Metrics reference

This page lists the metrics the agent emits. You need these names in two places: when reading charts, and when writing a custom alert rule in the console, which asks for a metric name.

Naming scheme

• host.* for base host metrics, on every platform.
• svc.<service>.* for service probes. The first segment after svc. is the service name from the matched definition (nginx, mysql, redis, ...).
• ext.* for external checks run from a collector vantage, and domain expiry.
• dev.* for SNMP devices polled by a collector.
• apm.* for zero-touch APM RED metrics.
• app.* is reserved for your own custom metrics (see Local ingest ports).

Dimensions never go into the name. They ride in tags: the mount point, the site, the port, the container image, the VM name. One metric name covers all entities of its kind, and the tag tells them apart.

Using metrics in alert rules

A custom alert rule takes a metric name, a comparison (>=, <=, ==), a threshold, a "for" duration the condition must hold, and a severity. Two details worth knowing:

• % is a wildcard. A rule metric may contain % to span a name segment. The built-in certificate rule watches svc.%.vhost.ssl_days_left, which matches the metric from nginx and Apache alike. Your custom rules can use the same trick.
• The tag key splits the rule per entity. A rule on host.disk.used_pct with tag key mount opens a separate incident per mount point, not one blurred incident per host. Use the tag listed for the metric below.

A rule also carries a disarm threshold (hysteresis): the incident resolves only when the value crosses back past the disarm value, so a metric hovering at the threshold does not flap.

Host

Base metrics, every platform, no privilege needed.

Metric	Tags	Unit	What it is
host.cpu.used_pct		%	CPU busy, all cores combined. Inside an LXC container this is the load of the physical cores the container is pinned to, as the container runtime presents them, so neighbours sharing those cores show up in it; host.cpu.pressure_pct is the container's own signal.
host.cpu.cores			Cores the agent may run on, re-read every cycle (a core taken offline is noticed within a minute; also feeds the energy estimate; the CPU model rides as a host fact).
host.cpu.pressure_pct		%	Share of time at least one task waited for a CPU (Linux pressure stall information; inside a container, the container's own cgroup).
host.load1 / host.load5 / host.load15			Load average (Linux and macOS). Inside a container the agent computes it from the container's own runnable and waiting tasks, sampled every five seconds with the kernel's decay, because the kernel's /proc/loadavg there is the node's.
host.load1_per_core			1-minute load divided by cores: the honest saturation signal a busy-percent hides (built-in rule at 4 sustained).
host.mem.total_kb		KiB	Total physical memory.
host.mem.available_kb		KiB	Memory available to applications.
host.mem.used_pct		%	Memory in use.
host.swap.used_pct		%	Swap in use (emitted only when swap exists).
host.disk.total_bytes	mount	bytes	Filesystem size, per mount.
host.disk.used_bytes	mount	bytes	Used space, per mount.
host.disk.used_pct	mount	%	Used space percentage, per mount.
host.disk.readonly	mount	0/1	The mount is read-only: on Linux as the host's init process sees it (a filesystem remounted read-only after errors; EFI partitions that are read-only by design are not judged), on Windows as the volume reports itself.
host.io.read_bytes_per_sec / host.io.write_bytes_per_sec		bytes/s	Disk reads and writes across physical block devices (inside a container, the container's own cgroup accounting).
host.io.pressure_pct		%	Share of time at least one task waited for disk I/O (pressure stall information; inside a container, the container's own cgroup). Absent where the kernel has pressure accounting switched off.
host.io.busy_pct		%	Share of time the busiest physical disk was serving requests, from the kernel's per-device counters; the fallback saturation signal where pressure accounting is unavailable.
host.net.rx_bytes_per_sec / host.net.tx_bytes_per_sec		bytes/s	Network throughput over physical interfaces (bridges, veth pairs and other virtual interfaces are not summed, so a container host does not count the same bytes twice; inside a container with no physical interface every interface except loopback and bridges counts).
host.uptime_sec		s	Seconds since boot.
host.top.cpu_pct	proc	%	Top processes by CPU (top 5, workers folded by name; only the process name travels, never the command line). Linux and Windows.
host.top.mem_bytes	proc	bytes	Top processes by memory.
host.top.io_bps	proc	bytes/s	Top processes by disk I/O (read plus write).

