# Wallarm Node Statistics Service

Wallarm provides the service for retrieving NGINX Node statistics for direct inspection and troubleshooting. The service exposes traffic, request processing, and attack detection statistics through the `/wallarm-status` endpoint.

Use `/wallarm-status` for direct inspection and troubleshooting. For continuous monitoring, Wallarm provides an [aggregated Prometheus metrics endpoint (`http://127.0.0.1:9445/metrics`)](https://docs.wallarm.com/7.x/admin-en/nginx-node-metrics.md) which is designed to be scraped by monitoring systems and exposes traffic counters together with component and process metrics.

!!! info "Native Node statistics service"
    For [Native](https://docs.wallarm.com/7.x/installation/nginx-native-node-internals.md#native-node) nodes, the statistics service is available for compatibility but is considered a legacy interface. The primary interface is the [`metrics` service available at `localhost:9000/metrics`](https://docs.wallarm.com/7.x/admin-en/native-node-metrics.md).

## Setup

By default, the statistics service is exposed through the `/wallarm-status` endpoint. The endpoint location depends on the deployment option:

**All-in-one installer, AWS or GCP machine image:**

```
http://127.0.0.8/wallarm-status
```

**NGINX-based Docker image:**

By default, the endpoint is accessible only from **inside the container** at:

```
http://127.0.0.8/wallarm-status
``` 

To access it from **outside the container**:

1. Set the `WALLARM_STATUS_ALLOW` environment variable to the CIDR or CIDRs that are allowed to access the endpoint. Separate multiple CIDRs with commas, for example:

    ```bash
    WALLARM_STATUS_ALLOW="10.0.0.0/8,192.168.0.0/16"
    ```

1. Send the request to the container IP and append the `/wallarm-status` path.

The endpoint runs on the same internal port as NGINX. The port is controlled by the `NGINX_PORT` environment variable and defaults to `80`:

```bash
NGINX_PORT="443"
```

For example, if `NGINX_PORT` is set to `443`, retrieve statistics from:

```bash
curl http://<CONTAINER_IP>:443/wallarm-status
```

When the endpoint is requested from outside the container, it returns statistics in the Prometheus format by default.

**Ingress Controller:**

The endpoint is available only internally on `controller.nginxStatus.port` (default: `10246`) and is restricted to loopback access.

## Configuring the statistics service

### Default configuration

The filtering node statistics service configuration is described in the `/etc/nginx/conf.d/wallarm-status.conf` (`/etc/nginx/wallarm-status.conf` for all-in-one installer) file.

The default configuration file looks like the following:

```
server {
  listen 127.0.0.8:80;
  server_name localhost;

  allow 127.0.0.8/8;   # Access is only available for loopback addresses of the filtering node server
  # If running the NGINX-based Docker container:
  # allow 127.0.0.0/8;
  deny all;

  wallarm_mode off;
  disable_acl "on";   # Checking request sources is disabled, denylisted IPs are allowed to request the wallarm-status service. https://docs.wallarm.com/admin-en/configure-parameters-en/#disable_acl
  wallarm_enable_apifw off;
  access_log off;

  location /wallarm-status {
    wallarm_status on;
  }
}
```

!!! warning "Keep the default `wallarm-status` configuration"

    The default configuration is designed to expose the statistics endpoint securely. Unless instructed otherwise, keep the existing configuration unchanged.

    If you need to customize the statistics service, make the changes in its dedicated configuration file `wallarm-status.conf` rather than adding the `wallarm_status` directive to other NGINX configuration files.

### `wallarm_status` directive

The `wallarm_status` NGINX directive accepts the following value format:

```
wallarm_status [on|off] [format=json|prometheus];
```

* `on` | `off` is whether the service activated. For corrent Node operation, it should be `on`.
* `format` defines the statistics format, can be:

    * `json` (default for all deployment options except for NGINX-based Docker image)
    * `prometheus` (default for NGINX-based Docker image when the service is called outside the container)

    !!! warning "Changing the default response format"
        Wallarm recommends keeping the default response format unchanged.
        
