Nexus plugin metrics

The Nexus OSA plugin registers the codescoring metric set in the standard Nexus metrics registry. The metrics are available through the standard Nexus metrics export. Values of failure_rate and slow_call_rate are percentages from 0 to 100.

Circuit Breaker state

State metrics have the value 1 only for the current Circuit Breaker state and 0 for all other states.

Metric	Type	Description
`codescoring_circuit_breaker_state_closed`	gauge	Circuit Breaker is in the normal `CLOSED` state
`codescoring_circuit_breaker_state_open`	gauge	Circuit Breaker is `OPEN`, so CodeScoring requests are not allowed
`codescoring_circuit_breaker_state_half_open`	gauge	Circuit Breaker is `HALF_OPEN`, so trial requests are allowed

Current Circuit Breaker window

These values describe the current Circuit Breaker sliding window and can be reset when the state changes.

Metric	Type	Description
`codescoring_circuit_breaker_failure_rate`	gauge	Failure rate calculated by Resilience4j; `-1` until the minimum of 5 calls is reached
`codescoring_circuit_breaker_observed_failure_rate`	gauge	Failure rate among calls already collected, including the first 1–4 calls
`codescoring_circuit_breaker_slow_call_rate`	gauge	Rate of calls classified as slow; `-1` until the minimum number of calls is reached
`codescoring_circuit_breaker_buffered_calls`	gauge	Total number of calls in the current window, up to 10
`codescoring_circuit_breaker_failed_calls`	gauge	Number of failed calls in the current window
`codescoring_circuit_breaker_successful_calls`	gauge	Number of successful calls in the current window
`codescoring_circuit_breaker_slow_calls`	gauge	Number of slow calls in the current window
`codescoring_circuit_breaker_not_permitted_calls`	gauge	Number of calls not permitted in the current Circuit Breaker state

Cumulative Circuit Breaker events

These counters accumulate from the time the plugin instance starts.

Metric	Type	Description
`codescoring_circuit_breaker_not_permitted_total`	counter	Calls rejected by the Circuit Breaker without an HTTP request to CodeScoring
`codescoring_circuit_breaker_failure_rate_exceeded_total`	counter	Events when the configured failure-rate threshold is reached or exceeded
`codescoring_circuit_breaker_slow_call_rate_exceeded_total`	counter	Events when the configured slow-call threshold is reached or exceeded
`codescoring_circuit_breaker_transitions_to_closed_total`	counter	Transitions to `CLOSED`
`codescoring_circuit_breaker_transitions_to_open_total`	counter	Transitions to `OPEN`
`codescoring_circuit_breaker_transitions_to_half_open_total`	counter	Transitions to `HALF_OPEN`

HTTP connection pool

CodeScoring requests use one shared pool.

Metric	Type	Description
`codescoring_http_pool_leased`	gauge	Connections currently used by requests
`codescoring_http_pool_available`	gauge	Open idle connections available for reuse
`codescoring_http_pool_pending`	gauge	Requests waiting for a connection to become available
`codescoring_http_pool_max`	gauge	Configured maximum pool size

HTTP requests to CodeScoring

These counters describe the actual outcome of calls to the external service. HTTP 4xx responses are recorded as response errors but do not open the Circuit Breaker.

Metric	Type	Description
`codescoring_requests_successes_total`	counter	HTTP 200 responses with a body successfully deserialized as a CodeScoring response
`codescoring_requests_io_errors_total`	counter	Network errors, timeouts, and response-body read errors
`codescoring_requests_server_errors_total`	counter	HTTP 500, 502, 503, and 504 responses recorded by the Circuit Breaker as failures
`codescoring_requests_auth_errors_total`	counter	HTTP 401 and 403 responses
`codescoring_requests_rate_limited_total`	counter	HTTP 429 responses
`codescoring_requests_other_client_errors_total`	counter	Other HTTP 4xx responses
`codescoring_requests_unexpected_responses_total`	counter	Other non-success responses not included in the categories above
`codescoring_requests_serialization_errors_total`	counter	Request serialization errors before an HTTP call is made
`codescoring_requests_deserialization_errors_total`	counter	HTTP 200 responses whose body cannot be deserialized; these errors are recorded by the Circuit Breaker
`codescoring_requests_duration`	summary	Duration distribution of completed HTTP requests in seconds; quantiles 0.5, 0.75, 0.95, 0.98, 0.99, and 0.999 are exported
`codescoring_requests_duration_count`	counter	Total number of completed HTTP requests included in the duration measurement

Scans and decisions

codescoring_scans_total counts operations that reach the shared analysis pipeline. Every such operation increments exactly one of the allowed, blocked, or skipped counters.

Metric	Type	Description
`codescoring_scans_total`	counter	Analysis operations for supported artifacts started by the plugin
`codescoring_scans_verdict_blocked_total`	counter	Operations after which the plugin actually blocked the download
`codescoring_scans_verdict_allowed_total`	counter	Operations after which the plugin allowed the download, including `blockOnError=false` and warm-up mode
`codescoring_scans_skipped_total`	counter	Operations skipped without requesting a scan result: superuser, unparsed artifact, or unsupported Docker/OCI manifest

Was this page helpful?

#Nexus plugin metrics

#Circuit Breaker state

#Current Circuit Breaker window

#Cumulative Circuit Breaker events

#HTTP connection pool

#HTTP requests to CodeScoring

#Scans and decisions