Websites (per-site checks)

Emitted by the vhosts probe of the matched web server, so the service segment is the web server's (svc.nginx.vhost.*, svc.apache.vhost.*). In rules, svc.%.vhost.<name> covers them all. See Websites and domains for how these are measured.

Metric	Tags	Unit	What it is
svc.%.vhost.latency_ms	vhost	ms	Response time of the local per-site HTTP check.
svc.%.vhost.ssl_days_left	vhost	days	Days until the site's certificate expires. Negative = already expired.
svc.%.vhost.ssl_trusted	vhost	0/1	Whether the certificate chain verifies. Reported for every name of the block, each from its own TLS handshake.
svc.%.vhost.ssl_name_ok	vhost	0/1	Whether the certificate presented for this name lists it. Reported for every name that exists in DNS; the built-in rule folds the zeros into one incident per host.
svc.%.vhost.dns_ok	vhost	0/1	Whether the site's domain still resolves (NXDOMAIN = 0). Reported for every name of the block, except an alias under the site's own domain that was never created in DNS.
svc.%.vhost.backend_missing	vhost	0/1	A local backend of the site (PHP socket, proxied port, upstream member) has nothing serving it: every dynamic request would answer 502, found by inspection rather than by waiting for traffic. First name of the block only.
svc.%.vhost.docroot_missing	vhost	0/1	The site's root directory does not exist. First name of the block only.
svc.%.vhost.offloaded	vhost	0/1	1 when the domain points away from this host (CDN, proxy, moved).
svc.%.vhost.domain_age_days	vhost (registrable domain)	days	Age of the domain registration. A young age on an old site signals a drop-catch.
svc.%.vhost.domain_days_left	vhost (registrable domain)	days	Days until the domain registration expires. Negative = registrar grace window.

Web servers (RED from access logs)

Metric	Tags	Unit	What it is
svc.nginx.req_rate		req/s	Request rate from the access log.
svc.nginx.client_error_rate		req/s	4xx responses per second.
svc.nginx.server_error_rate		req/s	5xx responses per second.
svc.apache.req_rate / .client_error_rate / .server_error_rate		req/s	The same three for Apache.

PHP-FPM pools

Pool saturation telemetry, read from the kernel and the pool configs with no client config touched. Saturation means a growing backlog (requests queueing on the listen socket), never a high workers-to-limit ratio: a static pool sits at its limit by design.

Metric	Tags	Unit	What it is
svc.php-fpm.pools			Pools found on the host.
svc.php-fpm.pool.workers	pool		Live worker processes of the pool.
svc.php-fpm.pool.blocked	pool		Workers in uninterruptible wait (stuck on IO or a lock).
svc.php-fpm.pool.max_children	pool		The pool's configured worker limit.
svc.php-fpm.pool.backlog	pool		Requests waiting in the pool's listen queue. The saturation signal.
svc.php-fpm.pool.static	pool	0/1	Whether the pool is static (prefers all workers by design).

Node.js services

Metric	Tags	Unit	What it is
svc.node.masters			Node master processes found.
svc.node.up	unit	0/1	Per-service state (systemd, pm2, or the Windows SCM).
svc.node.crash_restarts	unit	count	Automatic restarts counted by the supervisor.
svc.node.restarts_seen	unit	count	Restarts detected by process identity change (catches pm2 too).
svc.node.instrumented	unit	0..1	Share of the service's masters running the spans instrumentation.
svc.node.busy_pct / svc.node.unique_stacks			CPU profiler window stats (behind the profiling grant).

An instrumented Node service also reports runtime metrics: the OpenTelemetry nodejs.* and v8js.* families arrive as svc.node.* with dots turned into underscores, tagged unit, times in milliseconds. The ones you will actually use:

Metric	Tags	Unit	What it is
svc.node.nodejs_eventloop_delay_mean_ms	unit	ms	Mean event loop delay: the "Node cannot keep up" signal (built-in rule at 100 ms).
svc.node.nodejs_eventloop_delay_p99_ms	unit	ms	The p99 of the same.
svc.node.nodejs_eventloop_utilization	unit	ratio	Share of time the loop is busy.
svc.node.v8js_gc_duration	unit	ms	Average GC pause.
svc.node.v8js_memory_heap_used	unit	bytes	Heap in use.

