Verify your setup

Verify process health, capture coverage, business parsing, and event acknowledgements separately. Each result has its own scope; /healthz cannot certify the complete pipeline.

1. Configuration and coverage

sudo netflowscout onboard --config /etc/netflowscout/netflowscout.json \
  --endpoint-dir /etc/netflowscout/endpoints --timeout 30s

This checks the main service, analyzer, selected endpoint configurations, heartbeats, wiring, build identities, attachment counts, and overlapping targets. Its default scope is readiness_only; it sends no synthetic traffic. Zero matches means waiting, not observed business activity.

Poll with status --component all --require-ready or use the TUI. Select only endpoint files belonging to this pipeline. The scope excludes undeclared applications and other nodes.

2. Synthetic pipeline

Enable verification.enabled=true in the main configuration and restart the main service and analyzer, then run:

sudo netflowscout verify --config /etc/netflowscout/netflowscout.json \
  --canary --timeout 30s

Synthetic streams pass through the private socket, actual Wasm, rules, redaction, WAL, and enabled sinks. Capture always remains not_verified: no interface or TLS probe is involved. Use this to isolate downstream pipeline failures.

3. Real traffic and delivery

sudo netflowscout verify --config /etc/netflowscout/netflowscout.json \
  --service billing --expect-type http.transaction \
  --expect-event http.slow \
  --endpoint-config /etc/netflowscout/endpoints/billing.json --timeout 60s

After the command starts, generate a new request in another terminal that actually triggers the loaded http.slow rule. Use an event name present in your configuration. The verifier does not call the application for you.

Passing requires a new complete, non-truncated, non-late observation evaluated by a rule of the same record type. --expect-event additionally requires the matching event and independent sink acknowledgements. Without it, delivery remains not_verified.

Interpret results

Result	Next action
Attached but no business observation	Check for new requests, correct protocol/role, and source selection
Business passed, delivery unverified	Specify an event that your request will actually trigger
Empty queue but unconfirmed	Check credentials, receiver, and receipt retention; emptiness is not delivery proof
Dataway acknowledged	Query the same event_id on the destination platform to prove retrieval

The WAL retains the latest 8192 sink receipts; expired receipts become unconfirmed. Synthetic, loopback, and physical capture tests establish different evidence.