        To expose statistics in the Prometheus format, configure a dedicated Prometheus endpoint or override the format for individual requests using the `format` query parameter. See [Getting statistics in the Prometheus format](#getting-statistics-in-the-prometheus-format).

### Limiting IP addresses allowed to request statistics

When configuring the `wallarm_status` directive, you can specify the IP addresses from which you can request statistics. By default, access is denied from anywhere except for the IP addresses `127.0.0.1` and `::1`, which allow executing the request only from the server where Wallarm is installed.

To allow requests from another server:

**All-in-one installer:**

1. In the `/etc/nginx/wallarm-status.conf` file, add the `allow` instruction with the IP address of the desired server in the configuration. For example:

    ```diff
    ...
    server_name localhost;

    allow 127.0.0.8/8;
    + allow 10.41.29.0;
    ...
    ```
1. Once the settings changed, restart NGINX to apply the changes:

    **Debian:**

    ```bash
    sudo systemctl restart nginx
    ```

    **Ubuntu:**

    ```bash
    sudo service nginx restart
    ```

    **CentOS or Amazon Linux 2.0.2021x and lower:**

    ```bash
    sudo systemctl restart nginx
    ```

    **AlmaLinux, Rocky Linux or Oracle Linux 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

    **RHEL 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

**Docker image:**

* If running the Docker container [passing the environment variables only](https://docs.wallarm.com/7.x/admin-en/installation-docker-en.md#run-the-container-passing-the-environment-variables), pass allowed CIDRs in the `WALLARM_STATUS_ALLOW` environment variable.
* If running the Docker container [mounting configuration files](https://docs.wallarm.com/7.x/admin-en/installation-docker-en.md#run-the-container-mounting-the-configuration-file):

    1. Prepare the `wallarm-status.conf` file with allowed addresses specified in the `allow` directive, e.g.:

        ```diff
        server {
            listen 127.0.0.8:80;

            server_name localhost;

            allow 127.0.0.0/8;
        +    allow 10.41.29.0;
            deny all;

            wallarm_mode off;
            disable_acl "on";
            wallarm_enable_apifw off;
            access_log off;

            location ~/wallarm-status$ {
                wallarm_status on;
            }
        }
        ```

    1. Mount the prepared file to `/etc/nginx/conf.d/wallarm-status.conf` inside the container while running it.

**AWS or GCP machine image:**

1. In the `/etc/nginx/conf.d/wallarm-status.conf` file, add the `allow` instruction with the IP address of the desired server in the configuration. For example:

    ```diff
    ...
    server_name localhost;

    allow 127.0.0.8/8;
    + allow 10.41.29.0;
    ...
    ```
1. Once the settings changed, restart NGINX to apply the changes:

    **Debian:**

    ```bash
    sudo systemctl restart nginx
    ```

    **Ubuntu:**

    ```bash
    sudo service nginx restart
    ```

    **CentOS or Amazon Linux 2.0.2021x and lower:**

    ```bash
    sudo systemctl restart nginx
    ```

    **AlmaLinux, Rocky Linux or Oracle Linux 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

    **RHEL 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```
### Changing an IP address and/or port of the statistics service

To change an IP address and/or port of the statistics service, follow the instructions below.

**All-in-one installer:**

1. Open the `/etc/nginx/wallarm-status.conf` file and specify a new service address in the `listen` directive.
1. Restart NGINX to apply changes:

    **Debian:**

    ```bash
    sudo systemctl restart nginx
    ```

    **Ubuntu:**

    ```bash
    sudo service nginx restart
    ```

    **CentOS or Amazon Linux 2.0.2021x and lower:**

    ```bash
    sudo systemctl restart nginx
    ```

    **AlmaLinux, Rocky Linux or Oracle Linux 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

    **RHEL 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

**Docker image:**

* To change only the default port of the statistics service on an [NGINX-based Docker image](https://docs.wallarm.com/7.x/admin-en/installation-docker-en.md), start the container with the `NGINX_PORT` variable set to the new port. No other changes are required.
* To change both an IP address and port of the statistics service:

