This is part of the Metrics for troubleshooting Keycloak deployment guide.
Metrics need to be enabled for Keycloak. Follow the Enabling Keycloak Metrics guide for more details.
A monitoring system collecting the metrics.
User event metrics are disabled by default. See Enabling Keycloak Event Metrics on how to enable them and how to configure which tags are recorded.
| Metric | Description |
|---|---|
|
Counting the occurrence of user events. |
Tags
The tags client_id and idp are disabled by default to avoid a too high cardinality.
realmRealm
client_idClient ID
idpIdentity Provider
eventUser event, for example login or logout. See the Server Administration Guide on event types for an overview of the available events.
errorError specific to the event, for example invalid_user_credentials for the event login. Empty string if no error occurred.
The snippet below is an example of a response provided by the metric endpoint:
# HELP keycloak_user_events_total Keycloak user events
# TYPE keycloak_user_events_total counter
keycloak_user_events_total{client_id="security-admin-console",error="",event="code_to_token",idp="",realm="master",} 1.0
keycloak_user_events_total{client_id="security-admin-console",error="",event="login",idp="",realm="master",} 1.0
keycloak_user_events_total{client_id="security-admin-console",error="",event="logout",idp="",realm="master",} 1.0
keycloak_user_events_total{client_id="security-admin-console",error="invalid_user_credentials",event="login",idp="",realm="master",} 1.0| Metric | Description |
|---|---|
|
Counting password hashes validations. |
Tags
realmRealm
algorithmAlgorithm used for hashing password, for example argon2
hashing_strengthString denoting strength of hashing algorithm, for example, number of iterations depending on the algorithm. For example, Argon2id-1.3[m=7168,t=5,p=1]
outcomeOutcome of password validation. Possible values:
validPassword correct
invalidPassword incorrect
errorError when creating the hash of the password
To configure what tags are available provide a comma-separated list of tag names to the following option spi-credential-keycloak-password-validations-counter-tags.
By default, all tags are enabled.
The snippet below is an example of a response provided by the metric endpoint:
# HELP keycloak_credentials_password_hashing_validations_total Password validations
# TYPE keycloak_credentials_password_hashing_validations_total counter
keycloak_credentials_password_hashing_validations_total{algorithm="argon2",hashing_strength="Argon2id-1.3[m=7168,t=5,p=1]",outcome="valid",realm="realm-0",} 39949.0Return back to the Metrics for troubleshooting Keycloak deployment or proceed to Keycloak JVM metrics.