Monitoring#
Six jobs. Five of them are about getting state off the router, because that is where monitoring belongs.
| Guide | The job |
|---|---|
| Scrape the agent | Prometheus metrics: what is exported, and when a series is absent |
| Ship logs off the box | system syslog remote to a collector |
| SNMP | Read-only communities for a monitoring system that speaks SNMP |
| Export flows to a collector | NetFlow and IPFIX, so somebody else keeps the history |
| See what the switch says it is | LLDP, and what it settles in thirty seconds |
| Find what is using the link right now | Live conntrack flows and per-host totals |
What the router keeps, and for how long#
The audit log is the exception: it is persisted on the box, in
/config/wheelhouse/audit.jsonl. It cannot leave the box — there is no syslog or SIEM
export for it, no hash chain and no sequence numbers. See
Harden a router that faces the internet.
The three log-shaped things, which are not the same#
Keeping these apart saves an hour every time something goes wrong.
| Name | Is | Where |
|---|---|---|
| The journal | systemd's log, everything the router's daemons say | Logs |
| The commit history | Numbered configuration revisions, with a diff per revision | System — history |
| The audit log | Who changed what through the agent, from where, with which role | System — audit |
Checked against agent/metrics.go ·
agent/store.go ·
ui/src/pages/SessionsExtras.tsx ·
PLAN.md