Description
‘ROUTING: killing states for unreachable gateway’ is already parsed as the log event gateway_states_killed, but it arrives under the opnsense catch-all program, which is in nonDerivedPrograms, so nothing counts it. Derive a counter keyed strictly on that event, never on other lines from the catch-all program, labelled by gateway. It shows when pf flushed states on a gateway-down edge, which is a direct cause of mid-stream resets for every LAN client. It pairs with gateways_monitor_killstates and the dpinger alarm counters.
Acceptance Criteria
- #1 Counter increments once per kill event per gateway, from a captured line fixture
- #2 No other catch-all program line is counted
- #3 Metrics reference regenerated
Definition of Done
- #1 just check
- #2 just gen (if any generated artifact changed) and the diff committed
Implementation Plan
Inspect source contracts and live evidence where required; implement bounded telemetry with fixtures, regenerate shared artifacts, review and run just check before landing.
Implementation Notes
Implemented bounded gateway state-kill event counter only for syslog.event=gateway_states_killed with a gateway name. Captured receiver fixture proves one flush observation and no increment for unrelated catch-all routing messages; added state-kill rate panel.
Final Summary
Shipped bounded per-gateway flush-event counter and dashboard panel. Captured receiver fixture counts the kill event and excludes unrelated catch-all lines. Generated metrics reference updated. just gen and just check passed; review complete.