---
name: "audisp-statsd"
section: "8"
platform: "linux"
package: "audispd-plugins"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audisp-statsd"
---

# audisp-statsd(8)

plugin to push audit metrics to a statsd service

## NAME

audisp-statsd - plugin to push audit metrics to a statsd service

## SYNOPSIS

**audisp-statsd** \[ *OPTIONS* \]

## DESCRIPTION

**audisp-statsd** is a plugin for the audit event dispatcher that pushes audit metrics to a statsd service using UDP. It reads auditd's state report at regular intervals and forwards the data. Generation of the state report must be enabled in **auditd.conf**.

## CONFIGURATION

The plugin's configuration file is **/etc/audit/audisp-statsd.conf**.  The following parameters are recognized:

- *address*

  The name or address of the statsd server.

- *port*

  The UDP port of the statsd service.

- *interval*

  Time interval between reading auditd's report. The value is a time string such as 10m, 1h, 2d, or 6M where the suffix is s for seconds, m for minutes, h for hours, d for days, and M for months.  The default is 15s.

## REPORT METRICS

The plugin collects the following metrics as gauges:

- **backlog**

  number of kernel events pending transfer to user space

- **lost**

  number of kernel events dropped

- **free\_space**

  how much disk free space auditd sees in MiB

- **plugin\_current\_depth**

  number of events in auditd pending transfer to plugins

- **plugin\_max\_depth**

  historical maximum number of events backlogged while pending transfer to plugins

- **total\_memory**

  current total memory in use by glibc in KiB

- **memory\_in\_use**

  how much of the total memory is actively used in KiB

- **memory\_free**

  amount of free memory available in the glibc arenas in KiB

The following metrics are counters:

- **events\_total\_count**

  total number of events seen during interval

- **events\_total\_failed**

  total number of events seen during interval with failed outcome

- **events\_avc\_count**

  total number of AVC events seen during interval

- **events\_fanotify\_count**

  total number of FANOTIFY events seen during interval

- **events\_logins\_success**

  total number of successful login events seen during interval

- **events\_logins\_failed**

  total number of failed login events seen during interval

- **events\_anamoly\_count**

  total number of anamoly events seen during interval

- **events\_response\_count**

  total number of anamoly response events seen during interval

## FILES

/etc/audit/audisp-statsd.conf /etc/audit/plugins/au-statsd.conf

## SEE ALSO

**auditd.conf**(8), [**auditd-plugins**(5)](/auditd-plugins/5.md).

## AUTHOR

Steve Grubb