You can see what the box is doing#
Configuration says what should be true. This is the other half: what is true, shown beside it, with the disagreements named.
Live, meaning live#
The Dashboard's throughput charts are driven by differenced interface counters arriving over a WebSocket every two seconds. The stream deliberately bypasses the agent's read cache, because a panel labelled live that replays a three-second-old cache is not live. When the router cannot be read, the frame arrives as an error rather than as silence — a frame with null data would look like an idle router, and the stream is the Dashboard's liveness indicator.
Underneath, the agent budgets calls rather than intervals, because every call into VyOS'
HTTP API forks a process on the router. One throughput sampler reads the interface
counters every five seconds — one call for every interface — which is why a chart is
already populated when you open a tab. An open Dashboard adds one interface read every
two seconds for its stream. Operational reads are cached and served
stale-while-revalidating, warmed by a background primer and invalidated by the commit the
agent itself performed. Idle, that is about a dozen calls a minute
(docs/deploy.md).
Drift, named where it happens#
Wherever intent and reality disagree, the page says which:
- an interface the kernel reports that the configuration does not declare;
- a qdisc on an interface that is not the one the QoS policy specifies;
- a static route declared but absent from the forwarding table;
- a container declared but not running;
- a DHCP reservation with no live lease.
This is the failure OPNsense never tells you about: a daemon happily running yesterday's configuration. The rule in the interface's own design notes is that configured values render as plain fields and live values carry a pulse dot or a counter column, so you can always tell which you are looking at.
The pages#
| Page | Shows |
|---|---|
| Sessions | conntrack flows, top talkers, per-host and per-port aggregation, and the flow-export editor (system flow-accounting netflow) |
| Logs | the journal, with filters and a live tail |
| Diagnostics | conntrack health, processes, time sync, traceroute through the router's own endpoint, and show host lookup |
| Diagnostics → Neighbors | the ARP table beside LLDP: what the switch says it is, and which of its ports you are on |
| Firewall, NAT | per-rule hit counters joined from the router's own statistics |
| Certificates | the PKI store with expiry dates |
Prometheus#
/metrics is a Prometheus endpoint, and it covers the agent as well as the router:
request counts and a latency histogram, VyOS API reachability and time since last
success, calls and failures into the router's API, staged operation count, active
sessions, accounts, API tokens, per-interface throughput, cache and primer counters, and
three wheelhouse_desired_* metrics for the desired-state loop
(agent/metrics.go).
It needs a principal unless you pass --metrics-public.
What is not there#
An nftables ruleset inspector — the real chains, with counters, mapped back to the
configuration objects that generated each rule — is not built. Firewall hit counters
come from the router's firewall statistics instead.
Read on#
- The wiki: the metrics reference and the Sessions page.