Services, monitoring and system#
The rest of the web UI. Every page below either watches the router or changes something about the box itself rather than about a protocol: the Overview's status, traffic and connected devices, the shaper, the app store, the six diagnostics tabs, the journal, system identity and time, system images, the configuration history, the audit log, the support bundle, and the licence.
Two rules hold across the whole section.
Reading never needs a licence; changing anything does. Adding and applying changes,
restoring a revision, saving the configuration and every app action need a usable
licence, and the operator role (restoring and applying, the approver role). An unlicensed agent answers 402
on those routes and keeps serving every read, the audit log and the login screen.
Most changes here are added to the pending changes and applied from the Commit Bar, like everywhere else in the product. These act immediately instead: restarting or shutting down the router, system image operations, pulling a container image, restarting an app, enabling a feature module, saving the UPnP settings, removing a UPnP mapping, saving the configuration, restoring a revision, restarting the agent, and entering a licence. Each is admin-only or operator-only and is written to the audit log.
The pages#
| Page | The screen it documents |
|---|---|
| Overview | The landing page, card by card: the status ring and headline, WAN traffic, what needs attention, and who is connected. |
| Telemetry | Where every live number in the web UI comes from: the interface sampler, the live stream, the read cache and /metrics. |
| Sessions | Conntrack flows and per-host top talkers, why a byte column can be empty, and how old the table is. |
| QoS | The CAKE policy editor, the qdisc the kernel installed, and what the editor does not write. |
| Apps | The catalogue, the three steps an install takes, and what an app is in the config tree. |
| Companions | The configuration state of the resolver and the DHCP server, and the UPnP node the platform does not have. |
| Diagnostics | Six tabs for when something is wrong. |
| Logs | The router's journal, filtered and followed. |
| System | Overview, updates, settings, configuration history, the audit log, system images, power, and how to take a backup. |
| Support | The support bundle: what it contains and what it never carries. |
| Agent settings | Session lifetime, mandatory two-factor, the auto-revert window, audit retention, the audit log's syslog export, the management address, and restarting the agent. |
| Licence | What this agent holds, what the licence server last said, and entering or replacing a key. |
Three records that get confused#
| What it is | Where | |
|---|---|---|
| The journal | The router's own syslog, as show log tail <n> prints it. | Logs |
| The configuration history | VyOS' archived configuration revisions, each described in words, with a restore. | System → History |
| The audit log | Who asked this agent to change something, from which address, with which role, and whether it worked. | System → Audit log |
A change made at the console appears in the journal and in the configuration history, and not in the audit log — the audit log records what went through the agent. A refused login appears in the audit log and nowhere else.
See also#
- Network — interfaces, routes, DHCP, DNS and high availability.
- Security, VPN and accounts — firewall, NAT, IDS, the VPNs and who may do what.
- About Wheelhouse — what the base is, and where the licence boundary between it and this product sits.