Databases and caches

Metric	Tags	Unit	What it is
svc.mysql.unit_active		0/1+	Whether the MySQL or MariaDB unit is active (survives a dead server process, so the down rule can fire).
svc.mysql.connections			Connected threads.
svc.mysql.max_connections			The server's connection limit.
svc.mysql.connections_used_pct		%	Connections against the limit: the saturation signal (built-in rule at 85%).
svc.mysql.running			Actively running threads.
svc.mysql.threads			Server threads (status header).
svc.mysql.aborted_connects / .aborted_connects_per_min		count, /min	Failed connection attempts, cumulative and per minute (derived on the host).
svc.mysql.slow_queries / .slow_queries_per_min		count, /min	Slow queries, cumulative and per minute.
svc.mysql.slow_rate		q/s	Slow-log entries per second (from the real slow-log path).
svc.mysql.qps		q/s	Queries per second average.
svc.mysql.innodb_row_lock_waits / .innodb_row_lock_waits_per_min		count, /min	InnoDB row lock waits, cumulative and per minute.
svc.mysql.bytes_sent		bytes	Bytes sent (cumulative).
svc.mysql.uptime		s	Server uptime.
svc.postgres.connections			Backends across databases.
svc.postgres.commits / .rollbacks		count	Transactions (cumulative).
svc.postgres.commits_rate / .rollbacks_per_min		/s, /min	Commits per second and rollbacks per minute, derived on the host.
svc.postgres.blks_hit / .blks_read		count	Buffer cache hits versus disk reads (cumulative).
svc.postgres.blks_read_rate		/s	Disk block reads per second.
svc.postgres.deadlocks / .deadlocks_per_min		count, /min	Deadlocks, cumulative and per minute (the built-in rule watches the rate).
svc.redis.connected_clients			Connected clients.
svc.redis.used_memory		bytes	Memory used by Redis.
svc.redis.maxmemory		bytes	The configured memory limit (0 when unlimited).
svc.redis.memory_used_pct		%	Memory against the limit; only exists where a limit is set, so the rule arms honestly.
svc.redis.mem_fragmentation_ratio		ratio	Fragmentation ratio.
svc.redis.total_commands_processed		count	Commands processed (cumulative).
svc.redis.keyspace_hits / .keyspace_misses		count	Key lookups (cumulative).
svc.redis.keyspace_misses_per_min		/min	Misses per minute, derived on the host.
svc.redis.evicted_keys / .evicted_keys_per_min		count, /min	Keys evicted under memory pressure, cumulative and per minute.
svc.redis.rejected_connections / .rejected_connections_per_min		count, /min	Connections rejected at maxclients, cumulative and per minute.
svc.redis.uptime		s	Server uptime.
svc.mongo.connections / .connections_available			Current and available connections.
svc.mongo.opcounters_insert / .opcounters_query / .opcounters_update / .opcounters_delete		count	Operations (cumulative).
svc.mongo.insert_rate / .query_rate / .update_rate / .delete_rate		/s	Operations per second, derived on the host.
svc.mongo.mem_resident_mb		MB	Resident memory.
svc.mongo.uptime		s	Server uptime.
svc.mssql.connections / .user_sessions			Connections and user sessions.
svc.mssql.blocked_requests			Requests blocked by another session.
svc.mssql.databases / .databases_offline			Databases total and not online.
svc.mssql.batch_requests		count	Batch requests counter.
svc.mssql.page_life_expectancy		s	Buffer page life expectancy.
svc.elasticsearch.nodes / .data_nodes			Cluster nodes.
svc.elasticsearch.active_shards / .unassigned_shards / .relocating_shards			Shard states.
svc.elasticsearch.shard_health_pct		%	Active shards percentage.
svc.elasticsearch.status_red / .status_yellow		0/1	Cluster status flags; red means a primary shard is missing and drives the built-in rule.
svc.elasticsearch.pending_tasks			Pending cluster tasks.
svc.elasticsearch.docs / .store_bytes			Documents and store size of the probed index.
svc.clickhouse.unit_active		0/1	Whether the ClickHouse unit is active.
svc.clickhouse.running_queries			Queries in flight.
svc.clickhouse.tcp_connections / .http_connections			Client connections by interface.
svc.clickhouse.memory_bytes		bytes	Tracked memory use.
svc.clickhouse.max_parts_per_partition			Worst part count per partition: merge health.
svc.clickhouse.replica_max_delay_sec		s	Worst replica lag (0 without replication).
svc.clickhouse.databases / .tables			Object counts.
svc.clickhouse.rows_total / .bytes_total			MergeTree totals.
svc.clickhouse.uptime_sec		s	Server uptime.

