Metrics and tracing

The Artifact Firewall emits metrics and traces through the OpenTelemetry pipeline Orca already runs, configured under the top-level otel block. There is no separate telemetry configuration for the firewall: it reuses the providers the Supervisor set up, and its telemetry arrives under the instrumentation scope artifact-firewall, alongside Varnish and Supervisor telemetry carrying the same service.name.

Firewall metrics leave by whichever route otel.metrics.exporter selects, pushed over OTLP or served on the Prometheus scrape endpoint.

The audit log is a separate stream with its own destination setting.

Metrics

Package evaluation:

Metric	Type	Description
`firewall_requests_total`	counter	Package evaluations. Attributes: `package_type`, `action`, `rule_id`, `mode`.
`firewall_manifests_total`	counter	Manifest transformations. Attributes: `package_type`, `status`, `mode`. `status` is `ok`, `error`, or `report_only` for a manifest left alone because of the firewall mode.
`firewall_manifest_duration_seconds`	histogram	Time spent transforming a manifest. Attribute: `package_type`.
`firewall_proxy_duration_seconds`	histogram	Total proxy request duration. Attribute: `package_type`.

Rulesets and their cache:

Metric	Type	Description
`firewall_rules_loaded`	gauge	Rules currently loaded.
`firewall_rulesets_loaded`	gauge	Rulesets currently loaded.
`firewall_ruleset_reloads_total`	counter	Reload attempts. Attribute: `status`, `success` or `failure`.
`firewall_storage_used_bytes`	gauge	Bytes used by the ruleset cache directory, sampled every 10 seconds. Only reported when `storage.size` is set.
`firewall_storage_declared_bytes`	gauge	The declared budget from `storage.size`, or `0` when it is not set.

Publish-time lookups, made to place a package inside or outside its quarantine window:

Metric	Type	Description
`firewall_maven_solr_requests_total`	counter	Solr API calls for Maven publish times. Attribute: `outcome`.
`firewall_maven_head_requests_total`	counter	HEAD requests against upstream POM URLs, the fallback when Solr answers nothing. Attribute: `outcome`.
`firewall_pypi_publish_time_requests_total`	counter	PyPI JSON API calls for publish times on the HTML simple index. Attribute: `outcome`.

HTTP:

Metric	Type	Description
`http_requests_total`	counter	All HTTP requests. Attributes: `method`, `route`, `status`.
`http_errors_total`	counter	Responses with a 5xx status. Attributes: `method`, `route`, `status`.
`http_request_duration_seconds`	histogram	Request duration. Attributes: `method`, `route`.

The route attribute is normalised to one of /api/rulesets, /api/update, /api/eval, /api/mode, /healthz, /readyz, or /. Registry traffic falls into the / bucket, since package paths are unbounded. To count proxied traffic, filter on route="/".

Tracing

Tracing is off until otel.tracing is enabled with an endpoint, and it needs the vmod-otel license addon like the rest of Orca tracing.

Per request the firewall emits:

An HTTP server span named by method and normalised route, for example GET /api/eval.
firewall.proxy, covering the proxied request.
firewall.transform_manifest, covering manifest evaluation and rewriting.
A client span per fetch from the origin registry.
firewall.evaluate on an /api/eval call, carrying the decision as firewall.purl, firewall.rule_id, firewall.ruleset_id, firewall.action, firewall.effective_action and firewall.mode.

An inbound W3C traceparent header is honored and propagated to the origin, so a build system that traces its own dependency fetches sees them continue through the firewall.