Monitoring Service in VyOS

VyOS provides built-in capabilities for collecting and exporting performance metrics, system data, and logs through Telegraf and Prometheus exporters, delivering complete monitoring of your network infrastructure.

Overview

Monitoring components

VyOS supports two primary monitoring mechanisms:

Telegraf - a universal metrics collection agent:

Collection of system metrics (CPU, memory, disk, network)
Export to a wide range of monitoring systems
Support for various output plugins
Processing of logs and events

Prometheus Exporters - specialized metrics exporters:

Node Exporter - hardware and OS system metrics
FRR Exporter - Free Range Routing routing metrics
Blackbox Exporter - service availability checks

Supported monitoring systems

Telegraf can export metrics to:

InfluxDB - Time-series database
Prometheus - Monitoring and alerting system
Azure Data Explorer - Microsoft Azure analytics platform
Splunk - Data analysis platform
Loki - Log aggregation system from Grafana

Telegraf Configuration

Basic Telegraf setup

# Enable Telegraf
set service monitoring telegraf

commit
save

System metrics

Telegraf automatically collects:

CPU usage and load average
Memory and swap utilization
Disk I/O and space usage
Network interface statistics
System uptime

InfluxDB Integration

InfluxDB output configuration

# Organization and bucket
set service monitoring telegraf influxdb authentication organization 'vyos-monitoring'
set service monitoring telegraf influxdb bucket 'vyos-metrics'

# Authentication token
set service monitoring telegraf influxdb authentication token 'YOUR_INFLUXDB_TOKEN'

# InfluxDB server URL
set service monitoring telegraf influxdb url 'http://influxdb.example.com'
set service monitoring telegraf influxdb port '8086'

commit
save

InfluxDB parameters

Organization - the organization in InfluxDB 2.x:

set service monitoring telegraf influxdb authentication organization 'company-ops'

Bucket - the target bucket for metrics:

set service monitoring telegraf influxdb bucket 'network-metrics'

Token - the authentication token for the InfluxDB API:

set service monitoring telegraf influxdb authentication token 'ZAml9Uy5wrhA...=='

URL and Port:

set service monitoring telegraf influxdb url 'https://influxdb.cloud.example.com'
set service monitoring telegraf influxdb port '443'

Full InfluxDB configuration example

# InfluxDB Cloud configuration
set service monitoring telegraf influxdb authentication organization 'network-team'
set service monitoring telegraf influxdb authentication token 'eyJrIjoiVGVzdCIsIm4iOiJUZXN0...'
set service monitoring telegraf influxdb bucket 'vyos-production'
set service monitoring telegraf influxdb url 'https://eu-central-1-1.aws.cloud2.influxdata.com'
set service monitoring telegraf influxdb port '443'

commit
save

Prometheus Client Integration

Prometheus output configuration

Telegraf can export metrics in Prometheus format:

# Enable the Prometheus client
set service monitoring telegraf prometheus-client

# Address and port for scraping
set service monitoring telegraf prometheus-client listen-address '0.0.0.0'
set service monitoring telegraf prometheus-client port '9273'

# Allow access from the Prometheus server
set service monitoring telegraf prometheus-client allow-from '192.168.1.100/32'
set service monitoring telegraf prometheus-client allow-from '10.0.0.0/8'

commit
save

Prometheus Client parameters

Listen address:

set service monitoring telegraf prometheus-client listen-address '192.168.1.1'

Port (default: 9273):

set service monitoring telegraf prometheus-client port '9273'

Allow-from - network ACL:

set service monitoring telegraf prometheus-client allow-from '192.168.1.0/24'
set service monitoring telegraf prometheus-client allow-from '10.0.0.0/8'

HTTP Authentication (optional):

set service monitoring telegraf prometheus-client authentication username 'prometheus'
set service monitoring telegraf prometheus-client authentication password 'secure_password'

Metric version:

set service monitoring telegraf prometheus-client metric-version 2

Prometheus scrape configuration

Add the following to prometheus.yml on the Prometheus server:

scrape_configs:
  - job_name: 'vyos-telegraf'
    static_configs:
      - targets:
        - '192.168.1.1:9273'
        labels:
          hostname: 'vyos-router-01'
          environment: 'production'

