Observability metrics reference
This page catalogs every metric emitted by Kasm Workspaces services. Metrics are stored in the kasm_otel ClickHouse database. For kasm.metric_name log events used in reports and dashboards, see Reporting and Logging.
All counters use a 15-second DELTA export interval unless otherwise noted. All metrics carry service.name and standard OTel resource attributes. Session-scoped metrics additionally carry kasm.kasm.id.
For configuration options that control metric collection and retention, see Observability configuration reference.
Service names
| Service | service.name value | Emit interval | Sum temporality |
|---|---|---|---|
| API Server | kasm-api | 15 s (counters) | DELTA |
| Provision Agent | kasm-agent | 15 s (counters); 30 s (resource gauges) | DELTA |
| Connection Proxy | kasm-guac | 15 s (counters); 30 s (resource gauges) | CUMULATIVE |
| RDP Gateway | kasm-rdp-gateway | 15 s (counters); 30 s (resource gauges) | DELTA |
| RDP HTTPS Gateway | kasm-rdp-https-gateway | 15 s (counters and gauges) | DELTA |
| Manager | kasm-manager | 15 s | DELTA |
| nginx Proxy | kasm-proxy | 30 s (scraped from stub_status by collector) | CUMULATIVE |
| PostgreSQL Database | kasm-db | 30 s (scraped via postgresql receiver) | CUMULATIVE |
| Workspace session | kasm-session | No metrics. Log records only, forwarded through the API's legacy bridge | None |
| Egress sidecar | kasm-sidecar | No metrics. Log records only, forwarded through the API's legacy bridge | None |
Temporality
Every row in otel_metrics_sum carries an AggregationTemporality column. The value 1 is DELTA: each point is the increment since the previous export. The value 2 is CUMULATIVE: each point is the running total since the process started. The Python and Go services export DELTA. The Connection Proxy and the collector's nginx and postgresql receivers export CUMULATIVE.
The two need different queries. For a DELTA series, sum(Value) over a time window is the count for that window. For a CUMULATIVE series, take max(Value) or the latest point per ServiceInstanceId. Summing a CUMULATIVE series overcounts by the number of exports in the window. Gauges in otel_metrics_gauge have no temporality. Read the latest point.
API server metrics
The API server emits authentication counters and session counters. Each session transition also writes a structured log record tagged with kasm.metric_name. Those records are listed in Session lifecycle events.
Authentication counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.account.login.successful | Counter | kasm.account.realm: local, ldap, saml, oidc kasm.account.has_2fa: true when the account has TOTP enabled or a WebAuthn credential enrolled |
kasm.account.login.failed | Counter | kasm.account.realm kasm.account.failure_reason: invalid_password, invalid_user, locked, disabled, ldap_error, email_not_verified, wrong_auth_method, license_exceeded, local_account_not_created |
kasm.account.logout | Counter | kasm.account.type: single, all, oidc |
kasm.account.2fa.success | Counter | kasm.account.realm |
kasm.account.2fa.failed | Counter | kasm.account.realm |
kasm.account.2fa.enrolled | Counter | kasm.account.realm type: totp, hardware |
kasm.account.password_reset.successful | Counter | kasm.account.realm |
kasm.account.password_reset.failed | Counter | kasm.account.realm kasm.account.failure_reason |
The kasm.account.login.successful and kasm.account.login.failed metrics also appear as kasm.metric_name values in the log stream and are subject to the audit log retention period. See Reporting and Logging.
Session counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.provision.request | Counter | kasm.kasm.is_cast |
kasm.provision.request.failed | Counter | kasm.provision.failed.reason: session_limit, usage_limit, license_named_user, license_concurrent, image_not_authorized, invalid_zone, persistent_profile, no_resources, invalid_request kasm.kasm.is_cast |
kasm.session.lifecycle | Counter | kasm.session.action: pause, stop, resume |
kasm.session.connect | Counter | kasm.kasm.is_owner: the connecting user owns the session kasm.kasm.is_shared: the session has a share link |
kasm.provision.request counts every session request before any check runs. kasm.provision.request.failed counts refused requests, one point per refusal. kasm.session.lifecycle counts accepted pause, stop, and resume commands. kasm.session.connect counts each client that opens the session websocket, once per attach and not per asset request.
An accepted session request, an accepted resume, and each client attach also write a log record tagged with kasm.metric_name. A refused request writes no record. For the record names and fields, see Session lifecycle events.
Provision agent metrics
The provision agent emits a heartbeat counter, host resource gauges, and a request-duration histogram.
Counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.agent.heartbeat | Counter | kasm.agent.heartbeat_status: success, error |
Histograms
| Metric name | Type | Unit | Attributes |
|---|---|---|---|
http.server.request.duration | Histogram | s | http.request.method, http.route, http.response.status_code |
Resource gauges (30-second interval)
Resource gauges carry kasm.server.id and kasm.server.hostname attributes on every data point. GPU gauges additionally carry kasm.server.gpu_id.
Utilization gauges report a ratio between 0 and 1 (unit 1), following the OpenTelemetry
utilization convention — a host at 42% CPU records 0.42. Temperature gauges report degrees
Celsius (unit Cel). The admin reports and health thresholds display percentages; they scale
these values on read.
| Metric name | Type | Attributes |
|---|---|---|
kasm.agent.cpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.agent.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.agent.disk.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.agent.gpu.utilization | Gauge | kasm.server.id, kasm.server.hostname, kasm.server.gpu_id |
kasm.agent.gpu.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname, kasm.server.gpu_id |
kasm.agent.gpu.temperature | Gauge | kasm.server.id, kasm.server.hostname, kasm.server.gpu_id |
Connection proxy metrics
The connection proxy (Guac) emits counters for session, authentication, and worker events, and gauges for active connections and resource utilization.
Connection proxy counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.guac.vm_connect | Counter | kasm.guac.status: success, error |
kasm.guac.vm_disconnect | Counter | kasm.guac.clients |
kasm.guac.session.authorized | Counter | kasm.guac.connection_type |
kasm.guac.session.cleanup | Counter | (none) |
kasm.guac.registration.success | Counter | (none) |
kasm.guac.registration.retry | Counter | kasm.guac.attempt |
kasm.guac.auth.success | Counter | (none) |
kasm.guac.auth.failure | Counter | (none) |
kasm.guac.ws.connection.authorized | Counter | kasm.guac.connection_type |
kasm.guac.ws.connection.rejected | Counter | (none) |
kasm.guac.ws.connection.error | Counter | (none) |
kasm.guac.worker.death | Counter | (none) |
Connection proxy gauges (30-second interval)
| Metric name | Type | Attributes |
|---|---|---|
kasm.guac.active_connections | Gauge | kasm.guac.worker_pid |
kasm.guac.cpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.guac.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.guac.disk.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.guac.gpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.guac.gpu.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.guac.gpu.temperature | Gauge | kasm.server.id, kasm.server.hostname |
RDP Gateway metrics
The RDP Gateway (kasm-rdp-gateway) handles RDP session connections and emits session, authentication, registration, and keepalive counters, plus session and resource gauges.
RDP Gateway counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.rdp_gateway.session.connected | Counter | kasm.rdp_gateway.login_type: jwt, direct |
kasm.rdp_gateway.session.disconnected | Counter | kasm.rdp_gateway.login_type; kasm.rdp_gateway.disconnect_reason: client, server, timeout, error |
kasm.rdp_gateway.auth.login.success | Counter | (none) |
kasm.rdp_gateway.auth.login.failed | Counter | kasm.rdp_gateway.failure_reason: missing_credentials, api_error |
kasm.rdp_gateway.registration.success | Counter | (none) |
kasm.rdp_gateway.registration.retry | Counter | kasm.rdp_gateway.attempt |
kasm.rdp_gateway.keepalive.sent | Counter | (none) |
kasm.rdp_gateway.keepalive.failed | Counter | (none) |
RDP Gateway gauges and histograms
| Metric name | Type | Attributes |
|---|---|---|
kasm.rdp_gateway.session.active | Gauge | kasm.server.id |
kasm.rdp_gateway.cpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.disk.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.gpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.gpu.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.gpu.temperature | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_gateway.session.duration | Histogram | kasm.rdp_gateway.login_type |
RDP HTTPS Gateway metrics
The RDP HTTPS Gateway (kasm-rdp-https-gateway) proxies RDP over HTTPS and emits connection, authentication, and tunnel counters plus connection and resource gauges.
