Inspect slow commands and live command traffic in Redis

Redis provides two useful views of command activity: the in-memory slow log for commands exceeding an execution-time threshold, and MONITOR for a live diagnostic stream. Neither is a durable, complete audit trail.

Set a slow-log threshold

In redis.conf:

slowlog-log-slower-than 10000
slowlog-max-len 128

The threshold is in microseconds: 10000 means 10 ms. The length setting bounds the number of retained entries, not their age.

To change the running instance through redis-cli:

CONFIG SET slowlog-log-slower-than 10000
CONFIG SET slowlog-max-len 128

Use an account permitted to read and change these settings. Runtime changes need a corresponding persistent configuration change if they must survive a restart.

Read and clear entries

SLOWLOG GET
SLOWLOG GET 10
SLOWLOG LEN
SLOWLOG RESET

SLOWLOG GET returns recent entries, newest first. Records include an ID, timestamp, execution duration, and command arguments; newer versions also include client details. Argument count or length may be truncated, and sensitive commands can have redacted or omitted information. Do not treat the result as a byte-for-byte copy of every request.

RESET removes the retained records, so export useful evidence before clearing them. The slow log lives in memory and is lost when the process restarts. If you need history, collect it often enough to avoid losing entries when the bounded list fills.

Observe live traffic

redis-cli MONITOR

Stop with Ctrl+C after a short capture. Streaming commands can impose substantial overhead and expose application data. The impact depends on workload and clients; a benchmark percentage is not a guarantee for your instance.

Despite its name, MONITOR is not an exhaustive security audit. Redis deliberately excludes or redacts some command information. Managed services may restrict access.

Interpret the timings correctly

Slow-log duration measures command execution inside Redis. It excludes client network transfer and time waiting before the command begins executing. A slow client request can therefore have no corresponding slow-log entry.

A threshold of 0 requests logging regardless of duration; a negative threshold disables slow logging. Even at zero, command exclusions still apply. The in-memory design avoids a file write for each entry, but logging every command and retaining large arguments still consumes resources.

For Guance collection, the Redis integration exposes slow-log data. Check the collector's permissions and interval against the source's retention length, then verify IDs and durations using a known test command. Lost source entries cannot be recovered by polling later.

See the SLOWLOG reference and MONITOR reference for their coverage and restrictions.