    1. Prepare the `wallarm-status.conf` file with the new address specified in the `listen` directive:

        ```
        server {
            listen 127.0.0.8:80;

            server_name localhost;

            allow 127.0.0.8/8;
            # If running the NGINX-based Docker container:
            # allow 127.0.0.0/8;
            deny all;

            wallarm_mode off;
            disable_acl "on";
            wallarm_enable_apifw off;
            access_log off;

            location ~/wallarm-status$ {
                wallarm_status on;
            }
        }
        ```

    1. Mount the prepared file to `/etc/nginx/conf.d/wallarm-status.conf` inside the container while running it.

**AWS or GCP machine image:**

1. Open the `/etc/nginx/conf.d/wallarm-status.conf` file and specify a new service address in the `listen` directive.
1. Restart NGINX to apply changes:

    **Debian:**

    ```bash
    sudo systemctl restart nginx
    ```

    **Ubuntu:**

    ```bash
    sudo service nginx restart
    ```

    **CentOS or Amazon Linux 2.0.2021x and lower:**

    ```bash
    sudo systemctl restart nginx
    ```

    **AlmaLinux, Rocky Linux or Oracle Linux 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

    **RHEL 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```
### Getting statistics in the Prometheus format

Most deployment options return statistics in JSON format by default. The NGINX-based Docker image is an exception; when the `/wallarm-status` endpoint is called from outside the container, it returns metrics in the Prometheus format.

To obtain statistics in the Prometheus format from node deployment options that default to JSON:

**Using a query parameter:**

Starting from NGINX Node 6.12.0, you can override the configured format at request time by appending a `?format=json` or `?format=prometheus` query parameter, e.g.:

```
curl http://127.0.0.8/wallarm-status?format=prometheus
```

**Creating a dedicated Prometheus endpoint:**

1. Add the following configuration to the `/etc/nginx/conf.d/wallarm-status.conf` file (`/etc/nginx/wallarm-status.conf` for all-in-one installer):

    ```diff
    ...

    location /wallarm-status {
      wallarm_status on;
    }

    + location /wallarm-status-prometheus {
    +   wallarm_status on format=prometheus;
    + }

    ...
    ```

    !!! warning "Do not delete or change the default `/wallarm-status` configuration"
        Do not delete or change the default configuration of the `/wallarm-status` location. Default operation of this endpoint is crucial.
1. Restart NGINX to apply changes:

    **Debian:**

    ```bash
    sudo systemctl restart nginx
    ```

    **Ubuntu:**

    ```bash
    sudo service nginx restart
    ```

    **CentOS or Amazon Linux 2.0.2021x and lower:**

    ```bash
    sudo systemctl restart nginx
    ```

    **AlmaLinux, Rocky Linux or Oracle Linux 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```

    **RHEL 8.x:**

    ```bash
    sudo systemctl restart nginx
    ```
1. Call the new endpoint to get the Prometheus metrics:

    ```bash
    curl http://127.0.0.8/wallarm-status-prometheus
    ```

##  Usage

To obtain the filtering node statistics, make a request from one of the allowed IP addresses (see above):

