KC 20.0.1 Prometheus /metrics Internal Server Error

Hello,
we have updated a test system (Linux RHEL 8.5 | Java OpenJdk-11.0.16) from Keycloak 18.0.1 to 20.0.1, with version 18.x the Prometheus endpoint https://xx.xx.xx.xx/auth/metrics worked but after updating to version 20.0.1 we got an internal server error.

  • kc.sh build we have done and the KC starts without optimized
  • KC is behind a reverse proxy

the aerogear/keycloak-metrics-spi metrics work but the internal ones do not.

with KC 20.0.5 the same

can someone help?
thank you

ERROR:


2023-04-13 10:31:57,269 ERROR [io.quarkus.vertx.http.runtime.QuarkusErrorHandler] (executor-thread-0) HTTP Request to /auth/metrics failed, error id: 8b5a3e96-0f7a-449c-b557-7088369dead6-4: java.lang.NullPointerException
        at org.keycloak.services.error.KeycloakErrorHandler.getResponse(KeycloakErrorHandler.java:61)
        at org.keycloak.services.error.KeycloakErrorHandler.toResponse(KeycloakErrorHandler.java:56)
        at org.jboss.resteasy.core.ExceptionHandler.executeExceptionMapper(ExceptionHandler.java:136)
        at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:309)
        at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:218)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:258)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler$1.run(VertxRequestHandler.java:91)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:564)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:829)

config:

# Basic settings for running in production. Change accordingly before deploying the server.

# Database

# The database vendor.
db=mariadb

# The username of the database user.
db-username=keycloakdbuser

# The password of the database user.
db-password=s0m3P4$$

# The full database JDBC URL. If not provided, a default URL is set based on the selected database vendor.
db-url=jdbc:mariadb://localhost:3306/keycloakdb

# Observability

# If the server should expose healthcheck endpoints.
#health-enabled=true

# If the server should expose metrics endpoints.
metrics-enabled=true

# HTTP

# The file path to a server certificate or certificate chain in PEM format.
#https-certificate-file=${kc.home.dir}conf/server.crt.pem

# The file path to a private key in PEM format.
#https-certificate-key-file=${kc.home.dir}conf/server.key.pem

# The proxy address forwarding mode if the server is behind a reverse proxy.
proxy=edge

# Do not attach route to cookies and rely on the session affinity capabilities from reverse proxy
#spi-sticky-session-encoder-infinispan-should-attach-route=false

# Bindung an alle interfaces
http-relative-path=auth
## Port conf
http-port=9080
https-port=9443

##http-port=80
##https-port=443


# Hostname for the Keycloak server.
# hostname=someIP
hostname-strict=false

Hi,
we had the same issue in our environment and figured out, that the relative path must start with a “/” for the quarkus metrics.
changing http-relative-path=auth
to http-relative-path=/auth
should fix your issue.

1 Like

thanks for your help it works.

I am so grateful to you for this response! very good find.