A Prometheus exporter for WireGuard, written in Rust. This tool exports the wg show all dump results in a format that Prometheus can understand. The exporter is very light on your server resources, both in terms of memory and CPU usage.
rustc 1.35.0-nightly (8159f389f 2019-04-06)).wg CLI in the path. The tool will call wg show all dump and of course will fail if the wg executable is not found. If you want I can add the option of specifying the wg path in the command line, just open an issue for it.To compile the latest master version:
bash
git clone https://github.com/MindFlavor/prometheus_wireguard_exporter.git
cd prometheus_wireguard_exporter
cargo install --path .
If you want the latest release you can simply use:
bash
cargo install prometheus_wireguard_exporter
Start the binary with -h to get the complete syntax. The parameters are:
| Parameter | Mandatory | Valid values | Default | Description |
| -- | -- | -- | -- | -- |
| -v | no | -p | no | any valid port number | 9576 | Specify the service port. This is the port your Prometheus instance should point to.
| -n | no | path to the wireguard configuration file | | This flag adds the friendly_name attribute to the exported entries. See Friendly names for more details.
Once started, the tool will listen on the specified port (or the default one, 9576, if not specified) and return a Prometheus valid response at the url /metrics. So to check if the tool is working properly simply browse the http://localhost:9576/metrics (or whichever port you choose).
Starting from version 1.2 you can instruct the exporter to append a friendly name to the exported entries. This can make the output more understandable than using the public keys. For example this is the standard output:
```
wireguardsentbytes{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32"} 13500788 wireguardsentbytes{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32"} 0 wireguardsentbytes{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32"} 0 wireguardsentbytes{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32"} 0 wireguardsentbytes{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32"} 0 wireguardsentbytes{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32"} 0 wireguardsentbytes{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", local_subnet="32"} 7975608
wireguardreceivedbytes{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32"} 50007604 wireguardreceivedbytes{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32"} 0 wireguardreceivedbytes{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32"} 0 wireguardreceivedbytes{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32"} 0 wireguardreceivedbytes{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32"} 0 wireguardreceivedbytes{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32"} 0 wireguardreceivedbytes{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", local_subnet="32"} 182505560
wireguardlatesthandshakeseconds{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32"} 50780 wireguardlatesthandshakeseconds{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", localsubnet="32"} 63459 ```
And this is the one augmented with friendly names:
```
wireguardsentbytes{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32", friendlyname="OnePlus 6T"} 13500788 wireguardsentbytes{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32", friendlyname="varch.local (laptop)"} 0 wireguardsentbytes{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32", friendlyname="cantarch"} 0 wireguardsentbytes{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32", friendlyname="frcognoarch"} 0 wireguardsentbytes{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32", friendlyname="frcognowin10"} 0 wireguardsentbytes{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32", friendlyname="OnePlus 5T"} 0 wireguardsentbytes{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", localsubnet="32", friendlyname="folioarch"} 7975608
wireguardreceivedbytes{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32", friendlyname="OnePlus 6T"} 50007604 wireguardreceivedbytes{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32", friendlyname="varch.local (laptop)"} 0 wireguardreceivedbytes{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32", friendlyname="cantarch"} 0 wireguardreceivedbytes{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32", friendlyname="frcognoarch"} 0 wireguardreceivedbytes{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32", friendlyname="frcognowin10"} 0 wireguardreceivedbytes{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32", friendlyname="OnePlus 5T"} 0 wireguardreceivedbytes{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", localsubnet="32", friendlyname="folioarch"} 182505560
wireguardlatesthandshakeseconds{inteface="wg0", publickey="2S7mA0vEMethCNQrJpJKE81/JmhgtB+tHHLYQhgM6kk=", localip="10.70.0.2", localsubnet="32", friendlyname="OnePlus 6T"} 50780 wireguardlatesthandshakeseconds{inteface="wg0", publickey="qnoxQoQI8KKMupLnSSureORV0wMmH7JryZNsmGVISzU=", localip="10.70.0.3", localsubnet="32", friendlyname="varch.local (laptop)"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="L2UoJZN7RmEKsMmqaJgKG0m1S2Zs2wd2ptAf+kb3008=", localip="10.70.0.4", localsubnet="32", friendlyname="cantarch"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="MdVOIPKt9K2MPj/sO2NlWQbOnFJ6L/qX80mmhQwsUlA=", localip="10.70.0.50", localsubnet="32", friendlyname="frcognoarch"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc=", localip="10.70.0.40", localsubnet="32", friendlyname="frcognowin10"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk=", localip="10.70.0.80", localsubnet="32", friendlyname="OnePlus 5T"} 1558341167 wireguardlatesthandshakeseconds{inteface="wg0", publickey="wTjv6hS6fKfNK+SzOLo7O6BQjEb6AD1TN9GjwZ08IwA=", localip="10.70.0.5", localsubnet="32", friendly_name="folioarch"} 63459 ```
In order for this to work, you need to add comments to your wireguard configuration file (below the [Peer] definition). The comment will be interpreted as friendly_name and added to the entry exported to Prometheus. Note that this is not a standard but, since it's a comment, will not interfere with WireGuard in any way. For example this is how you edit your WireGuard configuration file:
``` [Peer] PublicKey = lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc= AllowedIPs = 10.70.0.40/32
[Peer] PublicKey = 928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk= AllowedIPs = 10.70.0.80/32 ```
``` [Peer]
PublicKey = lqYcojJMsIZXMUw1heAFbQHBoKjCEaeo7M1WXDh/KWc= AllowedIPs = 10.70.0.40/32
[Peer]
PublicKey = 928vO9Lf4+Mo84cWu4k1oRyzf0AR7FTGoPKHGoTMSHk= AllowedIPs = 10.70.0.80/32 ```
As you can see, all you need to do is to add the friendly name as comment (and enable the flag since this feature is opt-in).
Now add the exporter to the Prometheus exporters as usual. I recommend to start it as a service. It's necessary to run it as root (if there is a non-root way to call wg show all dump please let me know). My systemd service file is like this one:
``` [Unit] Description=Prometheus WireGuard Exporter Wants=network-online.target After=network-online.target
[Service] User=root Group=root Type=simple ExecStart=/usr/local/bin/prometheuswireguardexporter -n /etc/wireguard/wg0.conf
[Install] WantedBy=multi-user.target ```