--- title: "Monitor your Public Cloud Load Balancer with Prometheus" description: "Learn about the various options available to monitor your Octavia Load Balancer." url: https://docs.us.ovhcloud.com/en/public-cloud/network-services/loadbalancer-monitoring-prometheus lang: en --- > For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt. # Monitor your Public Cloud Load Balancer with Prometheus **Learn about the various options available to monitor your Octavia Load Balancer.** The Public Cloud Load Balancer provides two ways to monitor your Load Balancers: either query an API to retrieve usage statistics or configure a Prometheus listener that your Prometheus infrastructure can scrape to collect metrics.   ## Requirements - A [Load Balancer](https://docs.us.ovhcloud.com/en/public-cloud/network-services/getting-started-load-balancer.md) created. #### OVHcloud Control Panel Access - **Direct link:** [Public Cloud projects](https://manager.us.ovhcloud.com/#/public-cloud/pci/projects) - **Navigation path:** `Public Cloud` > Select your project   ## Instructions ### Monitoring using CLI The Load Balancer service aggregates these statistics and makes them available via the OpenStack API. Those statistics are available at the Load Balancer or listener level. Load Balancer statistics can be queried using the [OpenStack Client](https://docs.openstack.org/python-openstackclient/latest/). They include metrics for all the listeners configured for the queried Load Balancer. ``` $ openstack loadbalancer stats show +--------------------+-----------+ | Field | Value | +--------------------+-----------+ | active_connections | 0 | | bytes_in | 2236722 | | bytes_out | 100973832 | | request_errors | 0 | | total_connections | 3606 | +--------------------+-----------+ ``` Individual listener statistics can also be queried using the [OpenStack Client](https://docs.openstack.org/python-openstackclient/latest/). ``` $ openstack loadbalancer listener stats show +--------------------+-------+ | Field | Value | +--------------------+-------+ | active_connections | 0 | | bytes_in | 89 | | bytes_out | 237 | | request_errors | 0 | | total_connections | 1 | +--------------------+-------+ ```   ### Monitoring with Prometheus To add a Prometheus endpoint on a Public Cloud Load Balancer, create a listener with a `PROMETHEUS` protocol. This will enable the `/metrics` endpoint, which listens on all the interfaces of your Load Balancer by default. **This means that if your Load Balancer is using a Floating IP, by default the **`/metrics`** endpoint will be opened to the Internet.** To avoid that, we advise setting the `allowed_cidrs` option to protect your metrics, for example with the CIDR of the subnet where the Load Balancer is spawned. This listener type provides the same features as the "regular" listeners but does not support attaching pools or L7 policies. All metrics will be identified by the Octavia object ID (UUID) of the resources. **Note:** Currently, UDP and SCTP-specific metrics are not reported via Prometheus endpoints.   ### Create a Prometheus listener #### OVHcloud Control Panel #### Via the OVHcloud Control Panel **Warning:** The `allowed_cidrs` option is not yet available in the OVHcloud Control Panel: you can create the listener here, but to restrict access to the metrics endpoint you must set `allowed_cidrs` via the OVHcloud API, the OpenStack CLI or Horizon. 1. Select `Public Cloud` from the top navigation bar. 2. In the left-hand menu under **Network**, select `Load Balancer`. 3. Select the `name` of the load balancer. 4. Select the `Listeners` tab. 5. Click `+ Add a listener`. 6. Fill in a **name**, select Prometheus as the **Protocol**, and choose a **Port** (different from the already existing listener ports of your Load Balancer). **Note:** The default pool is grayed out because the Prometheus listener does not need a pool, unlike the other types of listeners. 