Operations

Health, readiness, and delivery

sudo netflowscout status --component all \
  --config /etc/netflowscout/netflowscout.json \
  --endpoint-dir /etc/netflowscout/endpoints --require-ready

The main service exposes distinct loopback HTTP endpoints:

Endpoint	Meaning
/healthz	Main process and queue liveness
/readyz	Also checks analyzer, protocol routes, and capture heartbeat
/status	Versions, plugins, rules, queue, business, and sink status
/metrics	Prometheus counters and latency histograms
/business	Bounded recent-window business Top N

Unified endpoint coverage requires selected endpoint files through status --component all. Remote delivery failures are reported independently and should not cause a healthy main process to restart repeatedly.

Signals to monitor

• Kernel loss, bridge/client rejection, and analyzer output drops happen before the WAL and can lose business observations.
• Late input and group/distinct/state overflow can make rule results incomplete; they cannot establish health.
• Per-sink pending counts, failures, retry times, and oldest FIFO event time distinguish delivery failure from idle business.
• Wasm traps/timeouts, rebuilds, generations, and RSS reveal plugin failures and draining old connections.

Counters generally reset on process restart. Record PID, build digest, and sample time when comparing. Top N p95/p99 values are histogram bucket bounds, not exact quantiles.

Reload and restart

sudo systemctl reload netflowscout.service
sudo systemctl reload netflowscout-analyzer.service
sudo systemctl restart netflowscout-discovery@app.service
journalctl -u netflowscout.service -u netflowscout-analyzer.service --since '10 min ago'

These reload rules, reload compatible plugins, and reread endpoint policies respectively. Main configuration, schema, sensitivity, or ABI changes require a full check and coordinated restart. Failed rule reloads retain the old engine. Plugin reloads switch new connections while existing ones retain their generation.

Capacity and disk

queue.max_bytes bounds logical event data and accounting, not physical WAL size. Rule checkpoints have a separate budget; compaction needs temporary disk space. Reserve headroom for WAL, compaction, and output retention. Allow at least 2 GiB for the default queue setup plus output retention.

A full queue rejects new events without evicting committed ones. Never share a WAL or output file between service instances. Stop writers before backup/migration and preserve the complete directory. On corruption or recovery failure, retain the original data and collect diagnostics rather than deleting it.

Collect diagnostics

sudo netflowscout diagnose --config /etc/netflowscout/netflowscout.json \
  --endpoint-config /etc/netflowscout/endpoints/billing.json --out /tmp/nfs-diagnostics.tar.gz
netflowscout version
netflowscout support

The exclusively created 0600 archive contains status, counters, hashes, and target metadata, without environment values, PCAP, raw content, or rule source. Include incident time, input source, affected service, and sanitized reproduction steps when reporting an issue.