Every live measurement in Korthveil is drawn the same way: traffic, CPU, connections, VPN tunnels, intrusion prevention, and the rest. The graph scrolls from right to left. Each new measurement enters at the right edge as a sphere that rises from the bottom, bounces, and settles at its value. This guide shows how to read the graphs, look back in time, export the numbers, and change how the graphs look for yourself or for every administrator.
What you need:
Open the Dashboard. The Network Traffic panel shows the throughput of all interfaces except loopback.
| Part | Meaning |
|---|---|
| Upper left | What is measured (Throughput) and where (All interfaces except loopback) |
| Upper right | The newest measurement of each series, in its colour (Download, Upload), and the state: Live, Paused, No data N s, or Offline |
| Spheres | One measurement each. A new one rises from the bottom and bounces into place. The bounce is only animation: the numbers you read are always the measured values |
| Line | Joins the spheres. It is smooth but never goes above or below the measurements it joins |
| Left axis | The scale. It grows and shrinks smoothly with the values in view |
| Bottom axis | Seconds or minutes ago; now is the right edge |
| Legend | The series and their colours |
Gaps are real: when no measurement arrives, the line stops and the missing time is hatched in red. Korthveil never draws values it did not measure. No data 14 s means the firewall has not answered for 14 seconds; Offline means the request failed.
Graphs take turns: graphs that get their data at the same moment (the dashboard reads everything every 2 seconds) do not all move at once. Each graph shows its new measurement at its own moment, within at most 1.6 seconds, so the page moves like a wave. The measurement's time and value do not change.
The Live System panel and the interface cards have small graphs: CPU, memory, network, disk I/O, packets per second, and tracked connections. The number above each one is the newest measurement. The scale is in the graph's corners: the top value and the baseline.
Point at a small graph to see its Pause and settings buttons.
Point at a sphere. The tooltip shows the measured value, the series, what is measured, and the date and time. When the graph combines several measurements into one sphere (see Sampling interval below), it says Peak of N samples. A sphere above an alert line also names that line.
While paused, the bottom axis shows clock times instead of "seconds ago". Measurements keep arriving in the background, so nothing is missed.
How far back you can look is the Time window setting (5 minutes by default). Korthveil keeps twice that while the page is open.
Click Export (⤓) at the upper right of a graph. Korthveil saves a CSV file with one row per measurement:
| Column | Holds |
|---|---|
timestamp |
Date and time in UTC (ISO 8601) |
metric |
The graph's title and what it measures |
series |
For example Download |
value |
The measured value (throughput graphs: bytes per second) |
unit |
The unit of value |
samples |
How many measurements the value combines (its peak) |
The file has the measured values only, never the animated positions.
Click settings (⚙) on a graph. Changes apply at once and are saved to your account in the firewall's database. They affect only this graph and only for you. Use the global settings removes them again.
Open System › Appearance (or Appearance: graphs & animations in the user menu at the upper right). Graphs & animations holds your defaults for every graph; the Preview on the right uses generated sample data and shows each change at once.
| Setting | What it does | Default |
|---|---|---|
| Bounce strength | How far a sphere overshoots and bounces back; 0% rises smoothly | 70% |
| Scrolling speed | Slow, Normal, or Fast: the space between spheres (34, 51, or 85 pixels) | Normal |
| Animation duration | How long a sphere takes to settle | 2.0 s |
| Animated entry | Spheres rise from the bottom; off: they appear at their value | on |
| Opening wave | When a page opens, its history rises in one quick wave | on |
| Ripple where a new sample arrives | A soft ring around the newest sphere | on |
| Stagger updates | Graphs show new measurements at their own moment instead of all at once | on |
| Stagger spread (at most) | The longest a graph waits; never more than 80% of the time between measurements | 1.6 s |
| Spheres | Draw the spheres; off: the line only | on |
| Sphere glow, Line glow | A soft light around spheres and lines | on |
| Smooth curve | A curved line; off: straight lines between spheres | on |
| Shaded area under the line | A light fill below each line | on |
| Grid | Horizontal lines at the scale steps | on |
| Sphere size | Radius of the spheres | 6 px |
| Line thickness | Width of the lines | 1.5 px |
| Colours | One colour per series, in order | teal, blue, amber, violet |
| Background | Match the console, or Dark navy | Match the console |
| Sampling interval | One sphere per interval with the peak value, so short spikes stay visible; or every sample | Every sample |
| Time window | History kept for looking back; report graphs show their whole period | 5 minutes |
| Y-axis scale | Linear, or Logarithmic for spiky traffic | Linear |
| Measurement range | Automatic, or Fixed with a minimum and maximum | Automatic |
Some graphs fix what their measurement needs: percentages always run from 0 to 100%, and counts (peers, sessions, connections) use whole numbers.
Graphs with their own settings lists the graphs you changed with their gear; Use the defaults resets one.
Firewall-wide defaults on the same page are part of the firewall's configuration, so they apply to every administrator and are changed like any other setting: saved to the pending changes, then committed.
Graphs read the new defaults right after the commit. Each administrator's own settings still come first, then the firewall-wide ones, then Korthveil's. Korthveil defaults removes the firewall-wide defaults (again through a commit).
| Page | Graphs |
|---|---|
| Dashboard › Network Traffic | Download and upload, all interfaces |
| Dashboard › Live System | CPU, memory, network, disk I/O, packets per second, tracked connections |
| Dashboard › Threat Activity | Intrusion prevention alerts and blocks, DNS filter blocks, WAF blocks (for the add-ins that are on) |
| Dashboard › Network Interfaces, and Network › Interfaces, zones & routes (cards) | Download and upload per interface |
| Network › SD-WAN | Latency and jitter, packet loss per link |
| Network › Cellular WAN | Signal power (RSRP) and signal to noise (SINR) per modem |
| Network › DNS resolver | Queries and blocked queries per second |
| Security › Intrusion prevention | Alerts and blocks per second with alert markers; packets inspected |
| Security › Web application firewall | Requests inspected, blocked, and detected per second, with block markers |
| Security › Reverse proxy | HTTP requests, server errors, and WAF blocks per second |
| Security › Application control | Bandwidth of the four busiest applications |
| VPN › WireGuard | VPN throughput and peers online |
| Identity › Network access control | Sign-ins accepted and refused per minute; active sessions |
| Monitoring › Analytics & reports | Traffic and connections per hour or day, for the report period |
Markers: the intrusion prevention and WAF graphs draw a thin vertical line at each alert or block (red: blocked; amber: alert).
With the light theme (the sun/moon button at the top), graphs that match the console turn light too.
| Symptom | Check |
|---|---|
| A graph shows No data | The firewall stopped answering for that measurement. The red hatching shows how long. Check System status, or the add-in's page for a stopped service |
| A graph shows Offline | The request failed: the session may have expired (sign in again) or the network to the firewall is down |
| A security graph stays empty | The add-in is off or has nothing to count yet. Graphs start when the page opens; counters are turned into rates from the second measurement on |
| A security graph jumps to a gap | The add-in's service restarted and its counters started again from zero. Korthveil leaves a gap rather than draw a false spike |
| The page moves too much | Lower Bounce strength, turn off Ripple and Opening wave, or turn on reduced motion in your operating system: graphs then stop animating |
| My graph looks different from a colleague's | One of you has own settings (Appearance › Graphs with their own settings, or the gear). The firewall-wide defaults apply only where nobody changed a setting |
| Settings are not saved | Appearance shows Not saved with the reason. Settings are stored in the firewall's database, so the firewall must be reachable |
More: docs/KORTHVEIL_GRAPH_STANDARD.md describes the graph in full; adr/0071 records the design.