Vault

Auto-Detection

Built-in Metrics

Prometheus Metrics

HashiCorp Vault is a secrets management tool that exposes Prometheus-formatted metrics through its telemetry subsystem.

Glouton can monitor Vault in two ways:

• Auto-detection — recommended, minimal configuration. Glouton detects Vault and collects a curated set of built-in metrics.
• Prometheus metrics — scrape Vault’s telemetry endpoint yourself for a fully customizable set of metrics.

Both methods read the same telemetry subsystem, so the telemetry configuration below is required in either case.

Running OpenBao?

OpenBao is the open-source fork of Vault and has its own page (its metrics are prefixed bao_ instead of vault_).

Auto-Detection

Glouton detects Vault by its process and listening port (default: 8200).

Enable the Prometheus telemetry as shown in Service Configuration below. Because the telemetry endpoint requires authentication, provide a token that can read sys/metrics through the service configuration:

Linux

sudo tee /etc/glouton/conf.d/99-vault.conf > /dev/null << 'EOF'
service:
  - type: "vault"
    address: "127.0.0.1"
    port: 8200
    password: "<YOUR_VAULT_TOKEN>"
EOF

Windows

Create or edit C:\ProgramData\glouton\conf.d\99-vault.conf:

service:
  - type: "vault"
    address: "127.0.0.1"
    port: 8200
    password: "<YOUR_VAULT_TOKEN>"

To scrape a non-standard endpoint, set stats_url to the full metrics URL instead of address and port. Glouton automatically detects configuration changes.

Metric	Description
service_status	Status of Vault
vault_core_unsealed	Whether the Vault node is unsealed (1) or sealed (0)
vault_core_active	Whether the Vault node is the active node in the cluster
vault_core_in_flight_requests	Number of requests currently being processed
vault_core_handle_requests	Rate of requests handled by the core
vault_core_handle_login_requests	Rate of login requests handled by the core
vault_core_check_tokens	Rate of token checks performed by the core
vault_core_leadership_losses	Number of times this node lost cluster leadership
vault_expire_num_leases	Number of currently active leases

Prometheus Metrics

The auto-detection above collects a curated subset. If you need the full telemetry (runtime, audit, token and lease metrics) or want to choose exactly which metrics to keep, scrape Vault’s endpoint directly instead.

Service Configuration

Enable Prometheus telemetry in your Vault configuration file (HCL format):

telemetry {
  prometheus_retention_time = "30s"
  disable_hostname = true
}

Restart Vault for the changes to take effect. The metrics endpoint will be available at http://localhost:8200/v1/sys/metrics?format=prometheus.

This endpoint requires a valid Vault token with operator permissions. You can verify it works with:

curl -H "X-Vault-Token: <YOUR_TOKEN>" \
  "http://localhost:8200/v1/sys/metrics?format=prometheus"

Glouton Configuration

Because the endpoint requires authentication, you must include the Vault token in the request headers. Replace <YOUR_VAULT_TOKEN> with a valid token that has permissions to read the sys/metrics endpoint.

Linux

sudo tee /etc/glouton/conf.d/99-vault.conf > /dev/null << 'EOF'
metric:
  prometheus:
    targets:
      - url: "http://localhost:8200/v1/sys/metrics?format=prometheus"
        name: "vault"
        headers:
          X-Vault-Token: "<YOUR_VAULT_TOKEN>"
        allow_metrics:
          - "vault_core_unsealed"
          - "vault_runtime_alloc_bytes"
          - "vault_audit_log_request_count"
          - "vault_token_count"
          - "vault_secret_lease_creation"
          - "vault_runtime_num_goroutines"
          - "vault_runtime_sys_bytes"
          - "vault_expire_num_leases"
          - "vault_core_active"
EOF

Windows

Create or edit C:\ProgramData\glouton\conf.d\99-vault.conf:

metric:
  prometheus:
    targets:
      - url: "http://localhost:8200/v1/sys/metrics?format=prometheus"
        name: "vault"
        headers:
          X-Vault-Token: "<YOUR_VAULT_TOKEN>"
        allow_metrics:
          - "vault_core_unsealed"
          - "vault_runtime_alloc_bytes"
          - "vault_audit_log_request_count"
          - "vault_token_count"
          - "vault_secret_lease_creation"
          - "vault_runtime_num_goroutines"
          - "vault_runtime_sys_bytes"
          - "vault_expire_num_leases"
          - "vault_core_active"

Customize collected metrics

The metrics below are our recommended defaults. You can adjust the allow_metrics list to include any metric from Vault’s telemetry reference, or use deny_metrics to exclude specific ones. See Metrics Filtering for details.

Metric	Description
vault_core_unsealed	Whether the Vault node is unsealed (1) or sealed (0)
vault_core_active	Whether the Vault node is the active node in the cluster
vault_runtime_alloc_bytes	Number of bytes allocated by the Vault process
vault_runtime_num_goroutines	Number of active goroutines in the Vault process
vault_runtime_sys_bytes	Total bytes of memory obtained from the OS
vault_audit_log_request_count	Number of audit log requests processed
vault_token_count	Number of active tokens in Vault
vault_secret_lease_creation	Number of secret lease creations
vault_expire_num_leases	Number of currently active leases