Skip to main content

​
Objective 2 Overview

In this lesson, we focus on monitoring a Vault environment. While Objective 1 emphasizes Vault configuration, Objective 2 covers:
  • Monitor and understand Vault Telemetry
  • Monitor and understand Vault Audit Logs
  • Monitor and understand Vault Operational Logs
HashiCorp certification exams often use “understand” to mean that familiarity with core concepts is sufficient. With that in mind, let’s explore Vault telemetry: how to configure, collect, and visualize runtime metrics.

​
What Is Vault Telemetry?

Vault telemetry is a set of runtime metrics that reveal how Vault performs and operates internally. Typical telemetry data includes:
  • Write durations to the storage backend
  • Vault’s response times for client API requests
  • Node seal or initialization status
The image is a slide explaining telemetry, describing it as the collection of runtime metrics for performance monitoring and debugging in a Vault environment. It mentions metrics aggregation every 10 seconds and sending telemetry information to aggregation solutions like DataDog or Prometheus.
Vault aggregates metrics every 10 seconds, keeps them in memory for one minute, and exposes them via a local endpoint. A telemetry agent on each Vault node usually scrapes this endpoint and ships data to an external monitoring solution such as DataDog, Prometheus, Splunk, or Grafana. These platforms enable you to build dashboards, charts, and alerts to track your Vault cluster’s health and performance.
Telemetry metrics are held in-memory for only 60 seconds. Ensure your agent scrapes them at least every 10 seconds to avoid missing critical data.

​
Supported Telemetry Providers

Configure telemetry in the telemetry stanza of your Vault HCL config. Vault supports multiple backends:
ProviderUse CaseRecommended Platform
statsiteSimple, statsd-compatible aggregationCustom scripts
statsdGeneral metrics collectionGraphite, DataDog
circonusEnterprise-grade monitoringCirconus
dogstatsdDataDog-specific tags and metricsDataDog
prometheusPull-based model, native Vault integrationPrometheus
stackdriverGoogle Cloud monitoringGoogle Stackdriver
The image lists providers supported by Vault, including statsite, statsd, circonus, dogstatsd, prometheus, and stackdriver. It also features a Vault certification badge and a cartoon character.
Choose the provider that aligns with your observability stack: for example, use dogstatsd for DataDog and prometheus for Prometheus.

​
Common Vault Telemetry Metrics

Vault emits a variety of metrics. Below are some key examples:
The image is a table listing various metrics collected by Vault, with descriptions for each metric. It includes metrics like request handling duration, garbage collection pause, memory usage, and audit log request time.
MetricDescription
vault.core.handleRequestTime taken to handle API requests
vault.runtime.totalGCPauseNSNanoseconds spent in garbage collection (stop-the-world)
vault.runtime.memoryUsePercentagePercentage of physical memory in use
vault.runtime.memoryUseTotalBytesTotal physical memory in use (bytes)
vault.audit.log.requestLatency of sending audit log entries
vault.policy.getPolicyDuration to retrieve policy definitions
For a comprehensive metric list, see the Vault Telemetry documentation.

​
Configuring Telemetry in Vault

To enable telemetry, add a telemetry block to your Vault server’s HCL configuration. For example, to configure DogStatsD: 
telemetry {
  dogstatsd_addr = "metrics.hcvop.com:8125"
  dogstatsd_tags = ["vault_env:production"]
}

seal "transit" {
  address  = "transit.hcvop.com:8200"
  key_name = "autounseal"
}
After updating your config, restart Vault or send a SIGHUP to reload the settings.
Incorrect telemetry configuration can lead to missing metrics or excessive network traffic. Always validate your HCL syntax and test connectivity to your metrics endpoint.

​
Telemetry Workflow

A typical Vault telemetry workflow involves:
  1. Vault emits runtime metrics on each node.
  2. Local telemetry agent scrapes metrics (e.g., via DogStatsD or Prometheus endpoint).
  3. Agent forwards data to a centralized system:
    • DataDog
    • Splunk
    • Prometheus
    • Grafana
  4. Operations teams build dashboards and set up alerts based on these metrics.
The image illustrates a telemetry workflow involving a Vault Admin configuring a Vault Server, which sends metrics upstream to an aggregation platform like DataDog, Splunk, Prometheus, or Grafana. The process includes creating dashboards and alerting for metric consumption.
Vault’s role ends at emitting and exposing metrics; the external monitoring system handles storage, visualization, and alerting.

​
Sample Monitoring Dashboard

Below is an example Vault monitoring dashboard in DataDog, showing key metrics such as garbage collection pause durations, login request latency, and backend performance. This view helps you quickly assess the status and health of your Vault cluster.
The image shows a dashboard for monitoring Vault, featuring various performance metrics, logs, and summaries. It includes graphs and data visualizations for runtime, storage backend, and token activities.

​
Key Takeaways

  • Telemetry provides real-time metrics about Vault’s performance and health.
  • Metrics aggregation occurs every 10 seconds and is retained for 60 seconds in memory.
  • Supported providers include statsite, statsd, circonus, dogstatsd, prometheus, and stackdriver.
  • Monitor essential metrics: request duration, GC pause, memory usage, and audit log latency.
  • On the exam, you may need to interpret or identify telemetry configurations; full hands-on setup is uncommon.

Watch Video