Skip to main content

Devices

The Devices module covers the gear that cannot run an agent: switches, routers, UPS and PDU units, printers, appliances. One of your agent hosts per site takes the collector role and polls them over SNMP; everything below rides that collector's normal outbound connection. Read-only, no new inbound surface. The agent-side mechanics live in SNMP and network.

From candidate to monitored​

Devices enter the page in two ways: a subnet scan (running on an approved range) lists responders as candidates, or you add one by address. Either way, nothing is polled until you approve it.

Approve asks for the essentials: a label, the device address, which collector polls it, and the credential. The dialog gives you a ready wakora secret set command to copy and run on the collector host, because SNMP credentials live only there and never travel. On approve, the console composes a device definition (sysDescr, interfaces, sensors, PoE, vendor extras by device type), signs it for your workspace, and pushes it to the collector. Within a poll cycle the device tile fills with live data. Test on a device asks the collector to poll it right now and shows the answer, which is how you check a credential before waiting for the next cycle; the test uses only secrets stored for devices, never a secret that belongs to a service on the collector host, so a typo in a secret name cannot send a database password to a switch.

Each approved device is one monitored unit on the devices quota, however many ports it has.

The grid and the device page​

The grid groups devices by collector and shows type, liveness and the meters that matter per type. A device page is type-aware: a UPS leads with charge, load and runtime; a switch leads with ports, traffic, errors, PoE budget and sensors. An Environment card collects what the device says about itself, temperatures, fan speeds, voltages and CPU load, with the units the device itself declares, so a vendor's tenths-of-a-volt raw value never renders as 540 degrees. Traps and syslog from the device land on the same page, and device syslog is searchable in Logs like everything else.

The Manage card is where the optional layers switch on per device: traffic flows, configuration backup, or switching the device off entirely.

Map​

The map view draws the site topology without you drawing it: neighbor tables (LLDP, and the MikroTik neighbor protocol where that is what the gear speaks) become links, and where a switch port pins a single known MAC, that becomes an edge too. Drag nodes to arrange the layout; positions stick. Links are colored by utilization (accent until 70 percent, warning to 90, danger above) with the worst direction winning, and each edge knows its port speed. Neighbors that are not monitored appear as ghost nodes, so the map shows the whole room, not just the paying part.

Addresses​

The addresses view is the address book the network already knows about itself: ARP tables from all devices, unioned. Every address shows who answers it - a monitored host (named), a device, a known candidate, or unknown - and, where a switch reports it, which port the MAC sits behind. VLANs render per device with names and per-port untagged membership. The search box takes a fragment of an IP, MAC or name: typing 78:9a finds the switch it belongs to.

Flows​

Flow-capable devices (NetFlow v5 and v9, IPFIX) can export traffic summaries to the collector: enable Flows in the device's Manage card and point the exporter at the port shown there. The exporter is allowed automatically once the device is approved; a stray exporter is dropped.

The collector aggregates on site: every minute it folds raw flows into top talkers and totals, and only those summaries leave your network. Public addresses gain a country at ingest. The device page's Flows card answers "who is eating the uplink" with top talkers, ports and protocols over the window you pick.

Flow volume is metered like log volume: a monthly average against the plan's included gigabytes, extra in 5 GB blocks. Flows are available on Pro and above. sFlow is not supported yet.

Configuration backup​

For devices reachable over SSH, Config backup in the Manage card keeps a version history of the running configuration. The console shows the exact command to store an SSH credential on the collector; recipes ship for RouterOS, Cisco IOS, Junos, FortiGate and EdgeOS (gear without SSH access honestly cannot be backed up).

The collector fetches daily (plus a Fetch now button), pins the device's SSH host key on first use, normalizes volatile lines like timestamps so cosmetic noise never counts as a change, and masks passwords and keys on the collector before anything leaves your site. A version is stored only when the content really changed, capped at the last 50 versions per device, each viewable and diffable against the previous one. A real change raises a warning incident, so an unexpected 3 AM edit on a switch is an alert, not archaeology.

Alerts​

Device rules live in the normal alerting catalog and arm themselves when matching telemetry flows:

  • UPS on battery: warning after a minute on battery, critical at three minutes (short self-tests and blips stay under the radar), plus a low-runtime warning when the estimate drops under ten minutes.
  • Sensor alert: any standard sensor (temperature, fan, PSU) reporting not-ok.
  • Port down: a port that used to carry a link and went dark while administratively up. The collector remembers which ports ever worked, so the twenty empty ports of a switch never alert, and an operator shutting a port down on purpose resets the memory instead of firing.
  • Device unreachable: the collector's polls failing, sampled on the collector, so a dead collector raises its own host-down instead of a storm of device alerts. It is critical: a switch that stops answering every poll of the window is down the way a host is down, and it rings like one. A poll that fails because the collector has no credential for the device is not counted here; that is the next rule's job.
  • Device credential missing on the collector: the collector was told to poll a device but has no secret under the expected name (a reinstalled or replaced collector, a secret stored under a typo). One warning per missing secret, naming it, so the fix is one wakora secret set and not a hunt; the device itself is not declared down for it.
  • Nobody polls the device: an approved device that no collector has polled for ten minutes, while the collector is alive. The usual causes are a collector whose workspace templates it refused (see the marketplace page on the pinned key) or a device assigned to collectors that are all offline; the incident is quiet when the collector itself is down, because then host-down already says it, and it goes away with the device when you remove one.
  • Devices keep logging errors: the rate of error-or-worse syslog lines the collector receives from your devices, held for ten minutes, arming itself once device syslog flows. Per-port error counters also come as a per-minute rate, ready for a custom rule on one noisy uplink.
  • Config changed: the backup layer's warning described above.