A named MSSQL instance matched by its own definition emits the same set under its service name (for example svc.mssql-express.*).

Mail

Metric	Tags	Unit	What it is
svc.postfix.queue_requests / .queue_kbytes			Mail queue depth and size.
svc.postfix.sent_rate / .deferred_rate / .bounced_rate		msg/s	Delivery outcomes from the mail log.
svc.dovecot.login_rate		/s	IMAP logins per second.
svc.dovecot.auth_fail_rate		/s	Failed authentications per second.
svc.exim.queue			Queued messages.
svc.pmg.day_total / .day_in / .day_out		msgs	Proxmox Mail Gateway daily counts.
svc.pmg.day_spam_in / .day_virus_in / .day_bounces_in		msgs	Daily spam, virus, bounce counts.
svc.pmg.day_rbl_rejects / .day_greylist		msgs	RBL rejects and greylisted.
svc.pmg.avg_process_sec		s	Average processing time.

DNS

Metric	Tags	Unit	What it is
svc.bind.recursive_clients / .tcp_clients			Client counts from rndc status.
svc.bind.query_rate		q/s	Queries per second from the query log (real path from the config).
svc.unbound.queries / .cache_hits / .cache_miss		count	Totals (cumulative).
svc.unbound.query_rate / .cache_hit_rate / .cache_miss_rate		q/s	The same per second, derived on the host.
svc.unbound.cache_hit_pct		%	Cache hits as a share of hits plus misses.
svc.unbound.recursion_time_avg		s	Average recursion time.
svc.unbound.requestlist_avg			Average request list length.
svc.unbound.requestlist_exceeded / .requestlist_exceeded_per_min		count, /min	Queries dropped because the request list was full, cumulative and per minute.
svc.powerdns.udp_queries / .udp_answers / .tcp_queries / .tcp_answers		count	Query and answer totals per transport (cumulative).
svc.powerdns.query_rate		q/s	UDP queries per second, derived on the agent.
svc.powerdns.servfail_packets / .corrupt_packets / .timedout_packets / .overload_drops		count	Failure totals (cumulative).
svc.powerdns.servfail_rate / .corrupt_rate / .timedout_rate / .overload_drop_rate		/min	The same failures per minute, derived on the agent.
svc.powerdns.servfail_pct		%	SERVFAIL answers as a share of all queries (the built-in rule watches this, not the count).
svc.powerdns.query_cache_hit / .query_cache_miss		count	Query cache hits and misses.
svc.powerdns.packetcache_hit / .packetcache_miss		count	Packet cache hits and misses.
svc.powerdns.qsize_q			Queries waiting in the backend queue.
svc.powerdns.open_tcp_connections			Open TCP connections.
svc.powerdns.latency_us		us	Average time a packet spends inside PowerDNS.
svc.powerdns.uptime_sec		s	Daemon uptime.