RDP HTTPS Gateway counters
| Metric name | Type | Attributes |
|---|---|---|
kasm.rdp_https_gateway.connection.opened | Counter | protocol: websocket, legacy |
kasm.rdp_https_gateway.connection.closed | Counter | protocol: websocket, legacy |
kasm.rdp_https_gateway.auth.success | Counter | method: see the table below |
kasm.rdp_https_gateway.auth.failure | Counter | method: see the table below |
kasm.rdp_https_gateway.tunnel.error | Counter | (none) |
The method attribute records which authentication path produced the outcome. Front door successes are counted once per new tunnel, so the paired RDG_OUT and RDG_IN channels of one connection are not counted twice.
method value | Kind | Recorded |
|---|---|---|
kasm | PAA cookie | On tunnel create, only when the connection was not already authenticated at the front door |
token | PAA cookie | On tunnel create, only when the connection was not already authenticated at the front door |
oidc | Front door | OIDC authentication outcome |
basic | Front door | Success once per new tunnel. Failure only on an explicit credential rejection |
ntlm | Front door | Success once per new tunnel. Failure only on a completed Type 3 message rejection |
kerberos | Front door | Success once per new tunnel. No failure is observable |
RDP HTTPS Gateway gauges
| Metric name | Type | Attributes |
|---|---|---|
kasm.rdp_https_gateway.connection_cache | Gauge | (none) |
kasm.rdp_https_gateway.websocket_connections | Gauge | (none) |
kasm.rdp_https_gateway.legacy_connections | Gauge | (none) |
kasm.rdp_https_gateway.cpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_https_gateway.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_https_gateway.disk.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_https_gateway.gpu.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_https_gateway.gpu.memory.utilization | Gauge | kasm.server.id, kasm.server.hostname |
kasm.rdp_https_gateway.gpu.temperature | Gauge | kasm.server.id, kasm.server.hostname |
Manager metrics
Session duration histogram
| Metric name | Type | Unit | Attributes |
|---|---|---|---|
kasm.kasm.duration | Histogram | s | kasm.kasm.image_friendly_name kasm.kasm.image_type: Container, Server, Server Pool kasm.zone.name kasm.kasm.destroy_reason: user_requested, admin_action, kasm_not_running, unknown kasm.kasm.is_cast: the session was launched through a cast link kasm.kasm.is_persistent_profile: the session mounted a persistent profile |
The kasm.kasm.duration histogram records the total elapsed time of each workspace session, in seconds, from creation to destruction. It provides data for percentile-based session duration analysis. kasm.kasm.destroy_reason is kasm_not_running for sessions cleaned up because the container was already gone, and unknown when no reason was provided.
AutoScale gauges
The AutoScale planner emits one gauge per AutoScale config per tick of the scheduled reconcile job, so the values refresh even when nothing scales.
| Metric name | Type | Attributes |
|---|---|---|
kasm.autoscale.servers | Gauge | kasm.autoscale_config.name kasm.zone.name kasm.autoscale.server_state: running, provisioning, unprovisioning |
kasm.autoscale.server_state places each host the config owns in one inventory bucket: running hosts serve sessions, provisioning hosts are ordered or being created, and unprovisioning hosts have a teardown intent set, whatever their liveness state.
nginx proxy metrics
These metrics are scraped from the nginx stub_status endpoint by the OTel Collector every 30 seconds. They carry service.name=kasm-proxy.
nginx proxy metrics do not carry session-level attributes (no kasm.kasm.id). They come from the stub_status scraper rather than the OTel SDK, so per-session attribution is not available from metrics. Per-request nginx trace spans (service.name=kasm-proxy in otel_traces) are available and do carry session-level attributes.
| Metric name | Type | Description |
|---|---|---|
nginx.connections_accepted | Counter | Total connections accepted since nginx start. |
nginx.connections_handled | Counter | Total connections handled (accepted minus dropped). |
nginx.requests | Counter | Total HTTP requests handled since nginx start. |
nginx.connections_current | Gauge | Current number of active connections. |
nginx.connections_reading | Gauge | Connections where nginx is reading the request header. |
nginx.connections_writing | Gauge | Connections where nginx is writing a response to the client. |
nginx.connections_waiting | Gauge | Idle keep-alive connections waiting for a new request. |
PostgreSQL database metrics
These metrics are scraped directly from the Database Server every 30 seconds by the OTel Collector's postgresql receiver, authenticated as the dedicated, read-only kasm_otel_monitor role. They carry service.name=kasm-db.
PostgreSQL database metrics do not carry session-level attributes (no kasm.kasm.id) or the kasm.* naming convention used elsewhere in this reference — they use the upstream OpenTelemetry Collector Contrib postgresql receiver's standard metric names and attributes unchanged. For the complete, version-specific metric list, see the postgresqlreceiver documentation for the collector version listed in Container and image inventory.
The receiver is scoped to the single database configured for the Kasm Workspaces installation and reports connection, transaction, row, block I/O, and database size metrics for that database. For the monitoring role's grants and password handling, see PostgreSQL monitoring role.