**Statistics in the JSON format:**

```
curl http://127.0.0.8/wallarm-status
```

As a result, you will get a response of the type:

```json
{
    "requests": 0,
    "streams": 0,
    "messages": 0,
    "attacks": 0,
    "blocked": 0,
    "blocked_by_acl": 0,
    "blocked_by_antibot": 0,
    "acl_allow_list": 0,
    "bytes_in": 0,
    "bytes_out": 0,
    "bytes_blocked_in": 0,
    "bytes_blocked_out": 0,
    "bytes_blocked_by_acl_in": 0,
    "bytes_blocked_by_acl_out": 0,
    "tnt_errors": 0,
    "api_errors": 0,
    "requests_lost": 0,
    "overlimits_time": 0,
    "segfaults": 0,
    "memfaults": 0,
    "softmemfaults": 0,
    "proton_errors": 0,
    "time_detect": 0,
    "db_id": 73,
    "lom_id": 102,
    "custom_ruleset_id": 102,
    "custom_ruleset_ver": 51,
    "db_apply_time": 1598525865,
    "lom_apply_time": 1598525870,
    "custom_ruleset_apply_time": 1598525870,
    "proton_instances": {
        "total": 3,
        "success": 3,
        "fallback": 0,
        "failed": 0
    },
    "stalled_workers_count": 0,
    "stalled_workers": [],
    "ts_files": [
        {
        "id": 102,
        "size": 12624136,
        "mod_time": 1598525870,
        "fname": "/etc/wallarm/custom_ruleset"
        }
    ],
    "db_files": [
        {
        "id": 73,
        "size": 139094,
        "mod_time": 1598525865,
        "fname": "/etc/wallarm/proton.db"
        }
    ],
    "startid": 5846473569700248000,
    "compatibility": 4,
    "config_revision": 0,
    "rate_limit": {
        "shm_zone_size": 67108864,
        "buckets_count": 2,
        "entries": 0,
        "delayed": 0,
        "exceeded": 0,
        "expired": 0,
        "removed": 0,
        "no_free_nodes": 0
    },
    "timestamp": 1765271459.974994,
    "split": {
        "clients": [
        {
            "client_id": null,
            "requests": 78,
            "streams": 0,
            "messages": 0,
            "attacks": 0,
            "blocked": 0,
            "blocked_by_acl": 0,
            "bytes_in": 0,
            "bytes_out": 0,
            "bytes_blocked_in": 0,
            "bytes_blocked_out": 0,
            "bytes_blocked_by_acl_in": 0,
            "bytes_blocked_by_acl_out": 0,
            "overlimits_time": 0,
            "time_detect": 0,
            "applications": [
            {
                "app_id": 4,
                "requests": 78,
                "streams": 0,
                "messages": 0,
                "attacks": 0,
                "blocked": 0,
                "blocked_by_acl": 0,
                "bytes_in": 0,
                "bytes_out": 0,
                "bytes_blocked_in": 0,
                "bytes_blocked_out": 0,
                "bytes_blocked_by_acl_in": 0,
                "bytes_blocked_by_acl_out": 0,
                "overlimits_time": 0,
                "time_detect": 0
            }
            ]
        }
        ]
    }
}
```

**Statistics in the Prometheus format:**

Using the `format` query parameter (for NGINX Node 6.12.0 and above):

```bash
curl "http://127.0.0.8/wallarm-status?format=prometheus"
```

Using a dedicated endpoint:

```
curl http://127.0.0.8/wallarm-status-prometheus
```

The address can be different, please check the `/etc/nginx/conf.d/wallarm-status.conf` file (`/etc/nginx/wallarm-status.conf` for all-in-one installer) for the actual address.

