In Zwall, observability means Agents collect bounded metadata and events, the Manager stores and shows them, and operators investigate in the console. On hosting nodes, observation programs pass packets. Detectors produce investigation signals. This is visibility in the same control plane as policy — not a silent drop engine and not a full-packet capture product.
Zwall observability is infrastructure security visibility: service and authentication signals on Hosting Agents, bounded network metadata, detector events, Virtualization VM/interface inventory and traffic views, security logs, and operator dashboards.
It is not a SaaS APM and not a promise of lossless full-packet capture.
Three families, kept distinct:
Agents collect and upload. The Manager ingests security logs/events and Hosting observations into PostgreSQL-backed stores and shows them in the console. Live updates use a WebSocket path — not a public streaming SLA. Prometheus metrics exist (/metrics when enabled, auth-gated). Grafana dashboard JSON ships in-tree for operator-hosted Grafana, not a Zwall SaaS Grafana.
Console views for logs, Hosting status/events, Virtualization/VM/interfaces, health, and traffic widgets. Where Hosting status can say permission_blocked or source_not_present, the product already distinguishes missing sources from invented events. That honesty is part of the product: missing telemetry is visible. See Reliability.
Signals belong in the Hosting Agent story. Enforcement belongs on Virtualization Agents and explicit block paths.
You can observe a hosting node and enforce on a hypervisor in the same Manager without collapsing profiles.
| Profile | Visibility Focus |
|---|---|
| Hosting Agent | Service logs, authentication, network pass-only metadata, bounded detector events (investigation signals). |
| Virtualization Agent | VM/interface inventory, traffic views, enforcement telemetry, security logs. |
Security detection (brute-force, flood/scan, RBL, GeoIP) belongs in the Security capabilities.
AI Preview may analyze already ingested security logs when the operator triggers it. It does not subscribe to Hosting sources automatically. It does not drop packets.
Hosting observation programs pass. Enforcement is a different profile.
No. Bounded metadata and events.
No. JSON for operator-hosted Grafana.
Check Hosting status for permission or missing sources — Troubleshooting missing telemetry.
No.
Event delivery is not claimed as lossless.
Evaluate Zwall Community or talk to an engineer about Enterprise features.
