One operational model for streamed metrics, polled devices, active probes, flows, and events - built entirely from configured open-source components.
monNETtoring is a telemetry-first network monitoring platform: gNMI streaming is the primary data path, SNMP polling is the fallback, and active ICMP/HTTP probing covers path health. Every source is normalized to one canonical schema where source is just a label - a dashboard or alert never needs to know whether a number arrived by stream or by poll.
A parallel flows lane (NetFlow/sFlow → ClickHouse) adds per-flow drill-down beside the metrics, and an events lane (syslog + SNMP traps → the same ClickHouse) explains why a number moved. Both lanes share only the broker. Open source and config-over-code by design: no bespoke services, only configured components you can inspect, version, and replace.
Telemetry architectureOne canonical model
The transport can change without forcing dashboards, alerts, or downstream queries to change. Collection is source-specific; everything after normalization is not. Open source: inspect the configuration and contribute on GitHub
gnmic streams gNMI from capable routers and switches. telegraf polls SNMP where streaming is unavailable and also scrapes cloudprober for ICMP and HTTP path-health checks.
Vector maps every measurement to the same field and label contract. The source label records provenance, but queries depend on stable names such as device, interface, metric, site, and timestamp.
NetFlow, IPFIX, and sFlow retain per-conversation detail in ClickHouse. Syslog and SNMP traps land beside them, so operators can connect a metric change to traffic composition or a device event without forcing every workload into one store.
Collectors, normalization transforms, probe targets, alert rules, dashboards, and routing policies are reviewed and deployed as configuration. The platform is assembled from OSS services rather than hidden behind bespoke application code.
The greatest, user-friendliest design - and a perfect logo.
A Kafka-compatible broker decouples ingestion from processing. Vector enforces the canonical metrics contract before VictoriaMetrics, while ClickHouse independently consumes flows and events from the same broker.
gnmic streams gNMI, telegraf polls SNMP, and cloudprober produces active ICMP/HTTP measurements that telegraf scrapes.
Collectors publish through a Kafka-compatible broker. Vector maps metrics into canonical/v1 so Grafana and vmalert query stable labels, not transport-specific fields.
VictoriaMetrics serves time-series metrics; ClickHouse keeps high-cardinality flows and events. Grafana brings the lanes together at query time.
Without version control, dashboards drift, collector configuration gets inconsistent, and alert changes are harder to review or reproduce.
You cannot reliably rebuild the stack.
Alert changes can go live without review.
There is no clear record of who changed what or why.
Putting monitoring in Git buys review, rollback, diffability, and rebuild-from-nothing.
make up → make verify is the repository’s proof: configuration should be sufficient to recreate the stack and executable verification should prove the pipeline is alive.
schema/canonical.md instead of per-panel regular expressions.Each one maps to a concrete boundary
Nothing bespoke sits in the data path. gnmic, telegraf, cloudprober, Vector VRL, VictoriaMetrics, vmalert, and Alertmanager remain off-the-shelf components driven by committed configuration.
The single written service, services/api, renders configuration and serves the GUI; it never touches metrics. Every custom data-path service is something that pages you. Every configuration file is something you can diff.
Monitoring-as-code breaks when operators hand-edit derived files or a UI writes state that nothing reliably re-renders.
config/Static component configuration, mounted read-only and ready for future ConfigMaps.inventory/Devices, credentials, groups, and discovery seeds. Machine-writable, Git-tracked intent.state/Rendered collector targets. Gitignored, never hand-edited, and always regenerable.Normalization happens at ingest so source=gnmi and source=snmp label identical metric names. Dashboards and alert rules stay transport-agnostic instead of forking into unmaintainable duplicates.
schema/canonical.md→Vector VRL→canonical metricsDashboards and rules are committed and provisioned - never click-built. Raw Grafana JSON is adequate at the current scale; Grafonnet or grizzly remain the escape hatch if diff quality becomes the limiting factor.
config/grafana/dashboards/config/vmalert/rules/scripts/verify.sh asserts that every source is present, rules are loaded, and authentication completes a round trip after each change. Version control without an executable health check merely versions the breakage.
The stack also monitors itself through an out-of-band self-scrape, mon: rules, and the Pipeline Health dashboard. A dead collector must never look like a quiet network.
make up→make verify→Pipeline HealthDiscovery and GUI onboarding mutate the source of truth. The renderer regenerates derived targets and collectors re-read them through gnmic’s 30-second file loader and telegraf’s --watch-config.
No one-off change is pushed into a running collector. Imperative edits evaporate after restart and leave no Git history.
GUI / discovery→inventory/→renderer→state/→collectorsmonNETtoring is open source. The implementation, configuration, schemas, and supporting repositories are maintained openly under the monNETtoring GitHub account.
Use either developer email, visit the GitHub account, or send one simple question from the form. The Gmail inbox is the default recipient for form messages.