As a result, you will get a response of the type:

```
# HELP wallarm_requests requests count
# TYPE wallarm_requests gauge
wallarm_requests 187
# HELP wallarm_streams requests count
# TYPE wallarm_streams gauge
wallarm_streams 0
# HELP wallarm_messages requests count
# TYPE wallarm_messages gauge
wallarm_messages 0
# HELP wallarm_attacks attack requests count
# TYPE wallarm_attacks gauge
wallarm_attacks 49
# HELP wallarm_blocked blocked requests count
# TYPE wallarm_blocked gauge
wallarm_blocked 70
# HELP wallarm_blocked_by_acl blocked by acl requests count
# TYPE wallarm_blocked_by_acl gauge
wallarm_blocked_by_acl 33
# HELP wallarm_blocked_by_antibot blocked by Wallarm Antibot requests count
# TYPE wallarm_blocked_by_antibot gauge
wallarm_blocked_by_antibot 0
# HELP wallarm_acl_allow_list requests passed by allow list
# TYPE wallarm_acl_allow_list gauge
wallarm_acl_allow_list 0
# HELP wallarm_bytes_in total bytes received on listen servers
# TYPE wallarm_bytes_in gauge
wallarm_bytes_in 36157
# HELP wallarm_bytes_out total bytes sent from listen servers
# TYPE wallarm_bytes_out gauge
wallarm_bytes_out 123847
# HELP wallarm_bytes_blocked_in total bytes received in blocked requests
# TYPE wallarm_bytes_blocked_in counter
wallarm_bytes_blocked_in 0
# HELP wallarm_bytes_blocked_out total bytes sent in blocked responses
# TYPE wallarm_bytes_blocked_out counter
wallarm_bytes_blocked_out 0
# HELP wallarm_bytes_blocked_by_acl_in total bytes received in ACL-blocked requests
# TYPE wallarm_bytes_blocked_by_acl_in counter
wallarm_bytes_blocked_by_acl_in 0
# HELP wallarm_bytes_blocked_by_acl_out total bytes sent in ACL-blocked responses
# TYPE wallarm_bytes_blocked_by_acl_out counter
wallarm_bytes_blocked_by_acl_out 0
# HELP wallarm_tnt_errors wstore write errors count
# TYPE wallarm_tnt_errors gauge
wallarm_tnt_errors 0
# HELP wallarm_api_errors API write errors count
# TYPE wallarm_api_errors gauge
wallarm_api_errors 0
# HELP wallarm_requests_lost lost requests count
# TYPE wallarm_requests_lost gauge
wallarm_requests_lost 0
# HELP wallarm_overlimits_time overlimits_time count
# TYPE wallarm_overlimits_time gauge
wallarm_overlimits_time 0
# HELP wallarm_segfaults segmentation faults count
# TYPE wallarm_segfaults gauge
wallarm_segfaults 0
# HELP wallarm_memfaults vmem limit reached events count
# TYPE wallarm_memfaults gauge
wallarm_memfaults 0
# HELP wallarm_softmemfaults request memory limit reached events count
# TYPE wallarm_softmemfaults gauge
wallarm_softmemfaults 0
# HELP wallarm_proton_errors libproton non-memory related libproton faults events count
# TYPE wallarm_proton_errors gauge
wallarm_proton_errors 0
# HELP wallarm_time_detect_seconds time spent for detection
# TYPE wallarm_time_detect_seconds gauge
wallarm_time_detect_seconds 0
# HELP wallarm_db_id proton.db file id
# TYPE wallarm_db_id gauge
wallarm_db_id 267
# HELP wallarm_lom_id LOM file id
# TYPE wallarm_lom_id gauge
wallarm_lom_id 2006
# HELP wallarm_custom_ruleset_id Custom Ruleset file id
# TYPE wallarm_custom_ruleset_id gauge
wallarm_custom_ruleset_id{format="54"} 2006
# HELP wallarm_custom_ruleset_ver Custom Ruleset file format version
# TYPE wallarm_custom_ruleset_ver gauge
wallarm_custom_ruleset_ver 54
# HELP wallarm_db_apply_time proton.db file apply time id
# TYPE wallarm_db_apply_time gauge
wallarm_db_apply_time 1765269925
# HELP wallarm_lom_apply_time LOM file apply time
# TYPE wallarm_lom_apply_time gauge
wallarm_lom_apply_time 1765269925
# HELP wallarm_custom_ruleset_apply_time Custom Ruleset file apply time
# TYPE wallarm_custom_ruleset_apply_time gauge
wallarm_custom_ruleset_apply_time 1765269925
# HELP wallarm_proton_instances proton instances count
# TYPE wallarm_proton_instances gauge
wallarm_proton_instances{status="success"} 2
wallarm_proton_instances{status="fallback"} 0
wallarm_proton_instances{status="failed"} 0
# HELP wallarm_stalled_worker_time_seconds time a worker stalled in libproton
# TYPE wallarm_stalled_worker_time_seconds gauge
# HELP wallarm_startid unique start id
# TYPE wallarm_startid gauge
wallarm_startid 5846473569700247064
# HELP wallarm_compatibility unique start id
# TYPE wallarm_compatibility gauge
wallarm_compatibility 4
# HELP wallarm_config_revision config file revision number
# TYPE wallarm_config_revision gauge
wallarm_config_revision 0
# HELP wallarm_rate_limit_shm_zone_size shared memory size
# TYPE wallarm_rate_limit_shm_zone_size gauge
wallarm_rate_limit_shm_zone_size 67108864
# HELP wallarm_rate_limit_buckets_count buckets created
# TYPE wallarm_rate_limit_buckets_count gauge
wallarm_rate_limit_buckets_count 2
# HELP wallarm_rate_limit_entries number of tracked keys
# TYPE wallarm_rate_limit_entries gauge
wallarm_rate_limit_entries 0
# HELP wallarm_rate_limit_delayed delayed requests
# TYPE wallarm_rate_limit_delayed gauge
wallarm_rate_limit_delayed 0
# HELP wallarm_rate_limit_exceeded exceeded and rejected requests
# TYPE wallarm_rate_limit_exceeded gauge
wallarm_rate_limit_exceeded 0
# HELP wallarm_rate_limit_expired expired keys 
# TYPE wallarm_rate_limit_expired gauge
wallarm_rate_limit_expired 0
# HELP wallarm_rate_limit_removed total amount of removed keys
# TYPE wallarm_rate_limit_removed gauge
wallarm_rate_limit_removed 0
# HELP wallarm_rate_limit_no_free_nodes allocation fails
# TYPE wallarm_rate_limit_no_free_nodes gauge
wallarm_rate_limit_no_free_nodes 0
# HELP wallarm_apifw_subrequest_timeouts apifw subrequest timeouts count
# TYPE wallarm_apifw_subrequest_timeouts gauge
wallarm_apifw_subrequest_timeouts 0
```