Queues and brokers

Metric	Tags	Unit	What it is
svc.rabbitmq.messages / .messages_ready			Queue depth totals.
svc.rabbitmq.publish_total / .publish_rate		count, /s	Published messages, cumulative and per second.
svc.kafka.brokers			Live brokers.
svc.kafka.partitions	topic		Partitions per topic.
svc.kafka.current_offset	topic, partition		Latest offset.
svc.kafka.consumer_lag	consumergroup, topic		Consumer group lag.
svc.kafka.under_replicated	topic		Under-replicated partitions.
svc.nats.connections / .total_connections			Current and total connections.
svc.nats.total_connections_per_min		/min	New connections per minute (the reconnect-storm signal; the monitoring probe itself accounts for about one).
svc.nats.subscriptions			Active subscriptions.
svc.nats.slow_consumers / .slow_consumers_per_min		count, /min	Slow consumers, cumulative and per minute.
svc.nats.in_msgs / .out_msgs		count	Message totals (cumulative).
svc.nats.in_msgs_rate / .out_msgs_rate		msg/s	Messages in and out per second.
svc.nats.mem_bytes		bytes	Server memory.

Load balancers and proxies

Metric	Tags	Unit	What it is
svc.haproxy.current_connections / .conn_rate			Current connections and connection rate.
svc.haproxy.uptime		s	Process uptime.
svc.haproxy.backends_up / .backends_total			Backends up versus configured.
svc.haproxy.servers_up / .servers_total			Real servers up versus configured.
svc.haproxy.proxy.up	proxy, kind	0/1	Backend health.
svc.haproxy.proxy.sessions / .proxy.sessions_total	proxy, kind		Sessions per frontend or backend.
svc.haproxy.proxy.hrsp_5xx_total	proxy, kind	count	5xx answered through the proxy (cumulative).
svc.haproxy.proxy.conn_errors_total	proxy, kind	count	Backend connection errors (cumulative).
svc.haproxy.proxy.active_servers	proxy, kind		Active servers in the backend.
svc.haproxy.server.up	proxy, server	0/1	Per-server health.
svc.haproxy.server.sessions	proxy, server		Per-server sessions.
svc.haproxy.server.hrsp_5xx_total	proxy, server	count	Per-server 5xx (cumulative).
svc.varnish.uptime		s	Process uptime.
svc.varnish.sessions / .client_req		count	Sessions and client requests (cumulative).
svc.varnish.cache_hit / .cache_miss		count	Cache outcomes (cumulative).
svc.varnish.backend_fail / .backend_unhealthy		count	Backend trouble (cumulative).
svc.varnish.threads			Worker threads.
svc.traefik.http_routers / .http_services			Configured routers and services.
svc.keepalived.active		0/1	1 when this node actually holds the VIP (de-facto master).
svc.keepalived.vips_held			How many of the configured VIPs this node holds.
svc.keepalived.priority			Configured VRRP priority.

Virtualization and containers

Metric	Tags	Unit	What it is
svc.proxmox.vms / .vms_running			QEMU VMs total and running.
svc.proxmox.cts / .cts_running			LXC containers total and running.
svc.proxmox.guest.running	vmid, name, type	0/1	Per-guest state.
svc.proxmox.guest.cpu_pct / .guest.mem_pct / .guest.mem_bytes	vmid, name, type		Per-guest usage (running guests).
svc.proxmox.guest.disk_pct	vmid, name, type	%	Per-guest disk usage where reported.
svc.proxmox.guest.uptime	vmid, name, type	s	Per-guest uptime.
svc.proxmox.storage.used_pct	storage	%	Per-storage usage (this node's view; a built-in rule fires at 90%).
svc.proxmox.storages_active / .storages_total			Storage states.
svc.proxmox.cluster.quorate		0/1	Whether this node sees cluster quorum (exists only on cluster members).
svc.proxmox.cluster.nodes / .cluster.nodes_online			Cluster members total and online, as this node sees them.
svc.proxmox.cluster.node.online	node	0/1	Per-member liveness from this node's view.
svc.proxmox.cluster.corosync_active		0/1	Cluster membership daemon state; emitted only where a cluster exists, so single nodes never false-alarm.
svc.corosync.unit_active		0/1	The corosync service itself, where monitored as its own service.
svc.libvirt.domains / .running			Defined and running domains.
svc.libvirt.guest.running	domain	0/1	Per-domain state.
svc.libvirt.guest.vcpus / .guest.mem_bytes / .guest.cpu_time_ns	domain		Per-domain resources.
svc.libvirt.storage.capacity_bytes / .storage.used_bytes / .storage.used_pct	storage		Storage pools.
svc.hyperv.domains / .running			Hyper-V VMs total and running.
svc.hyperv.guest.running	vm	0/1	Per-VM state.
svc.hyperv.guest.vcpus / .guest.mem_bytes / .guest.uptime_sec	vm		Per-VM resources.
svc.docker.containers / .containers_running			Containers total and running.
svc.docker.services			Image groups (the billing unit).
svc.docker.group.containers / .group.running	image		Per-group counts.
svc.docker.group.cpu_pct / .group.mem_bytes	image		Per-group usage.
svc.docker.group.net_rx_total / .group.net_tx_total	image	bytes	Per-group network (cumulative).
svc.docker.group.blkio_read_total / .group.blkio_write_total	image	bytes	Per-group block IO (cumulative).
svc.docker.group.restarts	image	count	Restarts across the group (cumulative).
svc.docker.group.restarts_1h	image		Restarts in the last hour: the crash-loop signal a threshold can actually judge.
svc.docker.group.unhealthy	image		Unhealthy containers (only for groups with healthchecks).

