 1.0
cloudflare_dns_record_queries{colo_id="LAX",query_response="NOERROR",record_name="www.example.com",record_type="A",zone="example.com"} 5.0
# HELP cloudflare_waf_rules WAF-rules in the system and a hit count.
# TYPE cloudflare_waf_rules counter
cloudflare_waf_rules{rule_id="unknown",rule_message="internal"} 9.0
# HELP cloudflare_waf_uri_hits WAF-rule hits at PoP location per uri.
# TYPE cloudflare_waf_uri_hits gauge
cloudflare_waf_uri_hits{action="block",attacking_country="T1",colo_id="OSL",host="www.example.com",method="GET",protocol="HTTP/1.1",rule_id="unknown",uri="/"} 9.0

WAF Analytics

Cloudflare consideres the WAF analytics API experimental. The exporter currently supports dropping incoming T1 traffic (attacks) from the metrics, this can be enabled by setting the following in your environment: SCRAPER_SKIP_T1=true

Dashboard

A sample Grafana dashboard is included to visualize the information.

Overview of requests, cached and uncached:

Overview of requests served per Cloudflare network point-of-presence:

Overview of actual countries that cause threats:

Todo

Implement a way to store datapoints in Prometheus using timestamps received from Cloudflare. This should remove the delay as we currently have it.

License

wehkamp/docker-prometheus-cloudflare-exporter

ErrorLooks like something went wrong!

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Contributors 8

Languages

Error
Looks like something went wrong!

Packages