The following response parameters are available (Prometheus metrics have the `wallarm_` prefix):

*   `requests`: the number of requests that have been processed by the filtering node.
*   `streams` (available starting from the Wallarm release 6.2.0): the number of processed gRPC/WebSocket streams.
*   `messages` (available starting from the Wallarm release 6.2.0): the number of processed gRPC/WebSocket messages.
*   `attacks`: the number of recorded attacks.
*   `blocked`: the number of blocked requests including those originated from [denylisted](https://docs.wallarm.com/7.x/user-guides/ip-lists/overview.md) IPs.
*   `blocked_by_acl`: the number of requests blocked due to [denylisted](https://docs.wallarm.com/7.x/user-guides/ip-lists/overview.md) request sources.
*   `blocked_by_antibot`: the number of requests blocked by the [API Abuse Prevention module](https://docs.wallarm.com/7.x/api-abuse-prevention/overview.md).
*   `acl_allow_list`: the number of requests originating from [allowlisted](https://docs.wallarm.com/7.x/user-guides/ip-lists/overview.md) request sources.
*   `bytes_in`: the total number of bytes received by listening servers from clients (browsers, API clients, load balancers, etc.) — incoming traffic. The metric is collected regardless of [`wallarm_mode`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_mode) (including `off`). Includes:
    * HTTP request size (request line)
    * HTTP request headers
    * Request body (POST data, uploaded files, etc.)

    Does not include traffic to the `wallarm-status` endpoint.
*   `bytes_out`: the total number of bytes sent from listening servers to clients (browsers, API clients, load balancers, etc.) — outgoing traffic. The metric is collected regardless of [`wallarm_mode`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_mode) (including `off`). Includes: 
    * HTTP status line and response headers
    * Response body (HTML, JSON, files, etc.)