Replicated storage (DRBD, LINSTOR)

Per-resource and per-connection replication health. The link tag names a resource-to-peer pair; transient backup-snapshot resources are skipped at the source, so nightly dumps never masquerade as replication trouble.

Metric	Tags	Unit	What it is
svc.drbd.resources			DRBD resources on this node.
svc.drbd.resource.primary / .resource.suspended	res	0/1	Per-resource role and suspension.
svc.drbd.resource.replicas_uptodate	res		Up-to-date replicas of the resource.
svc.drbd.device.uptodate / .device.quorum	res	0/1	Local device state and quorum.
svc.drbd.connection.established	link	0/1	Whether the replication link is up.
svc.drbd.connection.flaps_hour	link		Link state changes in the last hour (computed at the source).
svc.drbd.peer.oos_kib / .peer.oos_lingering_kib	link	KiB	Out-of-sync data, and out-of-sync that lingers on an established link.
svc.drbd.peer.resync_percent / .peer.eta_sec	link		Resync progress and estimate.
svc.drbd.peer.resync_stalled	link	0/1	A resync that stopped making progress.
svc.linstor.node.online	node	0/1	Satellite liveness as the controller sees it.
svc.linstor.netif.on_default	node	0/1	Whether a node's traffic rides its default interface (0 = stuck on a failsafe path).
svc.linstor.pool.free_pct	pool	%	Free space per storage pool per node.
svc.linstor.error_reports_hour			New controller error reports in the last hour.
svc.linstor.stale_snapshots			Backup snapshots older than a day that should have been cleaned up.

Kubernetes

See Kubernetes for how these are collected.

Metric	Tags	Unit	What it is
svc.k8s.nodes / .nodes_ready			Nodes total and ready.
svc.k8s.nodes_ready_pct		%	Ready nodes as a percentage (computed at the source so one number drives the rule).
svc.k8s.pods			Pods total.
svc.k8s.pods_running / .pods_pending / .pods_failed / .pods_crashloop			Pod phase split.
svc.k8s.restarts_total		count	Container restarts across the cluster.
svc.k8s.namespaces			Namespaces.
svc.k8s.ns.pods / .ns.cpu_millicores / .ns.mem_bytes	namespace		Per-namespace usage.
svc.k8s.pod.cpu_millicores / .pod.mem_bytes	namespace, pod		Top pods by CPU.

Windows

Metric	Tags	Unit	What it is
svc.iis.sites / .sites_started			IIS sites total and started.
svc.iis.sites_started_pct / .pools_started_pct		%	Started share, computed at the source.
svc.iis.pools / .pools_started			App pools total and started.
svc.iis.worker_processes			Running w3wp processes.
svc.iis.site.started	site	0/1	Per-site state.
svc.iis.pool.started	pool	0/1	Per-pool state.
svc.windows.errors / .warnings / .events	channel	count	Event Log entries in the window, per channel (System, Application).

MSSQL metrics are in the databases table above.