7. Click `Add` to trigger the listener creation. The new listener is added to the listeners list. ##### OVHcloud API #### Via the OVHcloud API You can create the Prometheus listener directly via the OVHcloud API, which lets you set `allowedCidrs` at creation: [POST /cloud/project/{serviceName}/region/{regionName}/loadbalancing/listener](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#post-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/listener) In the path parameters, `serviceName` is your Public Cloud project ID and `regionName` is the region of your Load Balancer (for example `US-EAST-VA-1`). In the request body, set `protocol` to `prometheus`, choose a `port`, reference your `loadbalancerId`, and provide `allowedCidrs` with the subnets allowed to reach the metrics endpoint (for example `["192.0.2.0/24"]`). To change the allowed CIDRs on an existing listener, use the same `allowedCidrs` property on the update endpoint, where `listenerId` is the ID of the existing listener: [PUT /cloud/project/{serviceName}/region/{regionName}/loadbalancing/listener/{listenerId}](https://api.us.ovhcloud.com/console/?section=/cloud&branch=v1#put-/cloud/project/-serviceName-/region/-regionName-/loadbalancing/listener/-listenerId-) ##### Horizon #### Via Horizon Log in to Horizon using [this guide](https://docs.us.ovhcloud.com/en/public-cloud/cross-functional/introducing-horizon.md). Click `Network` and then `Load Balancers`. The Load Balancer list is displayed. Click on the load balancer `name`. The load balancer details page is then displayed. Click the `Listeners` tab and then `Create Listener`. On the listener creation page, fill in the **Name** and switch the **Protocol** to `PROMETHEUS`. The port will be set to a default value that you can change if needed. You can also fill in the `Allowed CIDRs` field to restrict access to the metrics endpoint. Enter the CIDR of the subnet where your Prometheus scraper runs (e.g. `192.0.2.0/24`). Leave it empty only if your Load Balancer has no Floating IP. Click `Create Listener`. ##### OpenStack CLI #### Via OpenStack CLI To create a Prometheus endpoint on port 9100 for Load Balancer lb1, you would run the following command: ``` $ openstack loadbalancer listener create --name stats-listener --protocol PROMETHEUS --protocol-port 9100 lb1 +-----------------------------+--------------------------------------+ | Field | Value | +-----------------------------+--------------------------------------+ | admin_state_up | True | | connection_limit | -1 | | created_at | 2023-11-30T01:44:25 | | default_pool_id | None | | default_tls_container_ref | None | | description | | | id | fb57d764-470a-4b6b-8820-627452f55b96 | | insert_headers | None | | l7policies | | | loadbalancers | b081ed89-f6f8-48cb-a498-5e12705e2cf9 | | name | stats-listener | | operating_status | OFFLINE | | project_id | 4c1caeee063747f8878f007d1a323b2f | | protocol | PROMETHEUS | | protocol_port | 9100 | | provisioning_status | PENDING_CREATE | | sni_container_refs | [] | | timeout_client_data | 50000 | | timeout_member_connect | 5000 | | timeout_member_data | 50000 | | timeout_tcp_inspect | 0 | | updated_at | None | | client_ca_tls_container_ref | None | | client_authentication | NONE | | client_crl_container_ref | None | | allowed_cidrs | None | | tls_ciphers | None | | tls_versions | None | | alpn_protocols | None | | tags | | +-----------------------------+--------------------------------------+ ``` To restrict access to the metrics endpoint to a specific subnet, add the `--allowed-cidr` option to the command above: ``` $ openstack loadbalancer listener create --name stats-listener --protocol PROMETHEUS --protocol-port 9100 --allowed-cidr 192.0.2.0/24 lb1 ``` Replace `192.0.2.0/24` with the CIDR of the subnet where your Prometheus scraper runs. You can repeat the option to allow multiple CIDRs. ##### Terraform #### Via Terraform The resource [openstack\_lb\_listener\_v2](https://registry.terraform.io/providers/terraform-provider-openstack/openstack/latest/docs/resources/lb_listener_v2) from the OpenStack provider enables you to configure a Prometheus listener. The following snippet is extracted from a full example available on [GitHub](https://github.com/yomovh/tf-at-ovhcloud/tree/main/simple_http_lb_with_prom_grafana) that you can adapt to your needs. ``` resource "openstack_lb_listener_v2" "prom_listener" { protocol = "PROMETHEUS" protocol_port = 9100 loadbalancer_id = openstack_lb_loadbalancer_v2.tf_lb.id #restrict the access of the listener to the private network subnet allowed_cidrs = [openstack_networking_subnet_v2.tf_lb_subnet.cidr] } ```   ### Configure Prometheus to collect your metrics Once the `PROMETHEUS` listener is `ACTIVE`, you can configure Prometheus to collect metrics from the Load Balancer by updating the `prometheus.yml` file. ``` [scrape_configs] - job_name: 'Octavia LB1' static_configs: - targets: ['loadbalancer-IP:9100'] ``` **Warning:** **NOTE:** If your Prometheus server is running within your private network, you can use the virtual IP of the load balancer as the target IP in the `prometheus.yml` file. Otherwise, you must add a public Floating IP to your load balancer and use it as the target IP. **Example **`prometheus.yml`** file:** ``` global:   scrape_interval:     15s # By default, scrape targets every 15 seconds.   # Attach these labels to any time series or alerts when communicating with   # external systems (federation, remote storage, Alertmanager).   external_labels:     monitor: 'codelab-monitor' # A scrape configuration containing exactly one endpoint to scrape: # Here it's Prometheus itself. scrape_configs:   # The job name is added as a label `job=` to any timeseries scraped from this config.   - job_name: 'prometheus'     # Override the global default and scrape targets from this job every 5 seconds.     scrape_interval: 5s    static_configs:       - targets: ['localhost:9090']   - job_name: 'Octavia LB1'     static_configs:       - targets: ['10.xxx.xxx.170:9100'] ``` For more information on setting up Prometheus, see the [Prometheus project website](https://prometheus.io/). You can connect [Grafana](https://grafana.com/) to the [Prometheus](https://prometheus.io/) instance to provide additional graphing and dashboard capabilities. A Grafana dashboard for Octavia Load Balancers is available [here](https://grafana.com/grafana/dashboards/15828-octavia-amphora-load-balancer/). The metrics have the following naming format: - `octavia_loadbalancer_xxx` or `octavia_memory_pool_xxx` metrics are global to the Load Balancer - `octavia_listener_xxx` metrics are instantiated per listener using the label \{listener=ID} - `octavia_pool_xxx` metrics are instantiated per pool using the label \{pool=ID} - `octavia_member_xxx` metrics are instantiated per member using the label \{member=ID} | Metric | Description | | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | octavia\_loadbalancer\_cpu | Load balancer CPU utilization (percentage). | | octavia\_loadbalancer\_memory | Load balancer memory utilization (percentage). | | octavia\_memory\_pool\_allocated\_bytes | Total amount of memory allocated in the memory pools (in bytes). | | octavia\_memory\_pool\_used\_bytes | Total amount of memory used in the memory pools (in bytes). | | octavia\_memory\_pool\_failures\_total | Total number of failed memory pool allocations. | | octavia\_loadbalancer\_max\_connections | Maximum number of concurrent connections. | | octavia\_loadbalancer\_current\_connections | Number of active sessions. | | octavia\_loadbalancer\_connections\_total | Total number of created sessions. | | octavia\_loadbalancer\_requests\_total | Total number of requests (TCP or HTTP). | | octavia\_loadbalancer\_max\_ssl\_connections | Configured maximum number of concurrent SSL connections. | | octavia\_loadbalancer\_current\_ssl\_connections | Number of active SSL connections. | | octavia\_loadbalancer\_ssl\_connections\_total | Total number of opened SSL connections. | | octavia\_loadbalancer\_current\_connection\_rate | Current number of connections per second over last elapsed second. | | octavia\_loadbalancer\_limit\_connection\_rate | Configured maximum number of connections per second. | | octavia\_loadbalancer\_max\_connection\_rate | Maximum observed number of connections per second. | | octavia\_loadbalancer\_current\_session\_rate | Current number of sessions per second over last elapsed second. | | octavia\_loadbalancer\_limit\_session\_rate | Configured maximum number of sessions per second. | | octavia\_loadbalancer\_max\_session\_rate | Maximum observed number of sessions per