wireguard_exporter

An asynchronous Prometheus exporter for wireguard

wireguard_exporter runs wg show [..] and scrapes the output to build Prometheus metrics. Because wg requires root privileges, this tool must be run as root (or via sudo) or with the following capabilities in both the ambient and bounding set:

• CAPDACREAD_SEARCH
• CAPNETADMIN
• CAPNETRAW

Metrics Provided

• Total number of bytes transferred in/out per peer
• Total number of bytes transferred in/out per interface
• Time since last handshake per peer
• Scrape duration in milliseconds
• Scrape success

Installation

wireguard_exporter is a single binary that must be placed somewhere in your $PATH. One can either download 64-bit Linux binaries from the Release Page or one can also compile from source.

Compile from Source

Ensure you have a Rust toolchain installed. Some of the dependencies also require gcc to be installed.

$ git clone https://github.com/kbknapp/wireguard_exporter $ cd wireguard_exporter $ cargo build --release $ sudo cp target/release/wireguard_exporter /usr/local/bin/

Usage

Command Line Interface

``` USAGE: wireguard_exporter [FLAGS] [OPTIONS]

FLAGS: -h, --help Prints help information -q, --quiet Supress output at a level or lower. -q: INFO, -qq: WARN, -qqq: ERROR (i.e. everything) -v, --verbose Show verbose output at a level or higher. -v: DEBUG, -vv: TRACE -V, --version Prints version information

OPTIONS: --collect-interval How often metrics are gathered [default: 5] -l, --listen-address The listen address scraping metrics [default: 0.0.0.0] -p, --listen-port The listen port for scraping metrics [default: 9455] ```

To run with the default options, and the binary is installed somewhere in your $PATH:

$ sudo wireguard_exporter

Prometheus Configuration

You can add the following scrape configs to Prometheus:

```yaml scrapeconfigs: - jobname: 'wireguard' staticconfigs: - targets: - 'localhost:9586' - 'otherhost:9586'

relabel_configs:
- source_labels: [ '__address__' ]
  regex: '(.*):\d+'
  target_label: instance

```

Example Metrics

```

HELP wireguardbytestotal Total number of bytes per direction per interface

TYPE wireguardbytestotal counter

wireguardbytestotal{direction="rx",interface="custom"} 19576636452 wireguardbytestotal{direction="rx",interface="wg0"} 1091996152 wireguardbytestotal{direction="tx",interface="custom"} 3919310388 wireguardbytestotal{direction="tx",interface="wg0"} 2393043528

HELP wireguarddurationsincelatesthandshake During since latest handshake for a peer

TYPE wireguarddurationsincelatesthandshake gauge

wireguarddurationsincelatesthandshake{interface="custom",peer="q2JWEKWfLPU5UjG2Sq31xx2GsSjdhKNtdT/X/tFVyjs="} 51405 wireguarddurationsincelatesthandshake{interface="custom",peer="2ELWFmGnqhtRpu4r2PUKc0cw+ELtuMPLd6l0KsoCUBQ="} 88405 wireguarddurationsincelatesthandshake{interface="custom",peer="duVVziZbyIiIPoRprisE69K0By198Cn8dPwY5bFecEk="} 116405 wireguarddurationsincelatesthandshake{interface="custom",peer="nwj+Zw49AbYrzUAPzeRf8hhll/1dz8SjoOYZuB+JdT4="} 15296341405 wireguarddurationsincelatesthandshake{interface="custom",peer="QF01u5CZhH9+CWcVY9pbsuTu3QsTcSqFvni3VfOiL2s="} 34405 wireguarddurationsincelatesthandshake{interface="custom",peer="N5UQp3XbysLBAavUm1Cpv7xxjk99LwJD99z5//PsyCc="} 95405 wireguarddurationsincelatesthandshake{interface="custom",peer="QlgHHfYP3aMlRG7d6/Zp9IhUOLrpT5G2GIdODODaUHQ="} 10690033405 wireguarddurationsincelatesthandshake{interface="custom",peer="FtUeMGdNxgkVN0G9lpvOc5jtAQQ1m9DpvZPDCUdKBx0="} 96405 wireguarddurationsincelatesthandshake{interface="wg0",peer="bRQZOyOZUvHMhBvCWq2sXO0VsRu6Aq5LCACi/R3AJk8="} 42405