OS health and security

Metric	Tags	Unit	What it is
svc.os.updates_pending		count	Pending package updates (apt, dnf, dnf5, zypper, apk).
svc.os.security_updates		count	Pending security updates.
svc.os.cves_pending		count	CVE and package pairs pending (RHEL family, local data).
svc.os.security_critical / .security_important / .security_moderate / .security_low		count	Severity split where the distribution publishes it.
svc.os.security_notices		count	Security notices (dnf5).
svc.os.reboot.exists		0/1	Reboot required flag (/var/run/reboot-required).
svc.ssh.auth_fail_rate		/s	Failed SSH logins per second (brute-force signal).
svc.ssh.accepted_rate		/s	Accepted SSH logins per second.
svc.ssh.root_login_rate		/s	Accepted logins for root per second.
svc.ssh.root_login_permitted		0/1	Root can log in with a password in the configuration sshd actually runs with (sshd -T, or the parsed sshd_config before the first connection on a socket-activated host): PermitRootLogin yes together with PasswordAuthentication or keyboard-interactive authentication on. Key-only root reads 0.
svc.ssh.password_auth_on		0/1	PasswordAuthentication is yes in the effective configuration, read the same way.
svc.systemd.failed_units		count	Failed systemd units.
svc.systemd.degraded		0/1	System state degraded.
svc.systemd.oom_kills_rate		/s	Kernel OOM kills per second.
svc.cis.score		%	Hardening scan: share of CIS-subset checks passed.
svc.cis.pass / svc.cis.fail		count	Hardening checks passed and failed; the failed ones ride an event with severities.
svc.cron.runs_rate / .error_rate		/s	Cron job runs and cron's own errors from the journal.
svc.cron.job_failed_rate		/s	Jobs that exited non-zero: a client job failing is its own signal, separate from cron being broken.
svc.vsftpd.login_rate / .login_fail_rate		/s	FTP logins and failures.
svc.vsftpd.upload_rate / .download_rate		/s	FTP transfers per second.
svc.pure-ftpd.sessions			Live FTP sessions.
svc.pure-ftpd.login_rate / .login_fail_rate		/s	Pure-FTPd logins and failures (a failure spike is the FTP brute-force signal).
svc.pure-ftpd.upload_rate / .download_rate		/s	Transfers per second.

Backups

The file probe pattern is svc.<service>.<probe>.exists (0/1) and svc.<service>.<probe>.age_sec (seconds since the newest write). The stock backup definitions produce:

Metric	Unit	What it is
svc.backup.artifact.age_sec	s	Age of the artifact at your configured backup.path.
svc.backup.artifact.exists	0/1	Whether the path exists.
svc.borg.repo.age_sec	s	Age of the newest write in the borg repository.
svc.restic.repo.age_sec	s	Age of the newest write in the restic repository.

APM

RED metrics from the zero-touch layer (see APM):

Metric	Tags	Unit	What it is
apm.http.req_rate	port	req/s	HTTP requests per second on the watched port.
apm.http.error_rate / .client_error_rate	port	req/s	5xx and 4xx per second.
apm.http.p50_ms / .p95_ms / .max_ms	port	ms	Request latency percentiles and max.
apm.backend.call_rate	component	calls/s	Outbound calls to a downstream (db, cache, ext).
apm.backend.p50_ms / .p95_ms / .max_ms	component	ms	Downstream round-trip latency.

Instrumentation state and the profiler:

Metric	Tags	Unit	What it is
svc.apm-php.instrumented	php	0/1	Whether spans instrumentation is active, per PHP minor.
svc.apm-dotnet.instrumented		0/1	Whether the .NET instrumentation is active.
svc.apm-profile.busy_pct		%	Share of profiler samples that were on-CPU.
svc.apm-profile.unique_stacks			Distinct folded stacks in the window.
svc.apm-profile.owner_pct	owner	%	CPU share per owner (plugin:X, theme:X, wp-core, app) in the last window.
svc.apm-profile.owner_samples	owner	count	Raw sample counts per owner (sums correctly over time windows).

Traces, profiles and RUM beacons are not metrics; they flow through their own pipelines.