    # If authentication is configured
    basic_auth:
      username: 'prometheus'
      password: 'secure_password'

    scrape_interval: 30s
    scrape_timeout: 10s

Azure Data Explorer Integration

Azure Data Explorer configuration

# Azure AD authentication
set service monitoring telegraf azure-data-explorer authentication client-id 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
set service monitoring telegraf azure-data-explorer authentication client-secret 'YOUR_CLIENT_SECRET'
set service monitoring telegraf azure-data-explorer authentication tenant-id 'YYYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY'

# Database configuration
set service monitoring telegraf azure-data-explorer database 'NetworkMetrics'
set service monitoring telegraf azure-data-explorer url 'https://mycluster.region.kusto.windows.net'

# Metrics grouping
set service monitoring telegraf azure-data-explorer metrics-grouping-type 'SingleTable'

commit
save

Azure Data Explorer parameters

Authentication - Service Principal credentials:

set service monitoring telegraf azure-data-explorer authentication client-id 'app-id'
set service monitoring telegraf azure-data-explorer authentication client-secret 'secret'
set service monitoring telegraf azure-data-explorer authentication tenant-id 'tenant-id'

Database:

set service monitoring telegraf azure-data-explorer database 'VyOSMetrics'

URL - Kusto cluster URL:

set service monitoring telegraf azure-data-explorer url 'https://vyoscluster.eastus.kusto.windows.net'

Metrics Grouping:

# SingleTable - all metrics in a single table
set service monitoring telegraf azure-data-explorer metrics-grouping-type 'SingleTable'

# TablePerMetric - a separate table for each metric
set service monitoring telegraf azure-data-explorer metrics-grouping-type 'TablePerMetric'

Splunk Integration

Splunk output configuration

# Splunk HEC endpoint
set service monitoring telegraf splunk url 'https://splunk.example.com:8088'

# HEC token
set service monitoring telegraf splunk authentication token 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

# Source and sourcetype
set service monitoring telegraf splunk source 'vyos-router-01'
set service monitoring telegraf splunk sourcetype 'vyos:metrics'

commit
save

Splunk parameters

URL - HTTP Event Collector endpoint:

set service monitoring telegraf splunk url 'https://splunk-hec.company.com:8088'

Authentication token:

set service monitoring telegraf splunk authentication token 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0'

Source identifier:

set service monitoring telegraf splunk source 'vyos-gateway'

Sourcetype:

set service monitoring telegraf splunk sourcetype 'network:metrics'

Index (optional):

set service monitoring telegraf splunk index 'network_metrics'

Loki Integration

Loki output configuration

# Loki server URL
set service monitoring telegraf loki url 'http://loki.example.com'
set service monitoring telegraf loki port '3100'

# Optional authentication
set service monitoring telegraf loki authentication username 'loki-user'
set service monitoring telegraf loki authentication password 'secure_pass'

# Metric name as label
set service monitoring telegraf loki metric-name-label '__name__'

commit
save

Loki parameters

URL and Port:

set service monitoring telegraf loki url 'https://loki.grafana.cloud'
set service monitoring telegraf loki port '443'

Authentication:

set service monitoring telegraf loki authentication username 'user'
set service monitoring telegraf loki authentication password 'api-key'

Labels:

set service monitoring telegraf loki metric-name-label 'metric_name'

Prometheus Node Exporter

Node Exporter provides detailed system metrics for Prometheus.

Basic configuration

# Enable Node Exporter
set service monitoring prometheus node-exporter

# Listen address and port
set service monitoring prometheus node-exporter listen-address '0.0.0.0'
set service monitoring prometheus node-exporter port '9100'

commit
save

VRF Support

# Run in a specific VRF
set service monitoring prometheus node-exporter vrf 'MGMT'

Textfile Collector

For custom metrics via the textfile collector:

# Directory for textfile metrics
# Default: /var/lib/prometheus/node-exporter/

Create a metric file:

echo 'custom_metric{label="value"} 123' > /var/lib/prometheus/node-exporter/custom.prom

Node Exporter metrics

Node Exporter provides the following metrics:

CPU: usage, frequency, thermal throttling
Memory: total, free, cached, buffers, swap
Disk: I/O statistics, space usage, inodes
Network: bytes/packets TX/RX, errors, drops
Filesystem: mount points, disk usage
System: load average, uptime, context switches
Hardware: temperature sensors, fans (if available)

Prometheus scrape config for Node Exporter

scrape_configs:
  - job_name: 'node-exporter'
    static_configs:
      - targets:
        - '192.168.1.1:9100'
        labels:
          hostname: 'vyos-router-01'
          role: 'gateway'
          site: 'datacenter-1'

Prometheus FRR Exporter

FRR Exporter provides Free Range Routing routing metrics.

