graylog-deploy/dashboards/view_servers.json
byrsapty 510ca37e48 Add flood alerts, session correlation, focused dashboards, and CI deploy workflow
- Two flood-detection alerts (per-source message volume, calibrated live
  against real traffic) grouped by gl2_remote_ip
- Session correlation: accelppp_interface fallback tagging plus
  radius_session_id/calling_station_id/radius_username extraction, so a
  subscriber's full session lifecycle is searchable by one key
- Replace the single combined dashboard with three focused ones (Overview
  & Alerts, Network Equipment, Servers & Sessions)
- Propagate GRAYLOG_ROOT_TIMEZONE and IP-in-alerts fixes into the reusable
  install script and templates
- Add a Forgejo Actions workflow (manual trigger) that re-runs
  install-graylog.sh on a self-hosted runner living in the container,
  automating the deploy step this project has done by hand all along

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-22 21:31:08 +03:00

147 lines
6.4 KiB
JSON

{
"entity": {
"type": "DASHBOARD",
"title": "Servers & Sessions",
"summary": "accel-ppp/RADIUS/conntrack - event types, top servers by volume, RADIUS accounting status breakdown.",
"description": "Scoped to the Servers stream only. Default range is 7 days. To trace one subscriber's full session, search accelppp_interface, calling_station_id, or radius_session_id on the Search page.",
"search_id": "__SEARCH_ID__",
"properties": [],
"requires": {},
"state": {
"a3000000-0000-0000-0000-000000000001": {
"selected_fields": null,
"static_message_list_id": null,
"titles": {
"tab": {"title": "Servers & Sessions"},
"widget": {
"a3000000-0000-0000-0000-000000000011": "Messages Over Time by Event Type",
"a3000000-0000-0000-0000-000000000012": "Event Types",
"a3000000-0000-0000-0000-000000000013": "Top Servers (by volume)",
"a3000000-0000-0000-0000-000000000014": "RADIUS Accounting Status Breakdown"
}
},
"widgets": [
{
"id": "a3000000-0000-0000-0000-000000000011",
"type": "aggregation",
"filter": null,
"filters": [],
"timerange": {"type": "relative", "range": 604800},
"query": null,
"streams": ["__SERVERS_STREAM_ID__"],
"stream_categories": [],
"config": {
"row_pivots": [{"fields": ["timestamp"], "type": "time", "config": {"interval": {"type": "auto", "scaling": 1.0}}}],
"units": {},
"column_pivots": [{"fields": ["event_type"], "type": "values", "config": {"limit": 10}}],
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
"sort": [],
"visualization": "bar",
"visualization_config": {"barmode": "stack", "axis_type": "linear", "axis_config": null},
"formatting_settings": null,
"rollup": false,
"event_annotation": false,
"row_limit": null,
"column_limit": 10
},
"description": null,
"context": null
},
{
"id": "a3000000-0000-0000-0000-000000000012",
"type": "aggregation",
"filter": null,
"filters": [],
"timerange": {"type": "relative", "range": 604800},
"query": null,
"streams": ["__SERVERS_STREAM_ID__"],
"stream_categories": [],
"config": {
"row_pivots": [{"fields": ["event_type"], "type": "values", "config": {"limit": 15}}],
"units": {},
"column_pivots": [],
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
"visualization": "table",
"visualization_config": {"pinned_columns": [], "show_row_numbers": true},
"formatting_settings": null,
"rollup": true,
"event_annotation": false,
"row_limit": 15,
"column_limit": null
},
"description": null,
"context": null
},
{
"id": "a3000000-0000-0000-0000-000000000013",
"type": "aggregation",
"filter": null,
"filters": [],
"timerange": {"type": "relative", "range": 604800},
"query": null,
"streams": ["__SERVERS_STREAM_ID__"],
"stream_categories": [],
"config": {
"row_pivots": [{"fields": ["source"], "type": "values", "config": {"limit": 15}}],
"units": {},
"column_pivots": [],
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
"visualization": "table",
"visualization_config": {"pinned_columns": [], "show_row_numbers": true},
"formatting_settings": null,
"rollup": true,
"event_annotation": false,
"row_limit": 15,
"column_limit": null
},
"description": null,
"context": null
},
{
"id": "a3000000-0000-0000-0000-000000000014",
"type": "aggregation",
"filter": null,
"filters": [],
"timerange": {"type": "relative", "range": 604800},
"query": "event_type:radius_accounting",
"streams": ["__SERVERS_STREAM_ID__"],
"stream_categories": [],
"config": {
"row_pivots": [{"fields": ["acct_status_type"], "type": "values", "config": {"limit": 10}}],
"units": {},
"column_pivots": [],
"series": [{"config": {"name": "Message count", "thresholds": []}, "function": "count()"}],
"sort": [{"type": "series", "field": "count()", "direction": "Descending"}],
"visualization": "pie",
"visualization_config": null,
"formatting_settings": null,
"rollup": true,
"event_annotation": false,
"row_limit": 10,
"column_limit": null
},
"description": null,
"context": null
}
],
"widget_mapping": {
"a3000000-0000-0000-0000-000000000011": ["a3000000-0000-0000-0000-000000000011"],
"a3000000-0000-0000-0000-000000000012": ["a3000000-0000-0000-0000-000000000012"],
"a3000000-0000-0000-0000-000000000013": ["a3000000-0000-0000-0000-000000000013"],
"a3000000-0000-0000-0000-000000000014": ["a3000000-0000-0000-0000-000000000014"]
},
"positions": {
"a3000000-0000-0000-0000-000000000011": {"col": 1, "row": 1, "height": 4, "width": "Infinity"},
"a3000000-0000-0000-0000-000000000012": {"col": 1, "row": 5, "height": 4, "width": 6},
"a3000000-0000-0000-0000-000000000013": {"col": 7, "row": 5, "height": 4, "width": 6},
"a3000000-0000-0000-0000-000000000014": {"col": 1, "row": 9, "height": 4, "width": 6}
},
"formatting": {"highlighting": []},
"display_mode_settings": {"positions": {}}
}
}
},
"share_request": {"selected_grantee_capabilities": {}}
}