External checks

From a collector host you designate (the ext probe), plus domain expiry:

Metric	Tags	Unit	What it is
ext.<service>.up	url	0/1	Check verdict (status under 500 and body matched, when configured).
ext.<service>.latency_ms	url	ms	Total request time.
ext.<service>.status	url		HTTP status code.
ext.<service>.dns_ms / .connect_ms / .tls_ms / .ttfb_ms	url	ms	Phase timings.
ext.<service>.ssl_days_left / .ssl_trusted	url		Certificate days left and chain trust, from the external vantage.
ext.<service>.body_match	url	0/1	Whether the expected body pattern matched.
ext.domain.days_left	domain	days	Days until the domain registration expires (RDAP, WHOIS fallback).
ext.domain.age_days	domain	days	Age of the domain registration.

Synthetics

Outside-in probes of your public sites, measured by Wakora's points of presence rather than by the agent (see Availability). They ride the normal metric stream, so rules can reference them like anything else.

Metric	Tags	Unit	What it is
ext.web.up	site, pop	0/1	Whether the site answered from that vantage.
ext.web.status	site, pop		HTTP status seen from that vantage.
ext.web.latency_ms	site, pop	ms	Response time from that vantage.
ext.txn.up	flow, pop	0/1	Whether the whole transaction flow passed from that vantage.
ext.txn.duration_ms	flow, pop	ms	Total flow duration.
ext.txn.steps_ok	flow, pop		How many steps passed before the flow ended.
ext.txn.step_ms	flow, pop, step	ms	Per-step timing for the steps that passed.

SNMP devices

Every dev.* point carries the device tag (the polled target). Walks add a per-row tag from the device's own labels (interface name, sensor name). See SNMP and network.

Metric	Tags	Unit	What it is
dev.sys.uptime	device	ticks	Device uptime.
dev.if.oper_status	device, interface label		Interface operational status (1 = up).
dev.if.in_octets / .out_octets	device, interface label	bytes	Traffic counters (cumulative).
dev.if.in_errors / .out_errors	device, interface label	count	Error counters (cumulative).
dev.if.in_errors_per_min / .out_errors_per_min	device, interface label	/min	Errors per minute per port, derived on the collector.
dev.if.link_lost	device, port	0/1	A port that used to carry a link went dark while administratively up; never-used ports do not count, and an admin shutdown resets the memory.
dev.ups.charge_pct	device	%	UPS battery charge.
dev.ups.battery_status / .output_source	device	enum	UPS states (UPS-MIB values).
dev.ups.seconds_on_battery / .minutes_remaining	device		Runtime on battery and estimate remaining.
dev.ups.battery_voltage_dv / .battery_temp_c	device		Battery voltage (tenths of volts) and temperature.
dev.ups.output_load_pct	device	%	Output load.
dev.sensor.value	device, sensor, type	varies	Any ENTITY-SENSOR-MIB sensor: celsius, voltsDC, amperes, watts, rpm, dBm.
dev.sensor.ok	device, sensor	0/1	Sensor operational status.
dev.poe.ports_delivering	device		PoE ports currently delivering power.
dev.poe.consumption_watts	device	W	Total PoE power draw.
dev.poe.detection_status / .admin / .class / .priority	device, port		Per-port PoE state.
dev.vendor.<vendor>.*	device	varies	Vendor OID bundles (for example APC battery and load, MikroTik voltage and temperature).
dev.traps.received_total / .dropped_total		count	Traps accepted and rejected by the listener.
dev.syslog.rate / .severe_rate		/s	Syslog lines per second, and err-or-worse lines.
dev.syslog.dropped_total		count	Syslog lines dropped by the allow filter.
dev.scan.responders / .scanned	range		Subnet scan results (candidates found versus addresses probed).
dev.flow.bytes_per_sec	device	B/s	Flow-reported traffic rate per exporter (NetFlow/IPFIX).
dev.flow.flows_per_sec	device	/s	Flow records per second per exporter.
dev.flow.dropped_total		count	Flow packets dropped by the exporter allow list or an unknown template.

Custom application metrics

Anything your own apps POST to the local ingest port lands under app.* with the tags you send, subject to namespace, cardinality and size limits. See Local ingest ports.