Network Monitoring and overviews: open filtered charts from tiles, identify instances and alerts by chart labels #1157

TL;DR

• Customer feedback on the Network Monitoring workspace: overview tiles are dead ends, and interfaces and other instances are shown by long chart IDs instead of names people recognize (such as the interface alias).
• The same gaps exist across Netdata Cloud: overview tiles do not open the chart behind them, alerts do not show the labels that identify the affected instance, and charts identify instances by chart ID.
• Proposed direction: show the existing chart labels in the UI, generically for every collector, instead of encoding display text in chart IDs or names. Screenshots of today's behavior come from the Netdata Demo space; target images are mockups.

Background

Two requests came from a customer using the Network Monitoring workspace:

1. Clicking an item in an overview tile (for example a device or an interface in a "top N" tile) should open the real chart, already filtered to that item. This should work in every workspace, not only Network Monitoring.
2. Network views should identify interfaces by their IF-MIB ifAlias (the description an administrator assigns, such as "Uplink to core") instead of the raw name (Gi1/0/24).

A first implementation across several repositories was explored and then closed in favor of a UI-first approach. Maintainer feedback: netdata/netdata#24553 (comment) and follow-up. The main points:

• Putting mutable display text into chart names is fragile. It needs duplicate-name handling, cross-chart name ownership and two-step renames. It changes exported metric names, and alert rules that match by chart name are affected.
• The metadata needed to identify an instance already exists as chart labels. The UI should show it, for every collector, not just SNMP.

Problems today (Netdata Demo space)

1. Overview tiles are dead ends

Clicking a row in the Network Monitoring overview (for example "Top Devices by Traffic" or the interface table) or in the home overview (for example "Top Nodes by CPU") does nothing. Users have to find the chart again by hand and rebuild the filter.

2. Instances are identified by chart IDs that are too long to read

• The interface table tile and the Metrics "List SNMP devices" table squeeze the instance and label columns into a few characters.
• In the chart instance picker, every row starts with the same prefix and the interface name is cut off. Real instance IDs from the demo look like this:
  • snmp_LON-Juniper-T4000-Core-Router-ip-15_15_15_2.snmp_device_prof_ifTraffic_et-1/0/0@LON-Juniper-T4000-Core-Router
  • snmp_NYC-Cisco-NEXUS9000-SWITCH-ip-20_20_21_1.snmp_device_prof_ifTraffic_Ethernet1/15@NYC-Cisco-NEXUS9000-SWITCH

3. The default grouping hides the instances

The interface Traffic chart defaults to "Group by dimension", which sums 803 interfaces across 26 nodes into a single in/out pair. Nothing on the chart says which interface carries the traffic.

4. Alerts don't identify the affected instance

• The alert modal shows Node and Instance (the chart ID), but none of the chart's labels (this chart has 13), even though labels are what identify an HA member, interface, disk or container.
• The alerts list's Instance column is cut off to snmp_….
• Alert text that uses ${label:...} shows unresolved values: the FortiGate HA alert reads "FortiGate HA node [none] sync" while the same modal shows a serial number for that member.

5. Interface alias is not available at all

SNMP profiles poll ifAlias only for topology. Interface charts carry no alias label, so neither charts, tables nor alerts can show it.

6. Topology tab: unhelpful error in the demo

The Network Monitoring Topology tab (and its overview tile) shows "Error 404 — The agent rejected this request — no snmp_topology instances available" for the default Agent. The cause is not investigated yet. At minimum, the error should guide the user (for example, by suggesting a different Agent or explaining how to enable topology).

Target result (mockups)

A. Overview tile rows open the real chart, filtered to the item

• Clicking a row opens the single-item chart in Metrics, or the node page when one node is involved, with the filter applied.
• The filter is kept in the URL so the view can be shared and reloaded.
• Placeholder rows ("Others", empty groups) aren't clickable, and rows can be reached with the keyboard.

B. Alert modal gets a generic "Chart labels" section

• Shows the labels of the alerting instance next to Node and Instance, for every collector (disk: device + mount point; container: name + image; interface: interface + alias).
• If labels can't be loaded, the modal still opens.
• Alert summaries never show unresolved placeholders such as [none].

C. Charts identify instances by labels, and the default grouping is useful

• The instance picker, legend, tooltip and table show a readable name built from labels (for example the alias, with device and interface as secondary text), not the chart ID.
• The default grouping for per-instance contexts such as interface traffic shows the top instances, not one sum of everything.
• Group by the identifying labels and only display the alias. Grouping by alias alone would merge interfaces that share an alias or have none.

D. Topology ports are labelled by alias

Port bullets show the alias and fall back to the interface name. The port key stays the interface name, so links still resolve and ports that share an alias are not merged.

E. Alerts list and notifications name the affected instance

• Alert summaries and info can use ${label:...}. The Agent already fills these in and re-renders them when labels change (rrdcalc.c).
• The Instance column shows labels, not a truncated chart ID.

Constraints learned from the first attempt

• Do not put display text in chart IDs or names.
  • IDs carry history and alert identity.
  • Names are exported (exporters send names by default).
  • Health alarm: rules match the chart ID or name (health_prototypes.c).
• Aliases are not unique and may be empty. Every display must fall back to the identifying label (such as interface), and grouping must not merge distinct instances.
• Labels can change while the Agent runs. SNMP chart labels are set when the chart is created. If an alias edit should show up without a job restart, the collector has to refresh labels, using a stable choice of row when several rows map to one chart. No chart renaming is needed for this.
• Topology payload changes are cross-repository. The topology service decodes payloads strictly, so a new optional field (for example a port display label) must be accepted by the service before Agents send it.

Work areas

• Agent (netdata/netdata)
  • Collect ifAlias as an if_alias chart label on every interface metric in the stock SNMP profiles.
  • Optionally add an Alias column to the SNMP interfaces Function.
  • Optionally add a topology port display label.
  • Use ${label:...} in any interface alert summaries.
  • Look into why the FortiGate HA alert renders [none].
• Charts library (netdata/charts)
  • Emit an opt-in event when a grouped row is clicked, carrying the group's labels, node and context.
  • Support a display label per instance or group, with a fallback.
• Cloud frontend
  • Navigate from tile clicks to the filtered chart, with the filter in the URL.
  • Add a "Chart labels" section to the alert modal. Per-instance labels are already returned by the data API with the details option.
  • Show readable instance names in the picker, legend and alerts table.
  • Set better default grouping for per-instance contexts.
  • Show the alias on network tiles.
• Topology service
  • Accept the optional port display label before Agents send it.
  • Note: netdata/cloud-topology-service#39 fixes a separate, live bug: released Agents' incident-mode owner filters are rejected. That PR is still open and is handed to the team.

Prior exploration (closed, for reference)

netdata/netdata#24552, netdata/netdata#24553, netdata/netdata#24554, netdata/charts#245, netdata/cloud-frontend#5966, netdata/cloud-topology-service#40, netdata/testdata#23.

Open questions

1. Which label should be an instance's display name? Should each context declare it (for example in chart metadata), or should the UI decide?
2. Which contexts should default to a per-instance top-N view instead of "Group by dimension"?
3. Should tile click-through open Metrics or the node page by default when the item belongs to one node?