Observability

Reporting Channels

An anchor keeps metrics, writes a log, and publishes an event whenever its state changes. You can read this information in three ways, each with its own access control:

Local Reporting

On a conflux machine, run anchor commands through sudo conflux.

sudo conflux status with no arguments prints conflux's own rows, followed by the anchor status. With arguments, the command goes straight to the anchor. For example, sudo conflux status -watch 15s repeats the anchor status every 15 seconds.

10:12:22  reachability=unknown  mtu=65498  peers=1  up=4m12s
  anchor      anchorxru3k54nd3…
  underlay    192.0.2.7:44700
  overlay     fd5f:23c6:acf0:883b:d9c6:6497:fe97:46af/48
  hardware    92:c6:9a:e1:36:f6
  realm       ycglqeazla/gyr7uu7ehx
  cut depth 0 joined to the whole tree
  renew by    2026-10-03T22:05:58Z
  works until 2026-10-03T22:05:58Z

• The first line shows the anchor's NAT type, its overlay MTU, how many peers it is connected to, and how long it has run.
• The next lines show its identity and addresses, its realm, and where the tree is cut above it, if anywhere.
• The last two lines show when its credential must be renewed and when it stops working.

status describes this anchor only. For each peer, use peers.

Metrics

To print the anchor's metrics, run sudo conflux metrics:

$ sudo conflux metrics
anchor_connections            2
anchor_handshakes_total       2
anchor_peers_known            3
anchor_relay_circuits         0
anchor_rtt_seconds            n=8 mean=0.00029 min=0.00022 max=0.00044

• Gauges refresh every five seconds, so a value read just after an event may not show it yet.
• Round-trip times print as a summary, n= mean= min= max=.
• The anchor keeps at most 4096 series. When it is full, it drops new series and counts them in anchor_metric_records_dropped_total. Metrics reset when the anchor restarts.

Events

sudo conflux events streams events until you stop it. The stream drops events for a slow reader rather than slow the anchor down, and it reports each gap: ... 14 events were dropped; this watcher is behind.

Logs

The anchor never logs key material, credentials or payload. The anchor daemon logs at info level, or at debug level with -v.

To debug the transport itself, write QUIC traces with -qlog DIR, one file per connection. The traces contain addresses and connection IDs in full, so do not use them in production.

Telemetry Orders

A telemetry order asks another anchor for its status. Only a member of the same realm whose credential carries telemetry can send one. You do not need to configure anything on the anchor that is asked.

The anchor answers about itself only: its uptime, peers known, connections, NAT type, MTU, the networks it routes and its own counters. It never reports its peers, its events, its traffic or the names of its compartments.

$ sudo conflux telemetry -from anchorqb64scm5ts…
qb64scm5ts  up 4m12s  peers 3  connections 2  reach nat-cone  mtu 65498
route       192.168.10.0/24 via -  served
route       192.168.20.0/24 via 7p24gzsf7j  accepted
anchor_connections            2
anchor_peers_known            3
anchor_routes_served          1
anchor_rtt_seconds             n=8 mean=0.00029 min=0.00022 max=0.00044

• Each order is a single request. Nothing is polled or pushed, so a member that stops asking costs the realm nothing.
• The order and its answer are encrypted end to end. A relay can carry them without reading them, and no new connection is opened.
• -timeout sets how long the order is valid: 30 seconds by default, and at most ten minutes.
• Orders stay inside one realm. A realm above can carry a member's traffic, but cannot ask the member for its status.
• Taints do not apply to telemetry orders, so a member in another compartment still answers.

anchor_orders_carried_out_total and anchor_orders_refused_total count the orders an anchor received, by kind and by reason.

Exporting to a Collector

The anchor daemon can export metrics, traces, logs and flow records to an OpenTelemetry collector over OTLP. Nothing is exported until you set an endpoint. You can start and stop the export while anchors run.

sudo conflux export -off sends what is queued, then stops the export. The export runs in the daemon, so restarting an anchor does not interrupt it.

• A collector that goes down does not slow down traffic.
• Treat any header the export sends as a credential, and store it as one. The daemon warns when a configuration file that holds one is readable by group or world.
• On a host that must never export, start the daemon with -allow-observability=false. Export is then not available at all.

Flow Records

A flow record describes one flow: one protocol, two addresses and two ports, in both directions, between this anchor and one peer. A record covers an interval of the flow, and ends for one of four reasons:

Each record names both ends of the flow, the transport, the peer, the relays the traffic took, and the packets and bytes in each direction. A host behind a subnet router appears with its IPv4 address.

A relay cannot read what it carries, so it records a relayed circuit only by its neighbouring hops and its volume.

All the records of one flow share an anchor.flow.id, so a long flow appears as a series of active records ending in idle. anchor_flows counts the flows in the table, anchor_flows_evicted_total the flows replaced, and anchor_flow_records_lost_total the records that could not be reported.

What Is Never Sent

An anchor's reporting follows these rules:

• No log contains key material, credentials or payload.
• A telemetry answer contains no peers and no traffic, and is sent only when asked for.
• No telemetry order crosses a realm boundary, including to a realm above.
• Relays cannot read orders, answers or traffic, because all of them are encrypted end to end.
• No flows are counted while flow export is off.
• No metric has a per-peer label, except three drop reasons of anchor_frames_dropped_total.
• Nothing is exported until you configure an endpoint.

Metrics to Alert On

The metrics for connections, routing and subnet routers are on their own pages: Discovery and NAT Traversal, Routing and Addresses and Subnet Routers and Exits.