HELP wireguardinterfacestotal Total number of interfaces

TYPE wireguardinterfacestotal gauge

wireguardinterfacestotal 2

HELP wireguardpeerbytes_total Total number of bytes per direction for a peer

TYPE wireguardpeerbytes_total counter

wireguardpeerbytestotal{direction="rx",interface="custom",peer=q2JWEKWfLPU5UjG2Sq31xx2GsSjdhKNtdT/X/tFVyjs=""} 0 wireguardpeerbytestotal{direction="rx",interface="custom",peer="2ELWFmGnqhtRpu4r2PUKc0cw+ELtuMPLd6l0KsoCUBQ="} 1240506784 wireguardpeerbytestotal{direction="rx",interface="custom",peer="duVVziZbyIiIPoRprisE69K0By198Cn8dPwY5bFecEk="} 1312403276 wireguardpeerbytestotal{direction="rx",interface="custom",peer="nwj+Zw49AbYrzUAPzeRf8hhll/1dz8SjoOYZuB+JdT4="} 11962543712 wireguardpeerbytestotal{direction="rx",interface="custom",peer="QF01u5CZhH9+CWcVY9pbsuTu3QsTcSqFvni3VfOiL2s="} 0 wireguardpeerbytestotal{direction="rx",interface="custom",peer="N5UQp3XbysLBAavUm1Cpv7xxjk99LwJD99z5//PsyCc="} 0 wireguardpeerbytestotal{direction="rx",interface="custom",peer="QlgHHfYP3aMlRG7d6/Zp9IhUOLrpT5G2GIdODODaUHQ="} 353261276 wireguardpeerbytestotal{direction="rx",interface="custom",peer="FtUeMGdNxgkVN0G9lpvOc5jtAQQ1m9DpvZPDCUdKBx0="} 2150081456 wireguardpeerbytestotal{direction="rx",interface="wg0",peer=""} 1091996152 wireguardpeerbytestotal{direction="tx",interface="custom",peer="q2JWEKWfLPU5UjG2Sq31xx2GsSjdhKNtdT/X/tFVyjs="} 0 wireguardpeerbytestotal{direction="tx",interface="custom",peer="2ELWFmGnqhtRpu4r2PUKc0cw+ELtuMPLd6l0KsoCUBQ="} 708900060 wireguardpeerbytestotal{direction="tx",interface="custom",peer="duVVziZbyIiIPoRprisE69K0By198Cn8dPwY5bFecEk="} 714718444 wireguardpeerbytestotal{direction="tx",interface="custom",peer="nwj+Zw49AbYrzUAPzeRf8hhll/1dz8SjoOYZuB+JdT4="} 1171658320 wireguardpeerbytestotal{direction="tx",interface="custom",peer="QF01u5CZhH9+CWcVY9pbsuTu3QsTcSqFvni3VfOiL2s="} 0 wireguardpeerbytestotal{direction="tx",interface="custom",peer="N5UQp3XbysLBAavUm1Cpv7xxjk99LwJD99z5//PsyCc="} 0 wireguardpeerbytestotal{direction="tx",interface="custom",peer="QlgHHfYP3aMlRG7d6/Zp9IhUOLrpT5G2GIdODODaUHQ="} 88648 wireguardpeerbytestotal{direction="tx",interface="custom",peer="FtUeMGdNxgkVN0G9lpvOc5jtAQQ1m9DpvZPDCUdKBx0="} 480852300 wireguardpeerbytestotal{direction="tx",interface="wg0",peer="bRQZOyOZUvHMhBvCWq2sXO0VsRu6Aq5LCACi/R3AJk8="} 2393043528

HELP wireguardpeerstotal Total number of peers per interfaces

TYPE wireguardpeerstotal gauge

wireguardpeerstotal{interface="custom"} 7 wireguardpeerstotal{interface="wg0"} 1

HELP wireguardscrapeduration_milliseconds Duration in milliseconds of the scrape

TYPE wireguardscrapeduration_milliseconds gauge

wireguardscrapeduration_milliseconds 1

HELP wireguardscrapesuccess If the scrape was a success

TYPE wireguardscrapesuccess gauge

wireguardscrapesuccess 1 ```

License

This crate is licensed under either of

• Apache License, Version 2.0
• MIT license

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.