Logging & Metrics

Settings for bouncer logging and Prometheus metrics.

Logging

logging.level Optional

Env: LOG_LEVEL · Default: info

Log verbosity level:

Level	Description
debug	Detailed information for debugging (noisy)
info	Normal operation messages
warn	Warning conditions
error	Error conditions only

logging:
  level: "debug" # Useful for troubleshooting

logging.format Optional

Env: LOG_FORMAT · Default: text

Log output format:

• text — human-readable, colored output (best for console/journalctl)
• json — structured JSON (best for log aggregation systems)

logging.file Optional

Env: LOG_FILE · Default: —

Path to a log file. Leave it empty — the default — and the bouncer writes to stderr only, exactly as before this key did anything.

When set, log lines go to both stderr and the file. The file is an addition, not a redirection: journalctl -u cs-routeros-bouncer and docker logs keep working. The file is opened in append mode, so a restart never discards ban history, and created with mode 0640 because log lines record the IP addresses of banned clients.

The parent directory must already exist

The bouncer does not create directories. If the parent is missing, or the path is not writable, startup fails with the path and the OS error rather than falling back silently to stderr — a log file you configured and did not get is worse than no log file.

Any file path is accepted. Under the hardened systemd unit written by setup, ReadWritePaths=/var/log is the only writable location, so a path outside /var/log will fail even if it exists — and a relative path resolves against / there, not against your shell’s working directory. Give an absolute path under /var/log for systemd deployments.

There is no built-in rotation, and the file handle is held for the process lifetime. A rotation tool that renames the file (logrotate without copytruncate) will leave the bouncer writing to the renamed inode until it restarts — use copytruncate, or rely on journalctl and leave this key unset.

Prometheus Metrics

metrics.enabled Optional

Env: METRICS_ENABLED · Default: false

Enable the Prometheus metrics endpoint. When enabled, the bouncer exposes metrics at /metrics. The /health health check is always served on the metrics listener regardless of this setting.

metrics.listen_addr Optional

Env: METRICS_ADDR · Default: 0.0.0.0

Listen address for the metrics HTTP server.

metrics.listen_port Optional

Env: METRICS_PORT · Default: 2112

Listen port for the metrics HTTP server.

metrics:
  enabled: true
  listen_addr: "0.0.0.0"
  listen_port: 2112

metrics.routeros_poll_interval Optional

Env: METRICS_ROUTEROS_POLL_INTERVAL · Default: 30s

How often to poll RouterOS for system metrics (CPU load, memory, temperature). Set to 0 to disable system metrics collection.

metrics:
  routeros_poll_interval: "30s"

metrics.track_processed Advanced

Env: METRICS_TRACK_PROCESSED · Default: true

Enable tracking of processed (non-blocked) traffic through the firewall. When enabled, the bouncer creates passthrough counting rules on RouterOS to measure all traffic passing through monitored chains and reports the data to both Prometheus and LAPI.

Set to false to disable processed traffic tracking, which avoids creating additional rules on the router and reduces metric overhead.

metrics:
  track_processed: true

metrics.pprof_enabled Advanced

Env: METRICS_PPROF_ENABLED · Default: false

Serves Go’s runtime profiler under /debug/pprof on the metrics listener, for investigating where the bouncer spends CPU or holds memory:

go tool pprof -seconds 30 http://127.0.0.1:2112/debug/pprof/profile
go tool pprof http://127.0.0.1:2112/debug/pprof/heap

Leave it off unless you are actively profiling, and set metrics.listen_addr: "127.0.0.1" while it is on. Two reasons, both concrete: a heap profile contains fragments of whatever the process has held in memory — your CrowdSec API key and RouterOS password among them — and /debug/pprof/profile holds a request open for its whole sampling window, which makes it a denial-of-service lever on an exposed listener.

The bouncer logs a warning on every start while this is enabled, so a setting left on by accident is visible rather than silent.

metrics:
  pprof_enabled: false
  listen_addr: "127.0.0.1"

Available metrics

Prometheus Metrics ReferenceFull list of all exported metrics with PromQL examples

Security

The metrics endpoint should not be exposed to the internet. Use firewall rules or network segmentation to restrict access.