operator usage

The operator usage command allows an administrator to retrieve a client count report for the default reporting period, or for a specific time range of months.

The command output will list clients by distinct entities, non-entity tokens, ACME clients, secret sync clients, and total active clients for each namespace, and the total for the entire cluster. It may indicate that no data is available for the requested time range, which may be because the client count reporting is disabled, the time range is too far in the past, or no data has yet been collected since the feature was enabled.

Refer to the Vault Usage Metrics tutorial to learn more about usage metrics, including required policy and data collection details.

Examples

Retrieve the client counts for the default reporting period:

$ vault operator usage
Period start: 2019-11-01T00:00:00Z
Period end: 2020-10-31T23:59:59Z

Namespace path   Distinct entities   Non-Entity tokens   Secret syncs   ACME clients   Active clients
--------------   -----------------   -----------------   ------------   ------------   --------------
[root]           1541                332                 40             60             1973

Total            1541                332                 40             60             1973

Retrieve the client counts for a specific month in the past:

$ vault operator usage -start-time=2020-01 -end-time=2020-01
Period start: 2020-01-01T00:00:00Z
Period end: 2020-01-31T23:59:59Z

Namespace path   Distinct entities   Non-Entity tokens   Secret syncs   ACME clients   Active clients
--------------   -----------------   -----------------   ------------   ------------   --------------
[root]           934                 176                 20             30             1160

Total            934                 176                 20             30             1160

Usage

The following flags are available in addition to the standard set of flags included on all commands.

Output options

-format (string: "table") - Print the output in the given format. Valid formats are "table", "json", or "yaml". This can also be specified via the VAULT_FORMAT environment variable.

Command options

-start-time (date) - Start month of the report to generate. May be given as YYYY-MM-DD, YYYY-MM-DD, a full RFC3339 timestamp, or a Unix epoch timestamp. Defaults to the configurable default_report_months prior to end-time.
-end-time (date: previous month) - End month of the report to generate. Defaults to the end of the previous calendar month.

The output shows the exact time range being reported, which may not match the input parameters if a full month is not available, or if the available reports are a subset of the months requested.