    Does not include traffic to the `wallarm-status` endpoint.
*   `bytes_blocked_in` (available starting from the NGINX Node release 6.10.2 and Native Node 0.23.1): the total number of incoming bytes in requests blocked due to detected attacks or antibot protection. Excludes requests blocked by denylisted IPs and sessions — those are counted separately in `bytes_blocked_by_acl_in`.
*   `bytes_blocked_out` (available starting from the NGINX Node release 6.10.2 and Native Node 0.23.1): the total number of outgoing bytes in responses to requests blocked due to detected attacks or antibot protection. Excludes responses to requests blocked by denylisted IPs and sessions — those are counted separately in `bytes_blocked_by_acl_out`.
*   `bytes_blocked_by_acl_in` (available starting from the NGINX Node release 6.10.2 and Native Node 0.23.1): the total number of incoming bytes in requests blocked by [denylisted IPs](https://docs.wallarm.com/7.x/user-guides/ip-lists/overview.md) or [denylisted sessions](https://docs.wallarm.com/7.x/api-sessions/blocking.md).
*   `bytes_blocked_by_acl_out` (available starting from the NGINX Node release 6.10.2 and Native Node 0.23.1): the total number of outgoing bytes in responses to requests blocked by [denylisted IPs](https://docs.wallarm.com/7.x/user-guides/ip-lists/overview.md) or [denylisted sessions](https://docs.wallarm.com/7.x/api-sessions/blocking.md).
*   `tnt_errors`: the number of requests not analyzed by a post-analytics module. For these requests, the reasons for blocking are recorded, but the requests themselves are not counted in statistics and behavior checks.
*   `api_errors`: the number of requests that were not submitted to the API for further analysis. For these requests, blocking parameters were applied (i.e., malicious requests were blocked if the system was operating in blocking mode); however, data on these events is not visible in the UI. This parameter is only used when the Wallarm Node works with a local post-analytics module.
*   `requests_lost`: the number of requests that were not analyzed in a post-analytics module and transferred to API. For these requests, blocking parameters were applied (i.e., malicious requests were blocked if the system was operating in blocking mode); however, data on these events is not visible in the UI. This parameter is only used when the Wallarm Node works with a local post-analytics module.
*   `overlimits_time`: the number of attacks with the type [Overlimiting of computational resources](https://docs.wallarm.com/7.x/attacks-vulns-list.md#resource-overlimit) detected by the filtering node.
*   `segfaults`: the number of issues that led to the emergency termination of the worker process.
*   `memfaults`: the number of issues where the virtual memory limits were reached.
* `softmemfaults`: the number of issues where the virtual memory limit for proton.db +lom was exceeded ([`wallarm_general_ruleset_memory_limit`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_general_ruleset_memory_limit)).
* `proton_errors`: the number of the proton.db errors, except for those that occurred when the virtual memory limit was exceeded.
*   `time_detect`: the total time of request analysis.
*   `db_id`: proton.db version.
*   `lom_id`: will be deprecated soon, please use `custom_ruleset_id`.
*   `custom_ruleset_id`: version of the [custom ruleset](https://docs.wallarm.com/7.x/about-wallarm/protecting-against-attacks.md#custom-rules) build.

    Starting from release 4.8, it appears as `wallarm_custom_ruleset_id{format="51"} 386` in Prometheus format, with `custom_ruleset_ver` inside the `format` attribute and the main value being the ruleset build version.
*   `custom_ruleset_ver` (available starting from the Wallarm release 4.4.3): the [custom ruleset](https://docs.wallarm.com/7.x/about-wallarm/protecting-against-attacks.md#custom-rules) format:

