Traffic history#

The History view on Interfaces, reached from the segmented control in the header. It answers the question a live rate cannot: was the link saturated at three in the morning?

The live sampler keeps 240 samples per interface, five seconds apart, about twenty minutes, in memory. This is the archive those samples are folded into, and it is on the router's disk. The Overview's traffic chart is drawn from it too: the last hour, six hours or 24 hours of one uplink, by the minute.

What it keeps#

Up to 32 interfaces. Beyond that the archive settles rather than thrashing: the interfaces already being recorded keep their rings, and any live interface that could not get a slot is named on the page rather than silently drawn as absent. A slot is only taken from an interface that has stopped being sampled.

The page prints these numbers from what the agent reports, not from a sentence written here, so the retention it promises and the ring it holds cannot drift apart.

What it costs the router#

Nothing. The archive makes no op-mode call of its own: it folds the samples the live sampler has already taken — one show interfaces counters every five seconds, whatever the interface count — and a test asserts that a fold adds zero router calls. Reading a window is arithmetic over what is already in memory.

Reading it honestly#

The view is explicit about which of four situations it is in, because an empty chart means four different things:

• Traffic history is not being recorded. The archive loop is not running in this agent, so the window is empty for that reason and not because the link was quiet.
• Recording since <time>, no points yet. Started less than one step ago — the first minute point appears after a full minute has been observed.
• Nothing recorded in this period. It has been recording longer than that, and there is genuinely nothing here.
• A break in the line. The agent recorded nothing for part of the window. The chart breaks the line rather than joining across the hole, and says how many breaks there are.

A partial bucket — the minute that is still filling — is the average of the seconds actually observed, not of the whole minute, so the newest point is never diluted by time that has not happened yet.

Surviving a restart#

The archive is written to traffic-history.json.gz under the agent's data directory every five minutes, and again when the agent is asked to stop — and the agent waits for that last write rather than exiting into it. So an orderly restart loses nothing, and a crash or a power cut loses at most the last five minutes of points in both tiers, because the bucket that was open at the time was never written.

If the agent has no data directory the archive still runs in memory and the page says so, because a history that will not survive a restart must not be presented as one that will.

See also#

• Interfaces — the table this view shares a page with.
• Telemetry — the live sampler, and what else is metered.
• Overview — the landing page's traffic chart, drawn from this archive.
• Sessions — traffic history by device.
• Flow export — per-flow history, kept by a collector.