pipistrelloandClaude Opus 4.8
f438f3845c
Two changes driven by the fleet syslog rollout (~4 -> 106 senders) and the
operator enabling Yealink's prepend-MAC on the autoprovisioned handsets.
1. Alloy: lift the MAC into a real `mac` label.
UDP syslog offers only three possible identities: sender IP, RFC3164
HOSTNAME, message body.
- source_ip is DHCP (observed lease 1200s) so it is NOT stable: a re-IP
looks like a new device, and a recycled IP silently inherits another
phone's history.
- HOSTNAME is useless: Yealink puts its subsystem there (sua/GUI/cfg/sys),
and after prepend-MAC the bracketed MAC lands in that slot and is rejected
as a hostname, so the label is simply absent on new lines.
So the body is the only place identity exists. A loki.process regex stage
extracts it. Non-Yealink senders (the D-Link switches) don't match and pass
through with no mac label. Cardinality is safe: mac is 1:1 with a device and
does not multiply against source_ip.
Verified on a disposable alloy+loki rig by replaying 406 REAL captured lines:
0 parse errors, both branches confirmed — Yealink lines get
mac=80:5e:0c:b2:44:d3, the switch line passes through with no mac label.
2. Dashboard: identity by MAC, comparative panels, no invented thresholds.
- Variable is now label_values(mac) with allValue ".+" (not ".*") so "All"
matches only streams that HAVE a mac — excluding switches automatically.
- Removed the absolute colour thresholds. They were derived from a ~4-hour
sample of TWO atypically verbose handsets and were already wrong at 2
phones (actionable errors read 537 against a red line of 800; scheduler
timeouts 193 against yellow at 150). They were fleet-wide SUMS, so they
scale with phone count rather than with health. The fleet onboarded today,
so no representative 24h baseline exists to replace them with — panels are
comparative (worst offenders) until a week of real data exists. The one
surviving threshold is "phones failing provisioning" >= 1, which is a
qualitative fault rather than a magnitude.
- Stats now count AFFECTED DEVICES, not fleet-wide line totals.
- "Phones reporting" -> "Phones heard from", documented as NOT a health
count: most of the fleet runs at Yealink default log level 3 (Error) and
is silent unless something breaks. A silent phone is a healthy phone.
- Registration/DHCP panels labelled level-6-only: they key on info/notice
lines that level-3 phones never send, so an absent phone there means
"quiet", not "unregistered".
- Added "loudest phones by log volume" to surface handsets left at level 6
(two of them are ~80% of all volume).
- refresh 1m -> 5m.
Verified by firing all 14 panel queries CONCURRENTLY against a sink loaded
with replayed real data: 14/14 return data, 0 rejected. Last time these were
verified sequentially, which is what let the 429 bug ship.
Note: data predating the MAC rollout has no mac label and won't appear.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
442 lines
19 KiB
JSON
442 lines
19 KiB
JSON
{
|
|
"annotations": {
|
|
"list": [
|
|
{
|
|
"builtIn": 1,
|
|
"datasource": { "type": "grafana", "uid": "-- Grafana --" },
|
|
"enable": true,
|
|
"hide": true,
|
|
"iconColor": "rgba(0, 211, 255, 1)",
|
|
"name": "Annotations & Alerts",
|
|
"type": "dashboard"
|
|
}
|
|
]
|
|
},
|
|
"editable": true,
|
|
"fiscalYearStartMonth": 0,
|
|
"graphTooltip": 1,
|
|
"links": [],
|
|
"liveNow": false,
|
|
"panels": [
|
|
{
|
|
"type": "text",
|
|
"title": "How to read this dashboard",
|
|
"gridPos": { "h": 5, "w": 24, "x": 0, "y": 0 },
|
|
"id": 100,
|
|
"options": {
|
|
"mode": "markdown",
|
|
"content": "**Identity is the phone's MAC**, lifted out of the message body into a `mac` label by Alloy (Yealink `static.syslog.prepend_mac_address.enable`). Do **not** use `source_ip` as identity — phones are on DHCP with a 1200 s lease, so a re-IP looks like a new device and a recycled IP would inherit another phone's history. Only devices sending a MAC appear here, so switches sharing this Loki are excluded automatically. *Data from before the MAC rollout has no `mac` label and will not show.*\n\n**A silent phone is a healthy phone, not a missing one.** Most of the fleet runs at Yealink's default log level **3 (Error)** and only speaks when something is wrong. A couple of handsets are at level **6 (Informational)** and produce ~80% of all volume. These panels count *phones heard from*, never *phones alive* — and the registration/DHCP panels at the bottom can only ever populate for level-6 phones.\n\n**Two known noise sources are filtered out:** `severity=emergency` is Yealink printing its own log-level table at boot (`E=3,W=4,N=5,I=6,D=7`), not an incident; and `LSYS<3+error> rtpcap get len not enough` was 56% of all error lines in baseline. Neither means anything.\n\n**No colour thresholds on the counts — deliberately.** The fleet onboarded 2026-07-15, so there is no representative 24 h baseline to derive them from, and fleet-wide sums scale with phone count rather than with health. The panels are *comparative* (worst offenders) instead. Revisit once a full week of fleet data exists."