second. | | octavia\_loadbalancer\_current\_ssl\_rate | Current number of SSL sessions per second over last elapsed second. | | octavia\_loadbalancer\_limit\_ssl\_rate | Configured maximum number of SSL sessions per second. | | octavia\_loadbalancer\_max\_ssl\_rate | Maximum observed number of SSL sessions per second. | | octavia\_loadbalancer\_current\_frontend\_ssl\_key\_rate | Current frontend SSL Key computation per second over last elapsed second. | | octavia\_loadbalancer\_max\_frontend\_ssl\_key\_rate | Maximum observed frontend SSL Key computation per second. | | octavia\_loadbalancer\_current\_backend\_ssl\_key\_rate | Current backend SSL Key computation per second over last elapsed second. | | octavia\_loadbalancer\_max\_backend\_ssl\_key\_rate | Maximum observed backend SSL Key computation per second. | | octavia\_loadbalancer\_ssl\_cache\_lookups\_total | Total number of SSL session cache lookups. | | octavia\_loadbalancer\_ssl\_cache\_misses\_total | Total number of SSL session cache misses. | | octavia\_loadbalancer\_http\_comp\_bytes\_in\_total | Number of bytes per second over last elapsed second, before http compression. | | octavia\_loadbalancer\_http\_comp\_bytes\_out\_total | Number of bytes per second over last elapsed second, after http compression. | | octavia\_loadbalancer\_limit\_http\_comp | Configured maximum input compression rate in bytes. | | octavia\_loadbalancer\_listeners | Current number of active listeners. | | octavia\_loadbalancer\_dropped\_logs\_total | Total number of dropped logs. | | octavia\_listener\_status | Current status of the listener. 0=OFFLINE, 1=ONLINE, 2=DEGRADED. | | octavia\_listener\_current\_sessions | Current number of active sessions. | | octavia\_listener\_max\_sessions | Maximum observed number of active sessions. | | octavia\_listener\_limit\_sessions | Configured session limit. | | octavia\_listener\_sessions\_total | Total number of sessions. | | octavia\_listener\_limit\_session\_rate | Configured limit on new sessions per second. | | octavia\_listener\_max\_session\_rate | Maximum observed number of sessions per second. | | octavia\_listener\_connections\_rate\_max | Maximum observed number of connections per second. | | octavia\_listener\_connections\_total | Total number of connections. | | octavia\_listener\_bytes\_in\_total | Current total of incoming bytes. | | octavia\_listener\_bytes\_out\_total | Current total of outgoing bytes. | | octavia\_listener\_requests\_denied\_total | Total number of denied requests. | | octavia\_listener\_responses\_denied\_total | Total number of denied responses. | | octavia\_listener\_request\_errors\_total | Total number of request errors. | | octavia\_listener\_denied\_connections\_total | Total number of requests denied by connection rules. | | octavia\_listener\_denied\_sessions\_total | Total number of requests denied by session rules. | | octavia\_listener\_failed\_header\_rewriting\_total | Total number of failed header rewriting rules. | | octavia\_listener\_http\_requests\_rate\_max | Maximum observed number of HTTP requests per second. | | octavia\_listener\_http\_requests\_total | Total number of HTTP requests received. | | octavia\_listener\_http\_responses\_total | Total number of HTTP responses. | | octavia\_listener\_intercepted\_requests\_total | Total number of intercepted HTTP requests. | | octavia\_listener\_http\_cache\_lookups\_total | Total number of HTTP cache lookups. | | octavia\_listener\_http\_cache\_hits\_total | Total number of HTTP cache hits. | | octavia\_listener\_http\_comp\_bytes\_in\_total | Total number of HTTP response bytes fed to the compressor. | | octavia\_listener\_http\_comp\_bytes\_out\_total | Total number of HTTP response bytes emitted by the compressor. | | octavia\_listener\_http\_comp\_bytes\_bypassed\_total | Total number of bytes that bypassed the HTTP compressor (CPU/BW limit). | | octavia\_listener\_http\_comp\_responses\_total | Total number of HTTP responses that were compressed. | | octavia\_pool\_status | Current status of the pool. 0=OFFLINE, 1=ONLINE. | | octavia\_pool\_current\_sessions | Current number of active sessions. | | octavia\_pool\_max\_sessions | Maximum