Chapter 4. Monitoring the Record Encryption filter
This section describes how to monitor the Record Encryption filter.
4.1. Record Encryption filter metrics Copy linkLink copied to clipboard!
The filter emits metrics that provide insights into its interactions with the configured KMS. They indicate the load the filter places on the KMS infrastructure and how often its interactions with the KMS fail.
The filter emits metrics that count the number of records that are being encrypted. This can help you verify that the filter is configured properly and encrypting specific topics as intended.
These metrics are made available automatically once metrics are enabled in the proxy.
4.1.1. KMS metrics Copy linkLink copied to clipboard!
KMS metrics track and count the following types of interactions:
- Generating DEK pairs
- Decrypting EDEKs
- Resolving KEK aliases
| Metric Name | Type | Labels | Description |
|---|---|---|---|
|
| Counter |
| Count of the number of KMS operations attempted. |
|
| Counter |
| Count of the number of KMS operations grouped by outcome. |
| Label | Domain | Description |
|---|---|---|
|
|
| Type of operation performed. |
|
|
| Result of the operation. |
4.1.2. Encryption accounting metrics Copy linkLink copied to clipboard!
Encryption accounting metrics count the number of records sent to topics that are encrypted and the number of records sent to topics that are not configured for encryption. These metrics are discriminated by topic name. Use these metrics to confirm you configuration is having the effect you desired.
| Metric Name | Type | Labels | Description |
|---|---|---|---|
|
| Counter |
| Count of the number of records encrypted by the filter. |
|
| Counter |
| Count of the number of records not encrypted by the filter. |