FRR Exporter configuration

# Enable FRR Exporter
set service monitoring prometheus frr-exporter

# Listen address and port
set service monitoring prometheus frr-exporter listen-address '0.0.0.0'
set service monitoring prometheus frr-exporter port '9342'

# VRF
set service monitoring prometheus frr-exporter vrf 'MGMT'

commit
save

FRR Exporter metrics

FRR Exporter provides the following metrics:

BGP: peers status, prefixes received/advertised, session uptime
OSPF: neighbors, LSA counts, areas
RIP: neighbors, routes
ISIS: adjacencies, LSP counts
BFD: sessions status
Route counts: IPv4/IPv6 routes by protocol
VRF: routing table statistics per VRF

Prometheus scrape config for FRR

scrape_configs:
  - job_name: 'frr-exporter'
    static_configs:
      - targets:
        - '192.168.1.1:9342'
        labels:
          hostname: 'vyos-router-01'
          asn: '65001'

Prometheus Blackbox Exporter

Blackbox Exporter checks the availability of external services over HTTP, HTTPS, DNS, TCP, ICMP, and gRPC.

Basic configuration

# Enable Blackbox Exporter
set service monitoring prometheus blackbox-exporter

# Listen address and port
set service monitoring prometheus blackbox-exporter listen-address '0.0.0.0'
set service monitoring prometheus blackbox-exporter port '9115'

# VRF
set service monitoring prometheus blackbox-exporter vrf 'MGMT'

commit
save

DNS Module Configuration

# DNS probe module
set service monitoring prometheus blackbox-exporter modules dns name 'dns4'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' query-name 'example.com'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' query-type 'A'

# DNS server to query
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' server-address '8.8.8.8'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' server-port '53'

# Transport protocol
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' transport 'udp'

# Timeout
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' timeout '5'

commit
save

ICMP Module Configuration

# ICMP ping module (IPv4)
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' ttl '64'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' timeout '5'

# ICMP ping module (IPv6)
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp6'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp6' preferred-ip-protocol 'ip6'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp6' timeout '5'

commit
save

HTTP Module Configuration

# HTTP probe
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx'
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx' timeout '10'

# Expected status codes
# By default, 2xx codes are checked

# TLS configuration
set service monitoring prometheus blackbox-exporter modules http name 'https_check'
set service monitoring prometheus blackbox-exporter modules http name 'https_check' preferred-ip-protocol 'ip4'
# TLS verification is enabled automatically for https:// URLs

commit
save

TCP Module Configuration

# TCP connection probe
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect'
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect' timeout '5'

commit
save

gRPC Module Configuration

# gRPC health check
set service monitoring prometheus blackbox-exporter modules grpc name 'grpc_health'
set service monitoring prometheus blackbox-exporter modules grpc name 'grpc_health' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules grpc name 'grpc_health' timeout '5'

# Service name for the gRPC health check
set service monitoring prometheus blackbox-exporter modules grpc name 'grpc_health' service 'my-grpc-service'

# TLS for gRPC
# Enabled automatically for the grpcs:// scheme

commit
save

Prometheus configuration for Blackbox

scrape_configs:
  # Blackbox exporter endpoint
  - job_name: 'blackbox-exporter'
    static_configs:
      - targets:
        - '192.168.1.1:9115'

  # ICMP probes
  - job_name: 'blackbox-icmp'
    metrics_path: /probe
    params:
      module: [icmp4]
    static_configs:
      - targets:
        - 8.8.8.8
        - 1.1.1.1
        - google.com
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 192.168.1.1:9115

  # HTTP probes
  - job_name: 'blackbox-http'
    metrics_path: /probe
    params:
      module: [http_2xx]
    static_configs:
      - targets:
        - https://example.com
        - https://api.example.com/health
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 192.168.1.1:9115

