Glossary
A dashboard full of acronyms is a dashboard that only helps the person who built it. Each term below says what the thing is and, more usefully, why it matters when something is going wrong. The same definitions appear as tooltips beside the readings themselves.
A virtual filesystem the Linux kernel exposes as ordinary files. Reading /proc/loadavg is a file read rather than a command, which is how this site reports host vitals without ever invoking a shell.
Acknowledged, or not acknowledged. An ACK confirms the frame arrived with its integrity check intact. A NACK reports a failed check and triggers retransmission – the failure is expected and handled, rather than being an error.
Rows are only ever added, never edited or deleted. An incident record that can be tidied up afterwards is not evidence of anything; this one is written by the code at the moment each condition is observed.
Identifies the network that owns an address block – an ISP, a hosting provider, a university. Often more informative than the address itself: traffic from a bulk hosting provider and traffic from a residential ISP mean quite different things.
The system detecting a fault and correcting it without a human in the path. The measure of it working is that nobody was woken up – which is also why it needs to log thoroughly, or nobody learns the fault ever happened.
Related activity from one source network grouped over time, rather than counted as separate requests. A single probe says nothing; what an actor went looking for, how long they persisted and whether they returned is the part with analytical value.
The difference between this node's clock and the browser's, corrected for half the round trip. Clock drift quietly corrupts any log that has to be correlated across machines, and it does so without producing a single error.
A checksum computed across a payload and transmitted alongside it. Recompute it on receipt and compare: if the values differ, the data changed in transit. Cheap to calculate and reliable against accidental corruption, which is why it appears in everything from Ethernet frames to tactical radio protocols.
A configured value rather than a reading. The application cannot determine which datacentre it occupies without asking an external service where its own address is, so this is labelled rather than quietly presented alongside figures that were genuinely measured.
Watches log files for patterns that indicate abuse and blocks the source at the firewall for a set period. The block happens at the packet level, so a banned host never reaches the application at all.
Detections are held briefly before appearing publicly. The evidence is identical a moment later, but an attacker no longer gets a live readout of which requests trip a filter or how close they are to being blocked. The exact delay is deliberately not published – printing it would give back what the delay is there to withhold.
Resolving an address to a country and network. Done here against a database file held on this machine, so the address never leaves the process – sending visitor addresses to a third-party lookup service would defeat the point of masking them.
A periodic signal a worker emits to show it is still alive. The absence is the signal: a stale heartbeat means the worker is wedged, which is precisely the failure mode that produces no error message at all.
Time since the kernel booted, distinct from how long the application has been running. Together the two tell you whether a service restarted or the whole machine did – a different problem with a different cause.
An address is an indicator and costs an opponent almost nothing to change – addresses are rented by the hour. How they enumerate, in what order, at what rate, is behaviour, and changing it costs real effort. Detection built on behaviour survives; detection built on indicators is defeated the moment the opponent notices.
Querystrings carrying SQL or script fragments – attempts to have input interpreted as code. The querystring is inspected but never stored or rendered back: a payload is evidence of intent, not something to repeat on a page.
A fail2ban ruleset: which log to watch, which pattern counts as a failure, how many failures earn a ban, and how long the ban lasts.
The variation between consecutive round trips. A link can be slow but perfectly steady and still carry real-time traffic fine – it is the variance that breaks things, so it is measured separately rather than hidden inside an average.
The running kernel version, read from /proc/version. In a container this is the host's kernel, not the image's – containers share the kernel and only bring their own userspace.
The average number of processes running or waiting on I/O, over 1, 5 and 15 minutes. It is not a percentage – the figure only means something against the core count, which is why load per core sits beside it. Comparing the three windows tells you whether a spike is building or clearing.
Load average divided by the number of CPU cores. Sustained above 100% means work is queuing rather than running, and the machine is behind.
The final octet is zeroed before anything is stored or displayed. Enough to tell two sources apart and attribute a network, without retaining data that identifies a person. The full address exists only in memory, for the moment it takes to look up its country.
An exponentially weighted moving average – recent samples count for more than older ones. It reacts quickly to a genuine shift without needing a full history buffer, and without one old outlier skewing the figure indefinitely.
Derived from MemAvailable – the kernel's own estimate of memory obtainable for new work, including cache it can reclaim. More honest than 'free', which counts cache as used and makes a perfectly healthy machine look full.
A path probed today that had never been seen before. Individually meaningless; as a share of daily traffic it tracks the opposition changing – a new scanning tool or wordlist circulating – rather than anything changing on this host.
Automated probing for paths belonging to common software – /wp-admin, /.env, /phpmyadmin. Nothing here serves any of them, which makes such a request unambiguous: it is not a mistake, it is a sweep looking for something to exploit.
How much work is waiting to be processed. A queue climbing steadily means the consumer has fallen behind the producer, and it is usually the earliest visible symptom of trouble – before anything has actually failed or thrown an error.
HTTP 429, the server refusing a request because the client has exceeded its allowance. Bounds what a single source can cost you, whether the excess is malicious or a bug in someone's client.
A run of 401 or 403 responses from one source – the shape of someone trying credentials rather than someone mistyping a password once.
Whether a source came back once its block expired. Indiscriminate scanning sweeps address ranges and never revisits, so a return is a choice. It is the cleanest available separation between internet background noise and something deliberate.
Failures across the most recent packets, not across all time. A lifetime rate looks fine and is quietly useless: the denominator grows the longer the system stays healthy, until a real fault cannot move it past any sensible threshold – the detector gets worse at its job exactly as the system gets more stable. A fixed window keeps the denominator constant.
How long a message takes to reach the far end and come back, timed at this end. It includes network transit, plus whatever the other end took to respond.
A rejected login attempt on port 22 – the highest-volume background noise on any public host. The username attempted is the useful part: wordlists differ between tools, so the accounts a source reaches for identify the tooling better than its address does. Successful logins are deliberately not recorded, because publishing when and from where a host is administered is intelligence about the operator.
A service managed by systemd, the init system on most modern Linux distributions. ActiveState says whether it is running; SubState says what it is actually doing, which is the more useful of the two when something is wrong.
Connections currently in the ESTABLISHED state, parsed from /proc/net/tcp. Only the count is taken: remote addresses are never read into anything the page can display.