Monitoring and API
Operational data goes to your own stack: a Portal API served by the daemon, a Prometheus exporter, and a gNMI northbound. Netvyn does not ask to be your system of record. Operator accounts, the audit trail and delegated login also live here.
Portal API
Served by the daemon for a billing portal or NOC dashboard to poll system, interface and subscriber state. It applies immediately and is not staged behind commit, including the listen rebind. Clients authenticate with an operator account and are additionally restricted by an allowed-source ACL — an empty ACL means any source, so add prefixes before exposing the port.
api enable | disable # live api listen <host:port> # live rebind api allow <cidr> # add a source prefix api no allow <cidr> # remove one api enable api listen 0.0.0.0:8090 api allow 198.51.100.0/24 show api
System and platform state
One command per question. Both show version and show health print uptime as raw seconds plus a human-readable form — uptime 3661 (1hr 1min 1sec) — so it stays script-parseable while an operator reads it at a glance.
show version # build + DPDK version + uptime show topology # lcore / worker / port plan show system # control-cores, workers, ht-policy show health # uptime, per-core CPU, memory, power show power # adaptive polling detail show sessions # PPPoE + IPoE in one table show drops [<interface>] # fast-path forward + drop counters show statistics [<interface>]# alias for show drops dispatch # software PPPoE RSS state
Optical diagnostics
show interface returns the whole health picture for a port, including transceiver identity and live DDM — temperature, voltage, TX bias and TX/RX optical power in dBm — with alarm flags and the full threshold table. EEPROM identity is cached per port because the NIC reads it over slow I2C; only the small live-DDM block is read per call. A weak or dirty fibre shows immediately as a low RX-power reading and an rxpwr-low alarm, without leaving the CLI.
Operator accounts
Operator accounts for the CLI, GUI and API are separate from subscribers. Three roles are assignable: read is view-only (show, ping, traceroute, whoami, and changing your own password); write adds configuration edits and subscriber actions; and full is the top role — the effective superadmin — required additionally for system CPU and topology configuration, for operator-account management itself, and for licence and maintenance actions. Bare system and show system stay read. An account still on its initial password is in a forced first-login state: until it runs change password only that command, whoami, help and logout are accepted. These are operational commands — they apply immediately and are not staged behind commit. The account-changing actions are recorded in the auth log alongside login and logout events, not the configuration audit trail.
whoami # your username + role change password <new> # alias: passwd <new> add user <name> <role> <password> [<description>] delete user <name> disconnect user-session <id> # id from show user-sessions show users show user-sessions show audit log [<n>] show auth log [<n>]
Delegated operator login
Operators not in the local store can be authenticated against a RADIUS realm instead, with the realm's server and secret in aaa.conf. On acceptance the server must return a Netvyn-Admin-Role VSA naming the role — an Access-Accept with no recognised role is denied, so a misconfigured realm can never silently grant access. Local accounts are always tried first, which means enabling this cannot lock you out of an existing local login.
aaa enable | disable # default disable
show aaa