|
|
}
|
|
},
|
|
|
|
{
|
|
"type": "stat",
|
|
"title": "Phones heard from",
|
|
"description": "Distinct MACs that sent at least one line in range. NOT a health count — level-3 phones stay silent unless something breaks, so this is expected to sit well below the fleet size.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 0, "y": 5 },
|
|
"id": 1,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range])))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "none",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] }
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Log lines",
|
|
"description": "Total lines from MAC-identified phones in range.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 4, "y": 5 },
|
|
"id": 2,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "sum(count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range]))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "none",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] }
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Phones with errors",
|
|
"description": "How many distinct handsets logged at least one actionable error (rtpcap noise floor excluded). A count of affected devices — unlike a fleet-wide error total, this does not inflate as phones are added.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 8, "y": 5 },
|
|
"id": 3,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" [$__range])))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "none",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] }
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Phones failing provisioning",
|
|
"description": "Handsets hitting 'tftp to file failed' or 'no config Provisioning Server'. Any non-zero value is worth a look regardless of fleet size — this is a qualitative fault, not a magnitude, which is why it carries a threshold when the count panels deliberately do not.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 12, "y": 5 },
|
|
"id": 4,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"tftp to file failed|no config Provisioning Server\" [$__range])))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "value",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"color": { "mode": "thresholds" },
|
|
"thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "yellow", "value": 1 }] }
|
|
},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Phones with auth failures",
|
|
"description": "Handsets logging CUIT 'check passwd err' — a credential rejection on the phone's own web/UI. Could be a mis-provisioned password or someone probing; read the log panel below rather than treating the number as a score.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 16, "y": 5 },
|
|
"id": 5,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"check passwd err\" [$__range])))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "none",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] }
|
|
},
|
|
{
|
|
"type": "stat",
|
|
"title": "Phones with scheduler timeouts",
|
|
"description": "Handsets logging DEV 'data_task schedule time out' — the phone's internal scheduler overran its 30 s threshold. The best available proxy for 'this handset is struggling'.",
|
|
"gridPos": { "h": 4, "w": 4, "x": 20, "y": 5 },
|
|
"id": 6,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "count(count by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"data_task schedule time out\" [$__range])))",
|
|
"queryType": "instant"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"colorMode": "none",
|
|
"graphMode": "none",
|
|
"textMode": "auto"
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "fixed", "fixedColor": "text" } }, "overrides": [] }
|
|
},
|
|
|
|
{
|
|
"type": "bargauge",
|
|
"title": "Worst phones by actionable errors",
|
|
"description": "Comparative, not absolute — find the outlier rather than judge against a made-up number. Keyed on MAC, so a phone that changes IP stays the same bar.",
|
|
"gridPos": { "h": 9, "w": 12, "x": 0, "y": 9 },
|
|
"id": 7,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" [$__range])))",
|
|
