redis_exporter turns a Redis connection string into an inventory question
The Redis exporter presents Redis metrics to Prometheus. Port 9121 is a common default. A port match can be an exporter, a development service, or an unrelated listener. The exporter's value comes from a configured connection to Redis, which may carry an address and password.
The measurements
The queries below completed on November 5, 2026, with page 1, page size 1, and sub_type=all:
| Query | Matches | UTC time |
|---|---|---|
port="9121" |
6 | 2026-11-05T00:40:25Z |
app="redis_exporter" |
0 | 2026-11-05T00:40:26Z |
http.body="redis_exporter_build_info" |
4 | 2026-11-05T00:40:28Z |
The port and body counts are close, but they are not a matched set. A body match can be a documentation page or a live metrics response. A port match can be any process using 9121. The application fingerprint returned no matches.
The exporter is a bridge to Redis
The exporter reads metrics from a Redis endpoint. Deployments commonly provide a Redis URL that contains the host, port, database number, and optionally a username or password. That URL is a secret-bearing configuration value. Protect it with file permissions or a secret store and avoid placing it in logs.
Use a dedicated Redis user with only the commands and keys needed for monitoring. Redis access control can restrict command categories and key patterns. The exporter should not use an administrator account or a credential shared with an application. Check the connection's TLS settings and verify the exporter is not silently falling back to plaintext.
The scrape endpoint should be bound to a private interface. If Prometheus is remote, restrict the source address and consider TLS plus authentication from the exporter toolkit. An exposed metrics endpoint can disclose Redis version, memory use, connected clients, keyspace counts, and command statistics. The precise labels depend on the exporter version and configuration.
Query the boundary, not the internet
An external count cannot prove that the Redis service is exposed. Start with an owned-asset query and ask the owner whether the address is an exporter. Then check the listener, the Redis URL source, and the Prometheus scrape configuration on the host.
Do not send authentication guesses or run Redis commands through an unverified endpoint. A harmless HTTP request to /metrics is enough to determine whether the port speaks the expected protocol. If it serves metrics, compare its build information and metric names with the deployed exporter.
For each confirmed exporter, record the Redis endpoint, database, account, TLS mode, source network, and the last rotation date. A port count without those fields is not actionable inventory.
Incident response for a reachable exporter
If the endpoint was publicly reachable, preserve its access logs and network flow records. Check whether the exporter configuration or environment could be read through another service on the host. Rotate the Redis credential if exposure is credible, then verify that old sessions were closed.
Review Redis logs for commands from the exporter's address. A metrics request does not normally mutate data, but a compromised exporter or a reused credential can behave differently. Restrict the account's allowed commands before rotating, so the replacement credential has a smaller blast radius.
The final test should show the exporter reaching Redis from the monitoring network and failing from an ordinary user network. The count is only useful when it leads to that verified boundary.
Top comments (0)