Services, monitoring and system#
The rest of the web UI. Everything on the pages below either watches the router or changes something about the box itself rather than about a protocol: what the Dashboard counts and where each number came from, the shaper, the app store, the six diagnostics tabs, the journal, system identity and time, boot images, the commit history, the audit log, and the licence that gates every write.
Two facts hold across this whole section, and are repeated on each page rather than assumed.
Reading never needs a licence; changing anything does. The write plane
(POST /api/stage, /api/commit, /api/configure, /api/rollback,
/api/config/save, every app action) is wrapped in licensed, which is
writeable(requireLicense(...)) — the operator role and a usable licence. An
unlicensed agent answers 402 on those routes and keeps serving every read, the audit
log and the login screen — agent/main.go,
agent/license.go.
Almost nothing here is instant, and the pages say which parts are. Configuration changes are staged and committed like everywhere else in the product. The exceptions — listed once, here — are reboot, power off, boot-image operations, pulling a container image, restarting an app, enabling a feature module, saving the boot config, restoring a revision, and the licence itself. Each of those acts at once, is admin-only or operator-only, and is written to the audit log.
The pages#
| Page | The screen it documents |
|---|---|
| Dashboard | The landing page, panel by panel, and what a dash instead of a zero means. |
| Telemetry | Where every live number on the Dashboard comes from: the sampler, the WebSocket, the read cache, /metrics. |
| QoS | The CAKE policy editor, the qdisc the kernel actually installed, and what the editor does not write. |
| Apps | The catalogue, the three steps an install takes, and what an app is in the config tree. |
| Companions | The configuration state of UPnP, the resolver and the DHCP server — and the gap this page reports. |
| Diagnostics | Six tabs for when something is wrong. |
| Logs | The router's journal, filtered and followed. |
| System | Overview, settings, commit history, the audit log, boot images, power, and how to take a backup. |
| Agent settings | Session lifetime, mandatory two-factor, the commit-confirm default, audit retention. |
| Licence | What this agent holds, what the licence server last said, and entering or replacing a key. |
Three things that get confused#
The product keeps three separate records and this documentation never blurs them.
| What it is | Where | |
|---|---|---|
| The journal | The router's own syslog, as show log tail <n> prints it. | Logs |
| The commit history | VyOS' archived configuration revisions, with a per-revision diff and a restore. | System → History |
| The audit log | Who asked this agent to change something, from which address, with which role, and whether it worked. | System → Audit |
A change made at the console appears in the journal and in the commit history, and not in the audit log — the audit log records what went through the agent. A refused login appears in the audit log and nowhere else.
See also#
- Network — interfaces, routes, DHCP, DNS and high availability.
- Security, VPN and accounts — firewall, NAT, IDS, the VPNs and who may do what.
- About Wheelhouse — what the base is, and where the licence boundary between it and this product sits.
- Contributing to this documentation — how these pages are built and checked.
Checked against agent/main.go,
agent/license.go,
agent/store.go,
ui/src/components/nav.ts.