  # DNS probes
  - job_name: 'blackbox-dns'
    metrics_path: /probe
    params:
      module: [dns4]
    static_configs:
      - targets:
        - example.com
        - google.com
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 192.168.1.1:9115

  # TCP probes
  - job_name: 'blackbox-tcp'
    metrics_path: /probe
    params:
      module: [tcp_connect]
    static_configs:
      - targets:
        - example.com:443
        - smtp.example.com:25
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: 192.168.1.1:9115

Grafana Dashboards

InfluxDB Dashboard

Grafana Data Source - InfluxDB v2:

Type: InfluxDB
URL: http://influxdb.example.com:8086
Organization: vyos-monitoring
Token: YOUR_INFLUXDB_TOKEN
Default Bucket: vyos-metrics

InfluxQL Query Example:

from(bucket: "vyos-metrics")
  |> range(start: -1h)
  |> filter(fn: (r) => r["_measurement"] == "cpu")
  |> filter(fn: (r) => r["_field"] == "usage_idle")
  |> aggregateWindow(every: 1m, fn: mean)

Dashboard Panels:

CPU Usage (100 - idle%)
Memory Usage (used/total * 100)
Network Traffic (bytes TX/RX per interface)
Disk I/O (read/write bytes)
System Load Average

Prometheus Dashboard

Grafana Data Source - Prometheus:

Type: Prometheus
URL: http://prometheus.example.com:9090

PromQL Query Examples:

CPU Usage:

100 - (avg by (instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)

Memory Usage:

(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100

Network Traffic (TX):

rate(node_network_transmit_bytes_total{device="eth0"}[5m])

Network Traffic (RX):

rate(node_network_receive_bytes_total{device="eth0"}[5m])

Disk Usage:

(node_filesystem_size_bytes{fstype!~"tmpfs|fuse.lxcfs|squashfs|vfat"} - node_filesystem_avail_bytes) / node_filesystem_size_bytes * 100

BGP Peers (FRR):

frr_bgp_peer_up

BGP Prefixes Received:

frr_bgp_peer_prefixes_received_count

Blackbox Probe Success:

probe_success

HTTP Response Time:

probe_http_duration_seconds

DNS Query Time:

probe_dns_lookup_time_seconds

Recommended Grafana Dashboards

Node Exporter Full:

Dashboard ID: 1860
Import URL: https://grafana.com/grafana/dashboards/1860

Telegraf System Overview:

Dashboard ID: 928
Import URL: https://grafana.com/grafana/dashboards/928

Blackbox Exporter:

Dashboard ID: 7587
Import URL: https://grafana.com/grafana/dashboards/7587

Custom VyOS Dashboard Panels

System Overview Panel:

Hostname
Uptime
VyOS Version
System Load
CPU Temperature (if available)

Network Overview Panel:

Total Bandwidth TX/RX
Interface Status (Up/Down)
Packet Errors
Packet Drops

Routing Panel:

BGP Sessions Status
OSPF Neighbors
Route Counts by Protocol
Prefix Limits

Security Panel:

Firewall Dropped Packets
Connection Tracking Usage
Failed Login Attempts (from syslog)

Configuration examples

Example 1: Basic Prometheus Monitoring

# Node Exporter for system metrics
set service monitoring prometheus node-exporter
set service monitoring prometheus node-exporter listen-address '0.0.0.0'
set service monitoring prometheus node-exporter port '9100'

# FRR Exporter for routing metrics
set service monitoring prometheus frr-exporter
set service monitoring prometheus frr-exporter listen-address '0.0.0.0'
set service monitoring prometheus frr-exporter port '9342'

# Blackbox for availability checks
set service monitoring prometheus blackbox-exporter
set service monitoring prometheus blackbox-exporter listen-address '0.0.0.0'
set service monitoring prometheus blackbox-exporter port '9115'

# ICMP module
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' preferred-ip-protocol 'ip4'

# Firewall for the Prometheus server
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address '192.168.1.100/32'
set firewall ipv4 input filter rule 100 destination port '9100,9115,9342'
set firewall ipv4 input filter rule 100 protocol tcp

commit
save

Example 2: InfluxDB Cloud Integration

# Telegraf with InfluxDB Cloud
set service monitoring telegraf influxdb authentication organization 'my-company'
set service monitoring telegraf influxdb authentication token 'eyJrIjoiVGVzdCIsIm4iOiJUZXN0...'
set service monitoring telegraf influxdb bucket 'vyos-prod'
set service monitoring telegraf influxdb url 'https://eu-central-1-1.aws.cloud2.influxdata.com'
set service monitoring telegraf influxdb port '443'

commit
save

Example 3: Hybrid Monitoring (Telegraf + Prometheus)

