# Trace, stats and metrics

> See what moat rules decide: moat stats counters, moat trace for live packets or a pcap, and moat metrics for Prometheus.

Source: https://moatfw.dev/docs/observability

## Stats

```sh
$ moat stats --iface eth0 [--watch | --json]
```

Packets and bytes for every rule, in rule order, then the default
action. In audit mode, rules that drop show as "would drop"; `--watch`
follows audit being turned on or off.

## Variables

```sh
$ moat var list --iface eth0 [--json]
```

The current value of every variable on the running program.

## Trace

```sh
$ moat trace --iface eth0 [--rule NAME] [--count N] [-w FILE]
```

Prints the packets a rule (or every rule) decides, one line each, or
writes them to a pcap file with `-w`. The program sends the first 128
bytes of each matching frame only while a trace runs. Only one trace per
interface runs at a time; if `moat trace` is killed, tracing stays on
until `moat trace --off` or a reload. When the rules are reloaded or
unloaded under a running trace, it ends with "the rules on eth0 were
reloaded or unloaded; run moat trace again to follow the new program".

## Metrics

```sh
$ moat metrics [--iface eth0] [--listen 127.0.0.1:PORT]
```

`moat metrics` prints what every interface with rules loaded holds, in
the Prometheus text format; `--iface` limits it to one interface. Write
it to a file node_exporter's textfile collector reads, or serve it with
`--listen`, which answers on `/metrics` until interrupted.

| Metric | Labels | Meaning |
|--------|--------|---------|
| `moat_rule_packets_total`, `moat_rule_bytes_total` | iface, rule, verdict | What each rule decided, and the default action. |
| `moat_set_entries`, `moat_set_size` | iface, set | Entries in each set, and how many it holds at most. |
| `moat_variable_value` | iface, variable | Each runtime variable; 1 or 0 for true or false. |
| `moat_audit_mode` | iface | 1 in audit mode. |
| `moat_program_load_timestamp_seconds` | iface | When the rules were loaded. |