    * `4x` - for Wallarm nodes 2.x which are [out-of-date](https://docs.wallarm.com/7.x/updating-migrating/versioning-policy.md#version-list).
    * `5x` - for Wallarm nodes 4.x and 3.x (the latter are [out-of-date](https://docs.wallarm.com/7.x/updating-migrating/versioning-policy.md#version-list)).
*   `db_apply_time`: Unix time of the last update of the proton.db file.
*   `lom_apply_time`: will be deprecated soon, please use `custom_ruleset_apply_time`.
*   `custom_ruleset_apply_time`: Unix time of the last update of the [custom ruleset](https://docs.wallarm.com/7.x/about-wallarm/protecting-against-attacks.md#custom-rules) file.
*   `proton_instances`: information about downloaded proton.db + LOM pairs:
    *   `total`: the total number of pairs.
    *   `success`: the number of pairs successfully downloaded from the Wallarm Cloud.
    *   `fallback`: the number of pairs downloaded from the backup directory. This indicates that there were issues downloading the latest proton.db + LOM from the Cloud, but NGINX was still able to load older versions of proton.db + LOM from the backup directory as the [`wallarm_fallback`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_fallback) directive is set to `on`.
    *   `failed`: the number of pairs that failed to initialize, meaning NGINX was unable to download the proton.db + LOM either from the Cloud or the backup directory. If [`wallarm_fallback`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_fallback) is enabled and this occurs, the Wallarm module will be disabled, leaving only the NGINX module operational. To diagnose the issue, it is recommended to check the NGINX logs or [contact Wallarm support](https://support.wallarm.com/).
*   `stalled_workers_count`: the quantity of workers that exceeded the time limit for request processing (the limit is set in the [`wallarm_stalled_worker_timeout`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_stalled_worker_timeout) directive).
*   `stalled_workers`: the list of the workers that exceeded the time limit for request processing (the limit is set in the [`wallarm_stalled_worker_timeout`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_stalled_worker_timeout) directive) and the amount of time spent on request processing.
*   `ts_files`: information about the [LOM](https://docs.wallarm.com/7.x/about-wallarm/protecting-against-attacks.md#custom-rules) file:
    *   `id`: used LOM version.
    *   `size`: LOM file size in bytes.
    *   `mod_time`: Unix time of the last update of the LOM file.
    *   `fname`: path to the LOM file.
*   `db_files`: information about the proton.db file:
    *   `id`: used proton.db version.
    *   `size`: proton.db file size in bytes.
    *   `mod_time`: Unix time of the last update of the proton.db file.
    *   `fname`: path to the proton.db file.
* `startid`: randomly generated unique ID of the filtering node.
* `compatibility`: numeric value indicating how well the Wallarm NGINX module is compatible with the running NGINX executable. This metric helps the support team diagnose compatibility issues. Values:
    *   `0`: not compatible by any source.
    *   `1`: this value is not used.
    *   `2`: debug build.
    *   `3`: exception list; valid in some cases when NGINX is built by the customer without standard patches.
    *   `4`: compatible by hash; this is the valid production value.
* `config_revision`: revision number of the currently applied configuration file, incremented whenever the configuration is updated.
* `rate_limit`: information about the Wallarm [rate limiting](https://docs.wallarm.com/7.x/user-guides/rules/rate-limiting.md) module:
    * `shm_zone_size`: total amount of shared memory that the Wallarm rate limiting module can consume in bytes (the value is based on the [`wallarm_rate_limit_shm_size`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_rate_limit_shm_size) directive, default is `67108864`).
    * `buckets_count`: the number of buckets (usually equal to NGINX workers count, 8 is a maximum).
    * `entries`: the number of unique request point values (aka keys) you measure limits for.
    * `delayed`: the number of requests that have been buffered by the rate limiting module due to the `burst` setting.
    * `exceeded`: the number of requests that have been rejected by the rate limiting module because they exceeded the limit.
    * `expired`: the total number of keys that are removed from the bucket on a regular 60-second basis if the rate limit for those keys was not exceeded.
    * `removed`: the number of keys abruptly removed from the bucket. If the value is higher than `expired`, increase the [`wallarm_rate_limit_shm_size`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_rate_limit_shm_size) value.
    * `no_free_nodes`: the value different from `0` indicates that there is insufficient memory allocated for the rate limit module, the [`wallarm_rate_limit_shm_size`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_rate_limit_shm_size) value increase is recommended.
* `timestamp`: time when the last incoming request was processed by the node (in the [Unix Timestamp](https://www.unixtimestamp.com/) format).
* `split.clients`: main statistics on each [tenant](https://docs.wallarm.com/7.x/installation/multi-tenant/overview.md). If the multitenancy feature is not activated, the statistics is returned for the only tenant (your account) with the static value `"client_id":null`.

    Starting from NGINX Node 6.12.0, when a label is set via the [`wallarm_partner_client_uuid`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_partner_client_uuid) directive, Prometheus output includes dedicated split metrics: `wallarm_*_per_app_total` (per application) and `wallarm_*_per_group_total` (per group). These metrics carry `client_uuid` and `client_label` labels for tenant identification. Groups are defined via the [`wallarm_status_group`](https://docs.wallarm.com/7.x/admin-en/configure-parameters-en.md#wallarm_status_group) directive.
* `split.clients.applications`: main statistics on each [application](https://docs.wallarm.com/7.x/user-guides/settings/applications.md). Parameters that are not included in this section return the statistics on all applications.
* `apifw_subrequest_timeouts`: the number of subrequests in the API Firewall service that timed out during processing. 

    !!! info "API Firewall subrequest timeouts"        
        The API Firewall service underlies the [API Specification Enforcement](https://docs.wallarm.com/7.x/api-specification-enforcement/overview.md) feature.

The data of all counters is accumulated from the moment NGINX is started. If Wallarm has been installed in a ready-made infrastructure with NGINX, the NGINX server must be restarted to start statistics collection.