# Telegraf with Prometheus client output
set service monitoring telegraf prometheus-client
set service monitoring telegraf prometheus-client listen-address '0.0.0.0'
set service monitoring telegraf prometheus-client port '9273'
set service monitoring telegraf prometheus-client allow-from '192.168.1.100/32'

# Node Exporter for additional metrics
set service monitoring prometheus node-exporter
set service monitoring prometheus node-exporter listen-address '0.0.0.0'
set service monitoring prometheus node-exporter port '9100'

# FRR Exporter
set service monitoring prometheus frr-exporter
set service monitoring prometheus frr-exporter listen-address '0.0.0.0'
set service monitoring prometheus frr-exporter port '9342'

# Firewall
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address '192.168.1.100/32'
set firewall ipv4 input filter rule 100 destination port '9100,9273,9342'
set firewall ipv4 input filter rule 100 protocol tcp

commit
save

Example 4: Enterprise Multi-Output

# InfluxDB for long-term storage
set service monitoring telegraf influxdb authentication organization 'network-ops'
set service monitoring telegraf influxdb authentication token 'INFLUX_TOKEN'
set service monitoring telegraf influxdb bucket 'network-metrics'
set service monitoring telegraf influxdb url 'https://influx.company.com'
set service monitoring telegraf influxdb port '8086'

# Prometheus for real-time alerting
set service monitoring telegraf prometheus-client
set service monitoring telegraf prometheus-client listen-address '10.0.0.1'
set service monitoring telegraf prometheus-client port '9273'
set service monitoring telegraf prometheus-client allow-from '10.0.0.100/32'

# Splunk for logs and SIEM
set service monitoring telegraf splunk url 'https://splunk.company.com:8088'
set service monitoring telegraf splunk authentication token 'SPLUNK_HEC_TOKEN'
set service monitoring telegraf splunk source 'vyos-gateway-01'
set service monitoring telegraf splunk sourcetype 'vyos:metrics'

commit
save

Example 5: Blackbox Probing

# Blackbox Exporter
set service monitoring prometheus blackbox-exporter
set service monitoring prometheus blackbox-exporter listen-address '0.0.0.0'
set service monitoring prometheus blackbox-exporter port '9115'

# ICMP IPv4
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' ttl '64'

# ICMP IPv6
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp6'
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp6' preferred-ip-protocol 'ip6'

# DNS check (IPv4)
set service monitoring prometheus blackbox-exporter modules dns name 'dns4'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' query-name 'example.com'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' query-type 'A'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' server-address '8.8.8.8'
set service monitoring prometheus blackbox-exporter modules dns name 'dns4' transport 'udp'

# HTTP check
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx'
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules http name 'http_2xx' timeout '10'

# TCP check
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect'
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect' preferred-ip-protocol 'ip4'
set service monitoring prometheus blackbox-exporter modules tcp name 'tcp_connect' timeout '5'

commit
save

Example 6: VRF Isolation

# Management VRF for monitoring
set service monitoring prometheus node-exporter vrf 'MGMT'
set service monitoring prometheus node-exporter listen-address '10.0.0.1'
set service monitoring prometheus node-exporter port '9100'

set service monitoring prometheus frr-exporter vrf 'MGMT'
set service monitoring prometheus frr-exporter listen-address '10.0.0.1'
set service monitoring prometheus frr-exporter port '9342'

set service monitoring prometheus blackbox-exporter vrf 'MGMT'
set service monitoring prometheus blackbox-exporter listen-address '10.0.0.1'
set service monitoring prometheus blackbox-exporter port '9115'