observed number of active sessions. | | octavia\_pool\_limit\_sessions | Configured session limit. | | octavia\_pool\_sessions\_total | Total number of sessions. | | octavia\_pool\_max\_session\_rate | Maximum observed number of sessions per second. | | octavia\_pool\_last\_session\_seconds | Number of seconds since last session assigned to a member. | | octavia\_pool\_current\_queue | Current number of queued requests. | | octavia\_pool\_max\_queue | Maximum observed number of queued requests. | | octavia\_pool\_connection\_attempts\_total | Total number of connection establishment attempts. | | octavia\_pool\_connection\_reuses\_total | Total number of connection reuses. | | octavia\_pool\_bytes\_in\_total | Current total of incoming bytes. | | octavia\_pool\_bytes\_out\_total | Current total of outgoing bytes. | | octavia\_pool\_queue\_time\_average\_seconds | Avg. queue time for last 1024 successful connections. | | octavia\_pool\_connect\_time\_average\_seconds | Avg. connect time for last 1024 successful connections. | | octavia\_pool\_response\_time\_average\_seconds | Avg. response time for last 1024 successful connections. | | octavia\_pool\_total\_time\_average\_seconds | Avg. total time for last 1024 successful connections. | | octavia\_pool\_max\_queue\_time\_seconds | Maximum observed time spent in the queue | | octavia\_pool\_max\_connect\_time\_seconds | Maximum observed time spent waiting for a connection to complete | | octavia\_pool\_max\_response\_time\_seconds | Maximum observed time spent waiting for a member response. | | octavia\_pool\_max\_total\_time\_seconds | Maximum observed total request+response time (request+queue+connect+response+processing) | | octavia\_pool\_requests\_denied\_total | Total number of denied requests. | | octavia\_pool\_responses\_denied\_total | Total number of denied responses. | | octavia\_pool\_connection\_errors\_total | Total number of connection errors. | | octavia\_pool\_response\_errors\_total | Total number of response errors. | | octavia\_pool\_retry\_warnings\_total | Total number of retry warnings. | | octavia\_pool\_redispatch\_warnings\_total | Total number of redispatch warnings. | | octavia\_pool\_failed\_header\_rewriting\_total | Total number of failed header rewriting warnings. | | octavia\_pool\_client\_aborts\_total | Total number of data transfers aborted by the client. | | octavia\_pool\_member\_aborts\_total | Total number of data transfers aborted by the server. | | octavia\_pool\_active\_members | Current number of active members. | | octavia\_pool\_backup\_members | Current number of backup members. | | octavia\_pool\_check\_up\_down\_total | Total number of UP->DOWN transitions. | | octavia\_pool\_check\_last\_change\_seconds | Number of seconds since the last UP\<->DOWN transition. | | octavia\_pool\_downtime\_seconds\_total | Total downtime (in seconds) for the pool. | | octavia\_pool\_loadbalanced\_total | Total number of times a pool was selected, either for new sessions, or when redispatching. | | octavia\_pool\_http\_requests\_total | Total number of HTTP requests received. | | octavia\_pool\_http\_responses\_total | Total number of HTTP responses. | | octavia\_pool\_http\_cache\_lookups\_total | Total number of HTTP cache lookups. | | octavia\_pool\_http\_cache\_hits\_total | Total number of HTTP cache hits. | | octavia\_pool\_http\_comp\_bytes\_in\_total | Total number of HTTP response bytes fed to the compressor. | | octavia\_pool\_http\_comp\_bytes\_out\_total | Total number of HTTP response bytes emitted by the compressor. | | octavia\_pool\_http\_comp\_bytes\_bypassed\_total | Total number of bytes that bypassed the HTTP compressor (CPU/BW limit). | | octavia\_pool\_http\_comp\_responses\_total | Total number of HTTP responses that were compressed. | | octavia\_member\_status | Current status of the member. 