Manager Visibility
Purpose
List the Manager console and API surfaces operators use to see fleet health, eBPF attach, traffic widgets, and Hosting evidence — without treating the WebSocket as a public stream product.
Audience
Administrators operating the SPA at /login and zwallctl.
Edition
SHARED dashboard groups. GET /api/v1/dashboard/ebpf-health is Enterprise in the v1 router. Hosting pages are Enterprise. Some traffic history endpoints are license-gated as advanced reporting.
Status
SUPPORTED as implemented widgets. Field-level schemas are not a second public OpenAPI contract.
Prerequisites
Ready Manager (GET /health/ready), admin session, Agents heartbeating.
Required permissions
Admin for the routes below. Viewer is insufficient for most operator APIs.
Dependencies
PostgreSQL; Agent heartbeats (agents.timeout example 2m marks offline); optional Hosting or Virtualization Agents for those widgets; web.enabled: true for the SPA.
Configuration
CORS server.cors.allowed_origins must include the browser origin. Metrics widgets on the dashboard are distinct from the Prometheus scrape at /metrics.
Procedure
Console after login at /login. Corresponding admin APIs:
Scroll sideways to see the full table. Use the arrow keys when focused.
| Surface | Path |
|---|---|
| Dashboard stats | GET /api/v1/dashboard/stats |
| Dashboard agents | GET /api/v1/dashboard/agents |
| eBPF health | GET /api/v1/dashboard/ebpf-health (Enterprise) |
| Logs widget | GET /api/v1/dashboard/logs |
| System widget | GET /api/v1/dashboard/system |
| Dashboard metrics | GET /api/v1/dashboard/metrics |
| Traffic | GET /api/v1/dashboard/traffic and /api/v1/traffic/* (some history license-gated) |
| Security events widget | GET /api/v1/dashboard/security-events |
| Live console updates | GET /api/v1/dashboard/ws |
| Sanity | GET /api/v1/system/sanity-check |
| Hosting | GET /api/v1/agents/:id/hosting/status and /hosting/events |
| Virtualization | GET /api/v1/virtualization/vms and /interfaces |
| Fleet | GET /api/v1/agents |
CLI: zwallctl list-agents, list-events, log, stats, check, ping, status --agent ID.
zwallctl log --follow prints not implemented. zwallctl stats reads local eBPF maps (stats_map) on a Virtualization host with pin dir /sys/fs/bpf/fw — it is not a Manager dashboard substitute.
Verification
Dashboard loads; zwallctl check / sanity-check returns without auth errors; Hosting and virtualization pages match installed profiles.
Expected result
An operations console view of Agents, attach health, and recent events. Not a SIEM and not a public streaming API.
Failure modes
Scroll sideways to see the full table. Use the arrow keys when focused.
| Symptom | Action |
|---|---|
| Empty eBPF health | Enterprise-only route or no Virtualization Agent |
| Empty Hosting UI | no Hosting heartbeat; see source states |
| WS fails | session cookie / HTTPS; cookie issuance requires acceptable HTTPS |
| Traffic history 403 | license gate — not a broken Agent |
| CLI default :8080 | set --manager-url |
Troubleshooting
Diagnostics, Console. Confirm /health/ready before debugging widgets.
Security considerations
WebSocket is admin-equivalent. Do not expose the Manager UI without TLS. Treat /metrics scrape tokens as admin (see Prometheus and Grafana).
Limitations
Not Splunk. Cluster Grafana dashboard is not a public HA product. OpenAPI is not a generated customer contract.