Skip to content

Administration Guide

Routine operations for a running flowwler deployment. For initial setup see the Getting Started guide; for diagnosing problems see the Troubleshooting guide.

Hot-reload

Apply configuration changes without restarting the process:

flowwler validate /etc/flowwler/config.yaml   # verify before applying
sudo systemctl reload flowwler                # sends SIGHUP
sudo journalctl -u flowwler -f                # confirm

What happens on reload:

  1. Config is re-parsed and validated - invalid config is rejected, the process keeps running with the old config
  2. IRR and NetBox prefix resolution re-runs; group subnets are updated
  3. BGP peers are reconciled live (adds, removes, and updates without dropping active mitigations)
  4. The LPM group radix tree is rebuilt atomically
  5. All active mitigations for groups removed from config are withdrawn immediately - BGP paths are withdrawn, all per-victim and group-level metrics are deleted, and a cleared notification is fired for each active victim
  6. The notification manager is rebuilt and swapped atomically
  7. Log level is updated live

Log output on successful reload:

{"level":"info","msg":"SIGHUP received, reloading config"}
{"level":"info","msg":"config reloaded successfully","log_level":"info"}

BGP restart required - changes to gobgp.local_asn, gobgp.router_id, or gobgp.grpc_addr cannot be applied via reload. flowwler will exit with code 1 and systemd will restart it automatically.

Background prefix refresh

IRR and NetBox prefix data is refreshed automatically every 12 hours without requiring a SIGHUP. Only the group subnet radix tree is updated - escalation state, active mitigations, and BGP sessions are unaffected.

Monitor freshness via Prometheus:

# Seconds since last successful IRR refresh per group
curl -s http://localhost:9731/metrics | grep flowwler_irr_last_refresh_timestamp_seconds

# Seconds since last successful NetBox refresh per group
curl -s http://localhost:9731/metrics | grep flowwler_netbox_last_refresh_timestamp_seconds

To force an immediate refresh without waiting for the timer, send a SIGHUP:

sudo systemctl reload flowwler

REST API authentication

Optional. When not configured the API is open. The /metrics endpoint is never gated.

# Generate a bcrypt password hash for HTTP Basic Auth
flowwler hash-password
Password: ········
$2a$10$...

Paste the hash into the config and reload:

http:
  auth:
    username: "admin"
    password_hash: "$2a$10$..."   # bcrypt hash from flowwler hash-password
    # api_key: "..."              # alternatively or additionally: static bearer token

flowwler validate /etc/flowwler/config.yaml
sudo systemctl reload flowwler

See REST API - Authentication for the full reference.

Upgrade

sudo apt update
sudo apt upgrade flowwler

The existing /etc/flowwler/config.yaml is never overwritten during an upgrade. The package upgrade restarts the service automatically.

Removal

sudo apt remove flowwler

Stops the service and removes the binary, systemd unit, all associated directories, and the system user.

The ufw firewall rules added during installation are not removed automatically and must be deleted manually:

sudo ufw delete allow 2055/udp   # NetFlow / IPFIX
sudo ufw delete allow 6343/udp   # sFlow
sudo ufw delete allow 179/tcp    # BGP