# Monitor Network Identity Attestor

> How to monitor Network Identity Attestor health and performance using the health endpoint and Prometheus-compatible metrics

This page describes how to monitor a running

Network Identity Attestor (NIA) instance using the built-in health endpoint and Prometheus-compatible metrics endpoint.

## Before you begin

* Network Identity Attestor must be [deployed and running](/user-guide/deploy-install/virtual-envs/set-up-network-identity-attestor) in your VMware vSphere environment.
* You need shell access to the NIA host (or network access to the NIA ports).

## Check NIA health

The NIA exposes a `/health` endpoint on the same port as the main API. This endpoint is always enabled and requires no configuration.

To check health status:

```shell
curl -k "https://<nia-host>/health"
```

Replace `<nia-host>` with the hostname or IP address of the NIA host.

A healthy response looks like:

```json
{"status":"Healthy","version":"1.29.100"}
```

An unhealthy response indicates the NIA can’t communicate with the vCenter API:

```json
{"status":"Unhealthy","version":"1.29.100"}
```

The most common cause of an unhealthy status is an expired or invalid vCenter API session.

> **HTTP status code `200` is NOT an indicator of health**
>
> The HTTP status code is always `200` regardless of health status. Check the `status` field in the JSON response body to determine whether the NIA is healthy or unhealthy.

## Enable the Prometheus-compatible metrics endpoint

The metrics endpoint is off by default. After you enable it, the NIA exposes Prometheus-compatible metrics on a separate HTTP port.

### Enable at install time

Set the `AEMBIT_METRICS_ENABLED` environment variable before running the NIA installer:

```shell
export AEMBIT_METRICS_ENABLED=true
```

### Enable after installation

To enable metrics on an existing NIA installation, update the systemd unit environment and restart the service:

```shell
sudo systemctl edit aembit_netid_attestor.service
```

Add the following in the editor:

```ini
[Service]
Environment="AEMBIT_METRICS_ENABLED=true"
```

Then reload and restart:

```shell
sudo systemctl daemon-reload
sudo systemctl restart aembit_netid_attestor.service
```

### Change the metrics port

By default, the metrics endpoint listens on port `9099`. To use a different port, set the `AEMBIT_METRICS_PORT` environment variable. For example:

```shell
export AEMBIT_METRICS_PORT=9100
```

For the full list of metrics environment variables, see the [Network Identity Attestation reference](/user-guide/deploy-install/virtual-envs/reference-network-identity-attestation#environment-variables).

## Configure Prometheus to scrape NIA metrics

The metrics endpoint listens on port `9099` by default. Open that port on the NIA host firewall before you scrape it. For example, run `sudo ufw allow 9099` on Ubuntu, or the equivalent `firewall-cmd` rule.

Add the NIA as a scrape target in your Prometheus configuration. Edit your `prometheus.yml` file and add a job under `scrape_configs`:

```yaml
scrape_configs:
  - job_name: 'aembit-nia'
    fallback_scrape_protocol: PrometheusText0.0.4
    static_configs:
      - targets: ['<nia-host>:9099']
```

Replace `<nia-host>` with the hostname or IP address of the NIA VM.

The `fallback_scrape_protocol: PrometheusText0.0.4` line tells Prometheus which format to expect when the NIA doesn’t advertise one during content negotiation. Prometheus 3.x requires this fallback to scrape the NIA’s text-format endpoint.

If you changed the metrics port with `AEMBIT_METRICS_PORT`, use your configured port instead of `9099`.

## Verify metrics are working

After enabling metrics, confirm the endpoint is responding and that counters increment correctly.

1. Confirm the metrics endpoint is responding:

   ```shell
   curl "http://<nia-host>:9099/metrics"
   ```

   If you’ve enabled metrics, you’ll see Prometheus text format output similar to:

   ```plaintext
   # HELP request_count Total requests by endpoint, method, status.
   # TYPE request_count counter
   request_count_total{endpoint="/health",method="GET",status="200"} 1


   # HELP request_error_count Total request errors by endpoint, method, status.
   # TYPE request_error_count counter


   # HELP in_flight_requests_count Current in-flight HTTP requests.
   # TYPE in_flight_requests_count gauge
   in_flight_requests_count 0


   # HELP vcenter_api_errors_count API errors.
   # TYPE vcenter_api_errors_count counter
   vcenter_api_errors_count_total 0
   # EOF
   ```

   If the connection refuses, you haven’t enabled metrics.

2. Generate some request traffic by hitting the health endpoint a few times:

   ```shell
   curl -k "https://<nia-host>/health"
   curl -k "https://<nia-host>/health"
   curl -k "https://<nia-host>/health"
   ```

3. Query the metrics endpoint and check that `request_count_total` reflects the requests:

   ```shell
   curl -s "http://<nia-host>:9099/metrics" | grep request_count_total
   ```

   The `grep` matches the series line, which now shows a higher count:

   ```plaintext
   request_count_total{endpoint="/health",method="GET",status="200"} 3
   ```

4. Confirm error counting by requesting a non-existent endpoint:

   ```shell
   curl -k "https://<nia-host>/nonexistent"
   curl -s "http://<nia-host>:9099/metrics" | grep request_error_count_total
   ```

   You should see an entry with a `404` status.

For the full list of available metrics and their descriptions, see the [Prometheus-compatible metrics reference](/user-guide/deploy-install/virtual-envs/reference-network-identity-attestation#prometheus-compatible-metrics).