Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
|Build Status| |PyPI| |PyPI version|
After googling for a while I didn't find a library that would enable some prometheus <https://prometheus.io/>
_ metrics for Sanic <https://github.com/channelcat/sanic>
_-based apps, so I had to write one. It makes adding monitoring to your Sanic app super easy, just add one line to your code (ok, two if you count import :) and point Prometheus to a newly appeared /metrics
endpoint.
Installatio:
.. code:: bash
pip install prometheus-sanic
Easy-peasy:
.. code:: python
from sanic import Sanic from prometheus_sanic import monitor
app = Sanic() ...
if name == "main": monitor(app).expose_endpoint() # adds /metrics endpoint to your Sanic server app.run(host="0.0.0.0", port=8000)
Actually, there're two ways to run monitoring:
monitor(app).expose_endpoint()
.
It just adds a new route
to your Sanic app, exposing /metrics
endpoint
on the same host and port your Sanic server runs. It might be useful if you run your
app in a container and you do not want to expose different ports for metrics and everything else.
You can customize the /metrics
endpoint by passing the metrics_path
keyword argument:
monitor(app, metrics_path='/my_metrics_path').expose_endpoint()
.monitor(app).start_server(addr=..., port=...)
.
Runs a HTTP server on given address and port and exposes /metrics
endpoint on it.
This might be useful if you want to restrict access to your /metrics
endpoint using some
firewall rulespromtheus-client
<= 0.4.2prometheus-client
>= 0.5.0prometheus-client
>= 0.7.1 and Sanic >= 18.12At the moment prometheus-sanic
provides four metrics:
counter <https://prometheus.io/docs/concepts/metric_types/#counter>
_]histogram <https://prometheus.io/docs/concepts/metric_types/#histogram>
_]gauge <https://prometheus.io/docs/concepts/metric_types/#gauge>
_]gauge <https://prometheus.io/docs/concepts/metric_types/#gauge>
_]/a
as your endpoint). It is quite configurable, in fact it's up you what's gonna get to the endpoint
label (see help(prometheus_sanic.monitor)
for more details)Sanic allows to launch multiple worker processes to utilise parallelisation, which is great but makes metrics collection much trickier (read more <https://github.com/prometheus/client_python/blob/master/README.md#multiprocess-mode-gunicorn>
_) and introduces some limitations.
In order to collect metrics from multiple workers, create a directory and point a prometheus_multiproc_dir
environment variable to it. Make sure the directory is empty before you launch your service::
% rm -rf /path/to/your/directory/*
% env prometheus_multiproc_dir=/path/to/your/directory python your_sanic_app.py
Unfortunately you can not use monitor(app).start_server(addr=..., port=...)
in multiprocess mode as it exposes a prometheus endpoint from a newly created process.
Best you can do is::
% ipython
In [1]: from prometheus_sanic import monitor
In [2]: help(monitor)
Average latency over last 30 minutes::
rate(sanic_request_latency_sec_sum{endpoint='/your-endpoint'}[30m]) / rate(sanic_request_latency_sec_count{endpoint='/your-endpoint'}[30m])
95th percentile of request latency::
histogram_quantile(0.95, sum(rate(sanic_request_latency_sec_bucket[5m])) by (le))
Physical memory usage percent over last 10 minutes::
rate(sanic_mem_rss_perc[10m])
.. |Build Status| image:: https://github.com/skar404/prometheus-sanic/workflows/Tests/badge.svg :target: https://github.com/skar404/prometheus-sanic/actions/ .. |PyPI| image:: https://img.shields.io/pypi/v/prometheus-sanic.svg :target: https://pypi.python.org/pypi/prometheus-sanic/ .. |PyPI version| image:: https://img.shields.io/pypi/pyversions/prometheus-sanic.svg :target: https://pypi.python.org/pypi/prometheus-sanic/
FAQs
Exposes Prometheus monitoring metrics of Sanic apps.
We found that prometheus-sanic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.