commit
save

Operational commands

Checking Telegraf status

# Service status
show service monitoring telegraf

# Check the process
run show system processes | grep telegraf

Checking Prometheus Exporters

# Node Exporter metrics
curl http://localhost:9100/metrics

# FRR Exporter metrics
curl http://localhost:9342/metrics

# Blackbox Exporter health
curl http://localhost:9115/health

Testing Blackbox Probes

# ICMP probe
curl 'http://localhost:9115/probe?module=icmp4&target=8.8.8.8'

# HTTP probe
curl 'http://localhost:9115/probe?module=http_2xx&target=https://example.com'

# DNS probe
curl 'http://localhost:9115/probe?module=dns4&target=example.com'

# TCP probe
curl 'http://localhost:9115/probe?module=tcp_connect&target=example.com:443'

Restart Services

# Restart Telegraf
restart monitoring telegraf

# Note: Prometheus exporters restart automatically when the configuration changes

Monitoring and diagnostics

Checking metrics

Node Exporter endpoint:

curl http://localhost:9100/metrics | head -20

Filter specific metrics:

curl http://localhost:9100/metrics | grep node_cpu
curl http://localhost:9100/metrics | grep node_memory
curl http://localhost:9100/metrics | grep node_network

Logs

# Telegraf logs
show log | match telegraf

# System logs
show log | match monitoring

Firewall check

# Check the rules for the monitoring ports
show firewall ipv4 input filter

# Test connectivity with the Prometheus server
ping 192.168.1.100

Performance

# Check CPU usage from the exporters
run show system processes | grep -E 'node_exporter|frr_exporter|blackbox'

# Network connections
run netstat -tulpn | grep -E '9100|9115|9273|9342'

Troubleshooting

Telegraf is not sending metrics to InfluxDB

Problem: Metrics do not appear in InfluxDB.

Causes:

Incorrect token or organization
Network connectivity issues
Firewall blocking outbound connections
Incorrect bucket name

Diagnostics:

# Check the configuration
show service monitoring telegraf influxdb

# Check connectivity
ping influxdb.example.com

# Check the logs
show log | match telegraf

Solution:

# Verify authentication
set service monitoring telegraf influxdb authentication token 'CORRECT_TOKEN'

# Verify the URL
set service monitoring telegraf influxdb url 'https://correct-url.influxdata.com'

# Commit and restart
commit
restart monitoring telegraf

Prometheus cannot scrape metrics

Problem: Prometheus targets show a “down” status.

Causes:

Firewall blocking the ports
The exporter is not running
Incorrect listen address
Network routing issues

Diagnostics:

# Check the exporters
curl http://localhost:9100/metrics
curl http://localhost:9342/metrics

# Check listening ports
run netstat -tulpn | grep -E '9100|9342'

# Firewall
show firewall ipv4 input filter

Solution:

# Firewall rule
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address '192.168.1.100/32'
set firewall ipv4 input filter rule 100 destination port '9100,9342,9115'
set firewall ipv4 input filter rule 100 protocol tcp

# Listen on the correct interface
set service monitoring prometheus node-exporter listen-address '192.168.1.1'

commit

Blackbox probe failures

Problem: Blackbox probes show probe_success = 0.

Causes:

The target is unreachable
The timeout is too short
Firewall blocking ICMP/DNS/HTTP
Incorrect module configuration

Diagnostics:

# Test the probe manually
curl 'http://localhost:9115/probe?module=icmp4&target=8.8.8.8'

# Check connectivity
ping 8.8.8.8

# DNS test
dig @8.8.8.8 example.com

Solution:

# Increase the timeout
set service monitoring prometheus blackbox-exporter modules icmp name 'icmp4' timeout '10'

# Check the firewall for outbound ICMP
show firewall ipv4 output filter

commit

FRR Exporter does not show BGP metrics

Problem: BGP metrics are missing or zero.

Causes:

BGP is not configured
The FRR daemon is not running
The exporter does not have access to FRR vtysh

Diagnostics:

# Check BGP
show ip bgp summary

# Check FRR
run show system processes | grep bgpd

# Test the FRR exporter
curl http://localhost:9342/metrics | grep bgp

Solution:

# Restart the FRR exporter
commit
# The exporter will restart automatically

# Check the FRR configuration
show protocols bgp

High memory usage from Telegraf

Problem: Telegraf consumes a lot of memory.

Causes:

Too many output plugins
Buffering issues
High metrics cardinality

Solution:

Use only the outputs you need
Configure metric filtering
Increase the flush interval

Metrics missing in Grafana

Problem: Grafana panels are empty or show “No data”.