"queryType": "instant",
|
|
"legendFormat": "{{mac}}"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"displayMode": "gradient",
|
|
"orientation": "horizontal",
|
|
"showUnfilled": true
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "continuous-GrYlRd" } }, "overrides": [] }
|
|
},
|
|
{
|
|
"type": "bargauge",
|
|
"title": "Loudest phones by log volume",
|
|
"description": "Identifies handsets left at log level 6 (Informational). Yealink's default is level 3 (Error); a phone near the top here is verbose by configuration, not necessarily unhealthy — but it dominates disk and query cost.",
|
|
"gridPos": { "h": 9, "w": 12, "x": 12, "y": 9 },
|
|
"id": 8,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "topk(10, sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} [$__range])))",
|
|
"queryType": "instant",
|
|
"legendFormat": "{{mac}}"
|
|
}
|
|
],
|
|
"options": {
|
|
"reduceOptions": { "calcs": ["lastNotNull"], "fields": "", "values": false },
|
|
"displayMode": "gradient",
|
|
"orientation": "horizontal",
|
|
"showUnfilled": true
|
|
},
|
|
"fieldConfig": { "defaults": { "unit": "short", "color": { "mode": "continuous-BlPu" } }, "overrides": [] }
|
|
},
|
|
|
|
{
|
|
"type": "timeseries",
|
|
"title": "Actionable errors by Yealink module",
|
|
"description": "Module tag parsed from the message body (it is not a label). CFG = config attribute lookups, DEV = scheduler, CUIT = auth, ATP = provisioning/transfer, WEB = web UI, LSYS = RTP capture.",
|
|
"gridPos": { "h": 8, "w": 12, "x": 0, "y": 18 },
|
|
"id": 9,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "sum by (module) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\" | regexp \"(?P<module>[A-Z]{2,5}) *<3[+]error\" [$__interval]))",
|
|
"queryType": "range",
|
|
"legendFormat": "{{module}}"
|
|
}
|
|
],
|
|
"options": {
|
|
"legend": { "displayMode": "table", "placement": "right", "showLegend": true, "calcs": ["sum"] },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": { "drawStyle": "bars", "lineWidth": 0, "fillOpacity": 80, "stacking": { "mode": "normal", "group": "A" }, "showPoints": "never" }
|
|
},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"type": "timeseries",
|
|
"title": "Severity mix (emergency excluded — see notes)",
|
|
"description": "severity=emergency is filtered out: on Yealink it is the boot-time log-level table, not an incident.",
|
|
"gridPos": { "h": 8, "w": 12, "x": 12, "y": 18 },
|
|
"id": 10,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "sum by (severity) (count_over_time({job=\"syslog\", mac=~\"$phone\", severity!=\"emergency\"} [$__interval]))",
|
|
"queryType": "range",
|
|
"legendFormat": "{{severity}}"
|
|
}
|
|
],
|
|
"options": {
|
|
"legend": { "displayMode": "list", "placement": "bottom", "showLegend": true },
|
|
"tooltip": { "mode": "multi", "sort": "desc" }
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": { "drawStyle": "bars", "lineWidth": 0, "fillOpacity": 70, "stacking": { "mode": "normal", "group": "A" }, "showPoints": "never" }
|
|
},
|
|
"overrides": [
|
|
{ "matcher": { "id": "byName", "options": "error" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "red" } }] },
|
|
{ "matcher": { "id": "byName", "options": "warning" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "orange" } }] },
|
|
{ "matcher": { "id": "byName", "options": "notice" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "blue" } }] },
|
|
{ "matcher": { "id": "byName", "options": "informational" }, "properties": [{ "id": "color", "value": { "mode": "fixed", "fixedColor": "green" } }] }
|
|
]
|
|
}
|
|
},
|
|
|
|
{
|
|
"type": "logs",
|
|
"title": "Signals that matter — auth, provisioning, scheduler",
|
|
"description": "The three narrow patterns confirmed to carry real operational meaning. Read this first when a phone is reported faulty. Labels show both mac (stable identity) and source_ip (where it is on the network right now).",
|
|
"gridPos": { "h": 10, "w": 24, "x": 0, "y": 26 },
|
|
"id": 11,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"check passwd err|tftp to file failed|no config Provisioning Server|data_task schedule time out\"",
