
Research
/Security News
Weaponizing Discord for Command and Control Across npm, PyPI, and RubyGems.org
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
@opentelemetry/instrumentation-redis
Advanced tools
OpenTelemetry instrumentation for `redis` database client for Redis
This module provides automatic instrumentation for the redis
module versions >=2.6.0 <6
, which may be loaded using the @opentelemetry/sdk-trace-node
package and is included in the @opentelemetry/auto-instrumentations-node
bundle.
If total installation size is not constrained, it is recommended to use the @opentelemetry/auto-instrumentations-node
bundle with @opentelemetry/sdk-node for the most seamless instrumentation experience.
Compatible with OpenTelemetry JS API and SDK 1.0+
.
npm install --save @opentelemetry/instrumentation-redis
redis
versions >=2.6.0 <6
OpenTelemetry Redis Instrumentation allows the user to automatically collect trace data and export them to the backend of choice, to give observability to distributed systems when working with redis.
To load a specific instrumentation (redis in this case), specify it in the registerInstrumentations' configuration
const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node');
const { RedisInstrumentation } = require('@opentelemetry/instrumentation-redis');
const { registerInstrumentations } = require('@opentelemetry/instrumentation');
const provider = new NodeTracerProvider();
provider.register();
registerInstrumentations({
instrumentations: [
new RedisInstrumentation(),
],
})
See examples/redis for a short example.
Redis instrumentation has a few options available to choose from. You can set the following:
Options | Type | Description |
---|---|---|
dbStatementSerializer | DbStatementSerializer (function) | Redis instrumentation will serialize the command to the db.statement attribute using the specified function. |
responseHook | RedisResponseCustomAttributeFunction (function) | Function for adding custom attributes on db response. Receives params: span, moduleVersion, cmdName, cmdArgs |
requireParentSpan | boolean | Require parent to create redis span, default when unset is false. |
db.statement
SerializerThe instrumentation serializes the command into a Span attribute called db.statement
. The standard serialization format attempts to be as informative as possible while avoiding the export of potentially sensitive data. The number of serialized arguments depends on the specific command, see the configuration
list in @opentelemetry/redis-common
.
It is also possible to define a custom serialization function. The function will receive the command name and arguments and must return a string.
Here is a simple example to serialize the command name and all command arguments. Notice that it might capture sensitive data and big payloads:
const { RedisInstrumentation } = require('@opentelemetry/instrumentation-redis');
const redisInstrumentation = new RedisInstrumentation({
dbStatementSerializer: function (cmdName, cmdArgs) {
return [cmdName, ...cmdArgs].join(" ");
},
});
This package uses @opentelemetry/semantic-conventions
version 1.22+
, which implements Semantic Convention Version 1.7.0 ("old" conventions).
It also supports the new stable semantic conventions introduced in [Version 1.33.0]
By default, old semantic conventions are used. Use the OTEL_SEMCONV_STABILITY_OPT_IN
environment variable to control which version to emit.
Attributes collected:
Attribute | Short Description |
---|---|
db.connection_string | URL to Redis server address, of the form redis://host:port |
db.statement | Executed Redis statement |
db.system | Database identifier; always redis |
net.peer.name | Hostname or IP of the connected Redis server |
net.peer.port | Port of the connected Redis server |
Attribute | Short Description |
---|---|
db.operation.name | Redis command name |
db.operation.batch.size | Number of commands in a Redis MULTI/EXEC transaction |
db.query.text | The database query being executed |
db.system.name | Database identifier; always redis |
server.address | Hostname or IP of the connected Redis server |
server.port | Port of the connected Redis server |
Apache 2.0 - See LICENSE for more information.
The 'redis' package is a popular Redis client for Node.js. While it provides the basic functionality to interact with Redis, it does not offer built-in tracing or telemetry capabilities like @opentelemetry/instrumentation-redis. Developers would need to manually instrument their code to collect telemetry data.
The 'ioredis' package is another widely-used Redis client for Node.js, known for its support of advanced Redis features and high performance. Similar to the 'redis' package, it does not include automatic tracing or telemetry features. Developers would need to integrate it with OpenTelemetry manually to achieve similar functionality to @opentelemetry/instrumentation-redis.
FAQs
OpenTelemetry instrumentation for `redis` database client for Redis
The npm package @opentelemetry/instrumentation-redis receives a total of 3,962,249 weekly downloads. As such, @opentelemetry/instrumentation-redis popularity was classified as popular.
We found that @opentelemetry/instrumentation-redis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Socket researchers uncover how threat actors weaponize Discord across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.
Security News
Socket now integrates with Bun 1.3’s Security Scanner API to block risky packages at install time and enforce your organization’s policies in local dev and CI.
Research
The Socket Threat Research Team is tracking weekly intrusions into the npm registry that follow a repeatable adversarial playbook used by North Korean state-sponsored actors.