---
name: key-protect-monitor-metrics
title: Monitoring operational metrics using the console
description: applications interact with IBM® Key Protect for IBM Cloud®.
last-updated: 2026-07-19
---

{:shortdesc: .shortdesc}
{:screen: .screen}
{:pre: .pre}
{:table: .aria-labeledby="caption"}
{:external: target="_blank" .external}
{:codeblock: .codeblock}
{:tip: .tip}
{:note: .note}
{:important: .important}

# Monitoring operational metrics using the console
{: #operational-metrics}

As a security officer, auditor, or manager, you can use the
IBM Cloud Monitoring service to measure how users and
applications interact with IBM® Key Protect for IBM Cloud®.
{: shortdesc}

IBM Cloud Monitoring records data on the operations that occur
inside of IBM Cloud. This service allows you to gain
operational visibility into the performance and health of your applications,
services, and platforms. You can use its advanced features to monitor and
troubleshoot, define alerts based on API response codes, and design custom
dashboards.

For more information regarding the Monitoring service,
see the
[getting started tutorial for IBM Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started){: external}.

## What metrics are available?
{: #kp-metrics-available}

You can use Monitoring to track
the type of API requests being made in your service instance as
well as the latency of the requests.

The following contains examples of metrics that can be measured
in your Monitoring dashboard:

- Total requests being made in your
    Key Protect instance

- Successful vs failed API requests categorized by API type

- API request latency over time

- Total API requests categorized by response code

## Before you begin
{: #operational-metrics-considerations}

Enabling Key Protect service metrics will
add new metrics to your Monitoring instance. For
information on Monitoring pricing, see
[Pricing](https://cloud.ibm.com/docs/monitoring?topic=monitoring-pricing_plans){: external}.
{: important}

Before you provision an instance of Monitoring, consider
the following guidance:

- You will need to enable a
    [metrics policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metrics)
    in the Key Protect instance in order to
    retrieve operational metrics.

- Other IBM Cloud users with `administrator` or `editor`
    permissions can manage the Monitoring service in the
    IBM Cloud. These users must also have platform
    permissions to create resources within the context of the resource group where
    they plan to provision the instance.

## Connecting Monitoring with Key Protect
{: #connect-monitor-keyprotect}

Your dashboard will show metrics for all
Key Protect instances with an enabled
metrics policy.
{: note}

### Configure a Monitoring instance for metrics
{: #configure-monitor}

To enable platform metrics in a region, complete the following steps:

1. [Provision an instance of Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-provision){: external}
    in the region of the Key Protect instance that contains an
    [enabled metrics policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metrics).

2. Go to the [monitoring dashboard](https://cloud.ibm.com/observe/monitoring).

3. Click **Configure platform metrics**.

4. Select the region where the Key Protect
    instance was created.

5. Select the Key Protect instance in which
    you would like to receive metrics.

6. Click "Configure."

7. Your Key Protect instance is now set for
    platform metrics.

## Key Protect Metrics Details
{: #kp-metrics}

You can use the metrics in your monitoring instance dashboard to measure the types of
requests being made in your service instance as well as the latency of the
requests.

### API Hits
{: #api-hits}

The type and amount of API requests being made to your
Key Protect instance. For example, you can
track how many API requests have been made by an authorized user be setting an
[alert](#set-monitor-alerts)
that triggers when your monitoring instance notices a frequent amount of 401 status
codes being returned from your Key Protect
instance.

|Metadata|Description|
|--- |--- |
|Metric Name|ibm_kms_api_request_gauge|
|Metric Type|Gauge|
|Value Type|none|
|Segment By|[Attributes for Segmentation](#attributes-for-segmentation)|
{: caption="Describes the API Hits metrics." caption-side="bottom"}

## Latency
{: #latency}

The amount of time it takes
Key Protect to receive an API request and
respond to it.

The latency is calculated by getting the average of all requests of the same
type that occur within 60 seconds.
{: note}

|Metadata|Description|
|--- |--- |
|Metric Name|ibm_kms_api_latency_gauge|
|Metric Type|Gauge|
|Value Type|Milliseconds|
|Segment By|[Attributes for Segmentation](#attributes-for-segmentation)|
{: caption="Describes the Latency metrics." caption-side="bottom"}

## Attributes for Segmentation
{: #attributes-for-segmentation}

You can filter your metrics by using the following attributes.

