You can see what the box is doing#
Configuration says what should be true. This is the other half: what is true, shown beside it, with the disagreements named.
Live, meaning live#
The Dashboard's throughput charts are driven by differenced interface counters arriving over a WebSocket every two seconds.
The stream, and what it costs the router#
The stream bypasses the agent's read cache. When the router cannot be read the frame arrives as an error rather than as silence, so a failed read never looks like an idle router.
Every call into VyOS' HTTP API forks a process on the router, so the agent budgets calls rather than intervals: one throughput sampler reads the interface counters every five seconds, an open Dashboard adds one interface read every two seconds, and operational reads are cached and served stale-while-revalidating. Idle, that is about a dozen calls a minute.
Drift, named where it happens#
Wherever intent and reality disagree, the page says which:
- an interface the kernel reports that the configuration does not declare;
- a qdisc on an interface that is not the one the QoS policy specifies;
- a static route declared but absent from the forwarding table;
- a container declared but not running;
- a DHCP reservation with no live lease.
That is the failure a page cannot show if it only reports your configuration back to you: a daemon running yesterday's configuration. Configured values render as plain fields and live values carry a pulse dot or a counter column, so you can always tell which you are looking at.
The pages#
| Page | Shows |
|---|---|
| Sessions | conntrack flows, top talkers, per-host and per-port aggregation, and the flow-export editor (system flow-accounting netflow) |
| Logs | the journal, with filters and a live tail |
| Diagnostics | conntrack health, processes, time sync, traceroute through the router's own endpoint, and show host lookup |
| Diagnostics → Neighbors | the ARP table beside LLDP: what the switch says it is, and which of its ports you are on |
| Firewall, NAT | per-rule hit counters joined from the router's own statistics |
| Certificates | the PKI store with expiry dates |
Prometheus#
/metrics is a Prometheus endpoint, and it covers the agent as well as the router:
request counts and a latency histogram, VyOS API reachability and time since last
success, calls and failures into the router's API, staged operation count, active
sessions, accounts, API tokens, per-interface throughput, cache and primer counters, and
three wheelhouse_desired_* metrics for the desired-state loop.
It needs a principal unless you pass --metrics-public.
What is not there#
An nftables ruleset inspector — the real chains, with counters, mapped back to the
configuration objects that generated each rule — is not built. Firewall hit counters
come from the router's firewall statistics instead.
Read on#
- The wiki: the metrics reference and the Sessions page.
Point the agent at a router you already have
The agent runs off-router against an existing VyOS box. Everything that reads works, which is enough to judge the pages on this one.