|
|
"queryType": "range"
|
|
}
|
|
],
|
|
"options": {
|
|
"showTime": true,
|
|
"showLabels": true,
|
|
"showCommonLabels": false,
|
|
"wrapLogMessage": true,
|
|
"enableLogDetails": true,
|
|
"dedupStrategy": "none",
|
|
"sortOrder": "Descending"
|
|
}
|
|
},
|
|
|
|
{
|
|
"type": "logs",
|
|
"title": "All actionable errors (rtpcap noise floor removed)",
|
|
"gridPos": { "h": 10, "w": 24, "x": 0, "y": 36 },
|
|
"id": 12,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "{job=\"syslog\", mac=~\"$phone\", severity=\"error\"} !~ \"rtpcap get len not enough\"",
|
|
"queryType": "range"
|
|
}
|
|
],
|
|
"options": {
|
|
"showTime": true,
|
|
"showLabels": true,
|
|
"showCommonLabels": false,
|
|
"wrapLogMessage": true,
|
|
"enableLogDetails": true,
|
|
"dedupStrategy": "exact",
|
|
"sortOrder": "Descending"
|
|
}
|
|
},
|
|
|
|
{
|
|
"type": "timeseries",
|
|
"title": "SIP registration refresh (level-6 phones only)",
|
|
"description": "REG 'Register: update server' fires at info level, so ONLY handsets left at log level 6 appear here. A gap for such a phone means it lost registration to the PBX (192.168.0.8); an absent phone means it is at level 3, NOT that it is unregistered.",
|
|
"gridPos": { "h": 7, "w": 12, "x": 0, "y": 46 },
|
|
"id": 13,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "sum by (mac) (count_over_time({job=\"syslog\", mac=~\"$phone\"} |~ \"Register: update server\" [$__interval]))",
|
|
"queryType": "range",
|
|
"legendFormat": "{{mac}}"
|
|
}
|
|
],
|
|
"options": {
|
|
"legend": { "displayMode": "list", "placement": "bottom", "showLegend": true },
|
|
"tooltip": { "mode": "multi" }
|
|
},
|
|
"fieldConfig": {
|
|
"defaults": {
|
|
"unit": "short",
|
|
"custom": { "drawStyle": "points", "pointSize": 5, "lineWidth": 1, "fillOpacity": 0, "showPoints": "always" }
|
|
},
|
|
"overrides": []
|
|
}
|
|
},
|
|
{
|
|
"type": "logs",
|
|
"title": "DHCP lease events (level-6 phones only)",
|
|
"description": "Lease acquisition/renewal as the phone sees it — notice level, so the same caveat as the registration panel. Useful when a handset is 'connected but dead'. Observed lease time is 1200 s, which is exactly why source_ip is not a safe identity.",
|
|
"gridPos": { "h": 7, "w": 12, "x": 12, "y": 46 },
|
|
"id": 14,
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"targets": [
|
|
{
|
|
"refId": "A",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"expr": "{job=\"syslog\", mac=~\"$phone\"} |~ \"lease of .* obtained|lease renew\"",
|
|
"queryType": "range"
|
|
}
|
|
],
|
|
"options": {
|
|
"showTime": true,
|
|
"showLabels": true,
|
|
"showCommonLabels": false,
|
|
"wrapLogMessage": true,
|
|
"enableLogDetails": true,
|
|
"dedupStrategy": "none",
|
|
"sortOrder": "Descending"
|
|
}
|
|
}
|
|
],
|
|
"refresh": "5m",
|
|
"schemaVersion": 39,
|
|
"tags": ["yealink", "phones", "syslog", "02-tekhnohim"],
|
|
"templating": {
|
|
"list": [
|
|
{
|
|
"name": "datasource",
|
|
"label": "Datasource",
|
|
"type": "datasource",
|
|
"query": "loki",
|
|
"current": {},
|
|
"hide": 0,
|
|
"refresh": 1,
|
|
"regex": "",
|
|
"skipUrlSync": false
|
|
},
|
|
{
|
|
"name": "phone",
|
|
"label": "Phone (MAC)",
|
|
"description": "Device identity. allValue is '.+' (not '.*') so that 'All' matches only streams that HAVE a mac label — which excludes switches and other non-Yealink senders sharing this Loki.",
|
|
"type": "query",
|
|
"datasource": { "type": "loki", "uid": "${datasource}" },
|
|
"definition": "label_values({job=\"syslog\"}, mac)",
|
|
"query": {
|
|
"label": "mac",
|
|
"refId": "LokiVariableQueryEditor-VariableQuery",
|
|
"stream": "{job=\"syslog\"}",
|
|
"type": 1
|
|
},
|
|
"current": { "selected": true, "text": ["All"], "value": ["$__all"] },
|
|
"includeAll": true,
|
|
"multi": true,
|
|
"allValue": ".+",
|
|
"hide": 0,
|
|
"refresh": 2,
|
|
"sort": 1,
|
|
"skipUrlSync": false
|
|
}
|
|
]
|
|
},
|
|
"time": { "from": "now-24h", "to": "now" },
|
|
"timepicker": {},
|
|
"timezone": "browser",
|
|
"title": "Yealink IP phones — syslog health",
|
|
"uid": "yealink-phones",
|
|
"version": 2,
|
|
"weekStart": ""
|
|
}
|