|Attribute Name|Description|
|--- |--- |
|ibm_resource_type|Supported resource type is instance.|
|ibm_kms_response_code|Response code for the Key Protect service API request.|
|ibm_scope|The account, organization, or space GUID associated with the metric.|
|ibm_ctype|public, dedicated, or local.|
|ibm_location|Location of the Key Protect service instance.|
|ibm_service_name|kms.|
|ibm_resource|Key Protect service instance ID.|
|ibm_kms_api|Key Protect service API name.|
|ibm_resource_group_name|Resource group name associated with the Key Protect service instance.|
|ibm_service_instance_name|Key Protect service instance name.|
|ibm_service_instance|Key Protect service instance ID.|
{: caption="Describes the attributes use for segmenting metrics." caption-side="bottom"}

## Metrics Filter Attributes
{: #metrics-filter-attributes}

You can scope down your metrics by using the following scope filters.
These filters are more granular than the segmentation filters.

|Attribute Name|Description|
|--- |--- |
|ibmResourceGroupName|The name of the resource group associated with the Key Protect service instance.|
|ibmScope|The account, organization, or space GUID associated with the metric.|
|ibmServiceInstanceName|The service instance associated with the metric.|
|ibmKmsApi|The Key Protect API call associated with the metric.|
{: caption="Describes the scope filters for Key Protect metrics." caption-side="bottom"}

Due to Monitoring limitations, you will only be able to see
the values in the dropdown filters for up to 6 hours at a time. You can manually
type in value into scope variables to use scope filters for given time periods.
{: note}

## Default Dashboards
{: #default-dashboards}

You will need to configure platform metrics and enable a
[metrics policy](https://cloud.ibm.com/docs/key-protect?topic=key-protect-manage-monitor-metrics)
on your KP service instance in order to view your
Key Protect operational metrics dashboard.
{: note}

### How to find the Monitoring dashboard for your Key Protect service instance using Key Protect console
{: #find-console}

After configuring your Monitoring instance to receive
platform metrics, follow these steps:

1. Go to the
    [Provision service instance](https://cloud.ibm.com/docs/key-protect?topic=key-protect-provision#provision-gui)
    and create your Key Protect service
    instance.

2. Click on the `Actions` dropdown.

3. Select `Monitoring`. This will take you to the
    Key Protect dashboard.

![An example of the console monitoring button.](images/kp-ui-monitoring-button.png){: caption="Shows example of the Monitoring instance console monitoring button." caption-side="bottom"}

### How to find the Monitoring dashboard for your Key Protect service instance using observability page
{: #find-observability}

After configuring your Monitoring instance to receive
platform metrics, follow these steps:

1. Go to the
    [monitoring dashboard](https://cloud.ibm.com/observe/monitoring){: external} and find your monitoring
    instance that is configured to receive platform metrics.

2. Click on the `View Monitoring` button that is in the
    `View Dashboard` column of the monitoring instance.

3. Once you are in the Monitoring platform, click
    `Dashboards` to open up the side menu.

4. Select `IBM` under the Dashboard Templates section.

5. Select `Key Protect - Overview` to view
    the dashboard for your Key Protect
    service instance.

![An example of the dashboard menu in Monitoring.](images/monitor-dashboard-menu.png){: caption="The dashboard menu that lists the dashboards in your Monitoring instances." caption-side="bottom"}

The following figures show the metric views available to you on the default
dashboard.

![An example of a Key Protect metrics dashboard.](images/monitor-operation-dash1.png){: caption="Some of the metrics available on the Monitoring dashboard." caption-side="bottom"}

![An example of a Key Protect dashboard view.](images/monitor-operation-view2.png){: caption="Some of the metrics available on the Monitoring dashboard." caption-side="bottom"}

You will not be able to see any metrics in your Monitoring
instance until you enable a metrics policy for your
Key Protect instance and make API requests
to your Key Protect instance.
{: note}

## Setting Alerts
{: #set-monitor-alerts}

You can set alerts on your Monitoring dashboard to notify
you of certain metrics.

To setup a metric, complete the follow steps.

1. Click `Alerts` on the side menu.

2. Click `Add Alert` at the top of the page.

3. Select `Metric` as the alert type.

4. Select the aggregation and the metric that you would like to be performed on.

5. Select the scope if applicable.

6. Set the metric and time requirements for the alert to trigger.

7. Configure and set up the notification channel and notification interval.

8. Click the `CREATE` button.

The figure as shown provides an example of how to configure an alert when your
service instance receives multiple 401 and 403 errors within a 10 minute time
span.

![An example of a 401 and 403 configuration.](images/monitor-401-alert.png){: caption="The configuration for a 401 alert in a Monitoring dashboard." caption-side="bottom"}