Scrape the agent#

You will end up with Prometheus scraping the agent and a dashboard that shows the router's throughput, the agent's own health, and whether it can reach the router at all.

Before you start#

An API token with the viewer role — Issue a token for automation. /metrics is gated on the viewer role by default.
A Prometheus that can reach the router on 8443.

Step 1 — Scrape it#

prometheus.yml

scrape_configs:
  - job_name: wheelhouse
    scheme: https
    tls_config:
      insecure_skip_verify: true      # or point ca_file at your own certificate
    authorization:
      credentials: wh_...
    static_configs:
      - targets: ['192.0.2.1:8443']

insecure_skip_verify is only right while the agent is serving its self-signed certificate. Issue a certificate and drop it when you have a trusted one.

The endpoint can be opened without authentication with the agent's --metrics-public flag, which is off by default. Prefer a token: the metrics name your interfaces, your account count and your session count.

Step 2 — Know what you are getting#

Series	What it tells you
`wheelhouse_up`, `wheelhouse_uptime_seconds`, `wheelhouse_build_info`	The agent is alive, for how long, and which build
`wheelhouse_http_requests_total{method,route,status}`	Request volume by route and status
`wheelhouse_http_request_duration_seconds`	A histogram of request latency
`wheelhouse_router_reachable`, `wheelhouse_router_last_success_seconds`	Whether the agent can talk to the router, and when it last could
`wheelhouse_vyos_calls_total`, `wheelhouse_vyos_failures_total`	Calls into the router's API, and how many failed
`wheelhouse_vyos_request_duration_seconds`	How long the router takes to answer
`wheelhouse_cache_reads_total`, `wheelhouse_cache_primes_total`, `wheelhouse_cache_prime_reads_total`, `wheelhouse_cache_prime_seconds_total`	The read-through cache and the background primer
`wheelhouse_interface_rx_bytes_per_second{interface}`, `wheelhouse_interface_tx_bytes_per_second{interface}`	Per-interface throughput, from the sampler
`wheelhouse_staged_operations`	How many operations are sitting in the Commit Bar
`wheelhouse_sessions_active`, `wheelhouse_users`, `wheelhouse_api_tokens`	Accounts and sessions
`wheelhouse_oidc_assertions_total`, `wheelhouse_oidc_roles_total`	Single sign-on activity
`wheelhouse_desired_managed`, `wheelhouse_desired_drift`, `wheelhouse_desired_pending_ops`	Desired-state enforcement

Step 3 — Alert on the two that matter most#

The agent cannot reach the router. Everything else is downstream of this.

yaml

- alert: WheelhouseRouterUnreachable
  expr: wheelhouse_router_reachable == 0
  for: 2m

Configuration has drifted from the desired-state file — if you use one.

yaml

- alert: WheelhouseConfigDrift
  expr: wheelhouse_desired_drift == 1
  for: 15m

Alert on drift has the whole picture, including the /api/drift endpoint, which carries more detail than the metric.

An absent series is information#

What is not here#

Any CPU, memory or throughput budget you have read about this product is a target. None has been measured, on hardware or in CI. Scrape your own router and use those numbers instead.

Check it worked#

bash

R=https://<router>:8443
T=wh_...
curl -sk -H "Authorization: Bearer $T" "$R/metrics" | head -30

Then in Prometheus: the target is up, and wheelhouse_router_reachable is 1.

Undoing it#

Remove the scrape config, and revoke the token — Issue a token for automation.