Monitoring#
Six jobs. Five of them are about getting state off the router, because that is where monitoring belongs.
| Guide | The job |
|---|---|
| Scrape the agent | Prometheus metrics: what is exported, and when a series is absent |
| Ship logs off the box | system syslog remote for the journal, and audit_syslog for the audit log |
| SNMP | Read-only communities for a monitoring system that speaks SNMP |
| Export flows to a collector | NetFlow and IPFIX, so somebody else keeps the history |
| See what the switch says it is | LLDP, and what it settles in thirty seconds |
| Find what is using the link right now | Live connections, the busiest devices, and their traffic history |
What the router keeps, and for how long#
The audit log is the exception to the first half: it is persisted on the box, in
/config/wheelhouse/audit.jsonl, and survives a reboot. It is not an exception to the
second. Every entry carries a sequence number and the hash of the one before it, and the
agent will copy each one to a syslog collector as it is written — off by default, switched
on in the agent's own settings, and the third step of
Ship logs off the box. Do switch it on: root on the router can rewrite
that file, and the copy that proves it is the one that already left. See
Harden a router that faces the internet.
The three log-shaped things, which are not the same#
Keeping these apart saves an hour every time something goes wrong.
| Name | Is | Where |
|---|---|---|
| The journal | systemd's log, everything the router's daemons say | Logs |
| The commit history | Numbered configuration revisions, with a diff per revision | System — history |
| The audit log | Who changed what through the agent, from where, with which role | System — audit |