Causes:

The data source is misconfigured
Query syntax error
The time range contains no data
The metric name has changed

Diagnostics:

# Verify that the metrics are available
curl http://192.168.1.1:9100/metrics | grep node_cpu

# Check in the Grafana Query Inspector
# Grafana → Panel → Query Inspector → Query

Solution:

Check the Data Source connectivity in Grafana
Validate the PromQL query syntax
Adjust the time range
Check the metric names on the /metrics endpoint

Security

Firewall Protection

# Allow only from monitoring servers
set firewall ipv4 input filter rule 100 action accept
set firewall ipv4 input filter rule 100 source address '192.168.1.100/32'
set firewall ipv4 input filter rule 100 destination port '9100,9115,9273,9342'
set firewall ipv4 input filter rule 100 protocol tcp

# Drop the rest
set firewall ipv4 input filter rule 999 action drop
set firewall ipv4 input filter rule 999 destination port '9100,9115,9273,9342'
set firewall ipv4 input filter rule 999 protocol tcp

HTTP Authentication for the Prometheus Client

set service monitoring telegraf prometheus-client authentication username 'prometheus'
set service monitoring telegraf prometheus-client authentication password 'SecurePassword123!'

VRF Isolation

# Isolate monitoring in the management VRF
set service monitoring prometheus node-exporter vrf 'MGMT'
set service monitoring prometheus frr-exporter vrf 'MGMT'
set service monitoring prometheus blackbox-exporter vrf 'MGMT'

TLS for Telegraf outputs

For InfluxDB Cloud and Splunk, use HTTPS URLs:

set service monitoring telegraf influxdb url 'https://influxdb.example.com'
set service monitoring telegraf splunk url 'https://splunk.example.com:8088'

Secrets Management

Never commit tokens to version control:

Use environment variables where possible
Rotate tokens regularly
Use read-only tokens where possible

Best practices

Use a VRF for management traffic:
- Isolate monitoring in a dedicated VRF
- Protect the management network
Restrictive firewall rules:
- Allow only specific monitoring servers
- Block public access to the exporters
Monitoring redundancy:
- Multiple Prometheus servers
- InfluxDB clustering
- Grafana high availability
Metric retention:
- Short-term in Prometheus (15-30 days)
- Long-term in InfluxDB (1+ year)
Alerting:
- Configure the Prometheus Alertmanager
- Alert on critical metrics:
  - CPU > 80%
  - Memory > 90%
  - Disk > 85%
  - Interface down
  - BGP session down
Dashboard organization:
- Separate dashboards by function
- Use folders in Grafana
- Standard naming conventions
Performance:
- Tune scrape intervals (30s for most cases)
- Limit metric cardinality
- Use recording rules for expensive queries
Documentation:
- Document custom metrics
- Maintain a dashboard inventory
- Document alerting thresholds
Testing:
- Test queries before deployment
- Validate alert rules
- Test failover scenarios
Regular reviews:
- Review metrics usage
- Clean up unused dashboards
- Update alerting rules
- Rotate credentials

Conclusion

VyOS provides comprehensive monitoring capabilities through Telegraf and Prometheus exporters, delivering full visibility into the performance and health of your network infrastructure.

Key capabilities:

Telegraf - a universal agent for multiple outputs (InfluxDB, Prometheus, Splunk, Azure, Loki)
Node Exporter - detailed system metrics (CPU, memory, disk, network)
FRR Exporter - routing protocol metrics (BGP, OSPF, ISIS)
Blackbox Exporter - service availability probing (HTTP, DNS, ICMP, TCP)

Integration:

Seamless integration with Prometheus and Grafana
Native support for InfluxDB and Splunk
Cloud-ready (Azure Data Explorer, InfluxDB Cloud)

Recommendations:

Use Prometheus + Grafana for real-time monitoring and alerting
Use InfluxDB for long-term storage and capacity planning
Configure Blackbox Exporter for proactive service monitoring
Protect the exporters with firewall and VRF isolation

A properly configured monitoring setup delivers proactive problem detection, capacity planning, and troubleshooting capabilities for VyOS-based network infrastructure.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

TFTP Server in VyOS Web Proxy (Squid) in VyOS