Working with Networking System Metrics from Node Exporter

When we discuss network monitoring through the Node Exporter, we’re talking about viewing networking data from a systems administration or engineering viewpoint: The Node Exporter provides us with networking device information pulled both from /proc/net/dev and /sys/class/net/INTERFACE, with INTERFACE being the name of the interface itself, such as eth0. All network metrics are prefixed with the node_network name.

Should we take a look at node_network in the expression editor, we can see quite a number of options — many of these are information gauges whose data is pulled from that /sys/class/net/INTERFACE directory. So, when we look at node_network_dormant, we’re seeing point-in-time data from the /sys/class/net/INTERFACE/dormant file.

But with regards to metrics that the average user will need in terms of day-to-day monitoring, we really want to look at the metrics prepended with either node_network_transmit or node_network_receive, as this contains information about the amount of data/packets that pass through our networking, both outbound (transmit) and inbound (receive). Specifically, we want to look at the node_network_receive_bytes_total or node_network_transmit_bytes_total metrics, because these are what will help us calculate our network bandwidth:

rate(node_network_transmit_bytes_total[30s])
rate(node_network_receive_bytes_total[30s])

The above expressions will show us the 30-second average of bytes either transmitted or received across our time series, allowing us to see when our network bandwidth has spiked or dropped.