OAM Monitoring Coverage Matrix
Canonical source: This wiki topic is the living reference for monitoring tool
domains across the PFVCluster fleet. Updated in place; edit history preserves
all prior states.
Purpose: Ensure every monitoring concern is covered with no overlap
between tools. Each tool owns its domain. This matrix validates the OAM stack
is complete with no gaps.
Related: #343,
#314 (OAM umbrella)
Tool Domain Ownership
| Tool | Domain | What It Monitors | Alert Delivery | Status | Ticket |
|---|---|---|---|---|---|
| Uptime Kuma | External availability | HTTP/HTTPS, DNS, TCP, ping for all PFV/SITER/Cloudron services | Pushover | Operational (partial monitors) | #435 |
| Beszel | Host metrics | CPU, RAM, disk, network, processes on all Linux hosts | Pushover (#428 pending) | Agent on some hosts | #406 |
| LibreNMS | Network (SNMP) | Switches, routers, PDUs — ports, traffic, uptime, interface errors | Pushover | Operational | #337 |
| Dell OME | Dell hardware | iDRAC, physical server health, drives, fans, power | TBD (Dell alerting) | Not deployed (user manual) | #339 |
| Smokeping | Latency | Network path quality (FPing) to 16 targets: switches, hosts, APs | LibreNMS-integrated | Operational | #375 |
| NetDisco | L2 topology | Switch port mapping, MAC discovery, LLDP neighbors, device location | Passive (no alerts) | Operational | #337 |
| Oxidized | Config backup | Network device configuration versioning, auto-push to Gitea | Passive (git diff) | Operational (4/5 switches) | #337 |
| phpIPAM | IP inventory | IP address management, DHCP reservations, subnet utilization | Passive (reference) | 90% configured | #425 |
| UNPoller → Grafana | UniFi wireless | UniFi APs, clients, traffic, WiFi metrics via Prometheus | Grafana alerts (pending) | Operational | #430 |
| NUT | UPS monitoring | APC + Tripp Lite UPS: battery, line voltage, runtime, load | Pushover (#439 pending) | APC operational, Tripp Lite pending (#372) | #340, #439 |
| Home Assistant | Environmental | Z-Wave/Zigbee sensors: temp, humidity, door, AC, lights | HA notifications | Partial | #344 |
| TEMPer USB | Temperature probes | Physical room temperature (Server Room, Art Room, EE Lab) | LibreNMS/HA (pending) | Exploration done, deploy Friday | #341 |
| Wazuh | Security/SIEM | Security events, syslog analysis, compliance, file integrity | Pushover (when rebuilt) | BROKEN — full rebuild needed | #438 |
Concern Coverage Matrix
Each row is a monitoring concern from #314.
Each cell shows which tool(s) cover it. No cell should have more than one
primary owner (secondary/backup coverage is marked with ~).
| Concern | Primary Owner | Backup | Gap? |
|---|---|---|---|
| NTP synchronization | system systemd-timesyncd | LibreNMS (monitoring drift) | None (#334 closed) |
| Host metrics (CPU/RAM/disk) | Beszel | LibreNMS (SNMP partial) | Beszel agent not fleet-wide |
| Network device monitoring | LibreNMS (SNMP) | — | None |
| External availability (HTTP/ping) | Uptime Kuma | — | Need comprehensive monitors (#435) |
| Latency/path quality | Smokeping | — | None |
| L2 topology | NetDisco | LibreNMS (partial) | None |
| Network config backup | Oxidized | — | Cisco pending (#431/#436) |
| IP address inventory | phpIPAM | — | Scan agent pending (#425) |
| UniFi/wireless metrics | UNPoller → Grafana | — | None |
| UPS/power monitoring | NUT | HA (NUT integration pending #439) | Tripp Lite pending (#372) |
| Dell hardware health | Dell OME | — | GAP: not deployed (#339) |
| Temperature (environmental) | TEMPer → LibreNMS/HA | — | GAP: not deployed (#341, Friday) |
| Security events/SIEM | Wazuh | — | GAP: broken, rebuild needed (#438) |
| Syslog forwarding | Wazuh | — | BLOCKED on #438 |
| Alert delivery | Pushover | — | LibreNMS+Uptime Kuma done; Beszel pending (#428) |
| Mail relay (system email) | Proxmox Mail Gateway | — | GAP: not deployed (#336) |
| Cloudron app health | Uptime Kuma | Cloudron built-in | Need monitors (#435) |
| Kubernetes health | — | — | GAP: no k8s monitoring (cluster rebuilding #367) |
| Interface errors/events | LibreNMS | — | None |
| System log patterns | Wazuh | — | BLOCKED on #438 |
Architecture Rules (from Discourse #303)
- All inter-app connectivity flows via public DNS (zero trust)
- OIDC + 2FA mandatory for interactive login
- API keys (preferred) or tightly-scoped local accounts for service auth
- snmpd is NOT fleet-wide — only for network devices (switches, routers,
PDUs). Beszel covers Linux host metrics. Exception: TEMPer sensor hosts may
get snmpd with extend for temperature data.
Alert Delivery Standard
Pushover is the standard alert delivery channel for ALL OAM tools
(user directive, 2026-08-11).
| Tool | Pushover Status | Ticket |
|---|---|---|
| Uptime Kuma | DONE | — |
| LibreNMS | DONE | #338 |
| Beszel | PENDING | #428 |
| Grafana | PENDING (configure alert rules) | #430 |
| UPS/NUT | PENDING | #439 |
| Wazuh | BLOCKED (rebuild first) | #438 |
Deployment Locations
All OAM tools run as Docker containers on tsys-librenms (VM 104 on
pfv-tsys1) unless noted otherwise.
| Tool | Host | Port(s) |
|---|---|---|
| LibreNMS | tsys-librenms | 80 |
| Smokeping | tsys-librenms | 8081 |
| NetDisco | tsys-librenms | 8082 |
| Oxidized | tsys-librenms | 8083 |
| UNPoller | tsys-librenms | 8084 (→ Prometheus on Cloudron) |
| Weathermap | tsys-librenms | (LibreNMS plugin) |
| Prometheus | Cloudron | (hosted) |
| Grafana | Cloudron | (hosted) |
| Uptime Kuma | Cloudron | (hosted) |
| Beszel | pfv-bms + fleet | (hub + agents) |
| phpIPAM | Cloudron | ipam.knownelement.com |
| Home Assistant | pfv-bms (HAOS VM 100) | 8123 |
| Wazuh | tsys-siem (VM 707 on tsys7) | BROKEN |
SNMP Community
All Dell PowerConnect switches + network devices: kn3lmgmt (v2c).
snmpd is NOT deployed on Linux hosts (Beszel covers host metrics).