0=ERROR, 1=ONLINE, 2=OFFLINE, 3=DRAIN. | | octavia\_member\_current\_sessions | Current number of active sessions. | | octavia\_member\_max\_sessions | Maximum observed number of active sessions. | | octavia\_member\_limit\_sessions | Configured session limit. | | octavia\_member\_sessions\_total | Total number of sessions. | | octavia\_member\_max\_session\_rate | Maximum observed number of sessions per second. | | octavia\_member\_last\_session\_seconds | Number of seconds since last session assigned to the member. | | octavia\_member\_current\_queue | Current number of queued requests. | | octavia\_member\_max\_queue | Maximum observed number of queued requests. | | octavia\_member\_queue\_limit | Configured maxqueue for the member (0 meaning no limit). | | octavia\_member\_bytes\_in\_total | Current total of incoming bytes. | | octavia\_member\_bytes\_out\_total | Current total of outgoing bytes. | | octavia\_member\_queue\_time\_average\_seconds | Avg. queue time for last 1024 successful connections. | | octavia\_member\_connect\_time\_average\_seconds | Avg. connect time for last 1024 successful connections. | | octavia\_member\_response\_time\_average\_seconds | Avg. response time for last 1024 successful connections. | | octavia\_member\_total\_time\_average\_seconds | Avg. total time for last 1024 successful connections. | | octavia\_member\_max\_queue\_time\_seconds | Maximum observed time spent in the queue | | octavia\_member\_max\_connect\_time\_seconds | Maximum observed time spent waiting for a connection to complete | | octavia\_member\_max\_response\_time\_seconds | Maximum observed time spent waiting for a member response. | | octavia\_member\_max\_total\_time\_seconds | Maximum observed total request+response time (request+queue+connect+response+processing) | | octavia\_member\_connection\_attempts\_total | Total number of connection establishment attempts. | | octavia\_member\_connection\_reuses\_total | Total number of connection reuses. | | octavia\_member\_responses\_denied\_total | Total number of denied responses. | | octavia\_member\_connection\_errors\_total | Total number of connection errors. | | octavia\_member\_response\_errors\_total | Total number of response errors. | | octavia\_member\_retry\_warnings\_total | Total number of retry warnings. | | octavia\_member\_redispatch\_warnings\_total | Total number of redispatch warnings. | | octavia\_member\_failed\_header\_rewriting\_total | Total number of failed header rewriting warnings. | | octavia\_member\_client\_aborts\_total | Total number of data transfers aborted by the client. | | octavia\_member\_server\_aborts\_total | Total number of data transfers aborted by the server. | | octavia\_member\_weight | Member weight. | | octavia\_member\_check\_failures\_total | Total number of failed check (Only counts checks failed when the member is up). | | octavia\_member\_check\_up\_down\_total | Total number of UP->DOWN transitions. | | octavia\_member\_downtime\_seconds\_total | Total downtime (in seconds) for the member. | | octavia\_member\_check\_last\_change\_seconds | Number of seconds since the last UP\<->DOWN transition. | | octavia\_member\_current\_throttle | Current throttle percentage for the member, when slowstart is active, or no value if not in slowstart. | | octavia\_member\_loadbalanced\_total | Total number of times a member was selected, either for new sessions, or when redispatching. | | octavia\_member\_http\_responses\_total | Total number of HTTP responses. | | octavia\_member\_idle\_connections\_current | Current number of idle connections available for reuse | | octavia\_member\_idle\_connections\_limit | Limit on the number of available idle connections |   ## Go further If you want to automate this scenario with Terraform and our managed Grafana service, you can find a ready-to-run example on this [GitHub repository](https://github.com/yomovh/tf-at-ovhcloud). Browse all the [Networking guides](https://docs.us.ovhcloud.com/en/public-cloud/network-services/landing-page-network-services.md). Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services. Learn more about [Public Cloud Network](https://us.ovhcloud.com/public-cloud/network/) on the OVHcloud US website. If you need training or technical assistance to implement our solutions, contact your sales representative or click on [this link](https://us.ovhcloud.com/professional-services/) to get a quote and ask our Professional Services experts for a custom analysis of your project.