Events

cerberd keeps the last 1000 events in memory (lost on restart). Read them with cerberd events [--follow] [--json] or GET /v1/events.

{"time":"2026-10-24T09:15:02.113Z","type":"link-active","link":"3f9c1a2b7d04","message":"direct link active","attrs":{"a":"site-a","b":"site-b","hub_rtt":"48.2ms","direct_rtt":"9.1ms"}}

Field	Meaning
time	when it happened
type	see below
node	the peer it is about, if any
link	the link id, if any
message	human-readable detail
attrs	string key/value details

Hub

Type	Meaning
hub-changed	a reconcile changed the interface; message lists what (2 peers added, 1 routes removed)
hub-error	applying the database to the interface failed; retried every timers.hub_reconcile
hub-guard	the max_removals guard held a reconcile back; nothing changed
hub-route-conflict	a route was skipped because another device already routes that prefix

Peers on the hub

Only for peers the database knows; foreign peers produce none.

Type	Attrs
peer-added	endpoint — the peer appeared on the interface
peer-removed	— the peer left the interface
node-online	endpoint — traffic from the peer within timers.hub_offline_after
node-offline	— no traffic for timers.hub_offline_after
endpoint-changed	old, new — the peer roamed

Routers

Type	Meaning
router-interface	attrs old, new — the binding’s wg_interface didn’t carry the peer’s public key; new does and is now stored in the peer’s router binding

Links

Attrs always include a and b.

Type	Meaning
link-punching	building a direct link; attr leader
link-active	the direct link is in use; attrs hub_rtt, direct_rtt
link-failed	no direct path; the link stays on the hub
link-no-gain	direct worked but wasn’t faster than the hub; removed
link-down	direct link removed, traffic back on the hub
link-down-failed	removing the link failed on a router
link-adopted	an active link found on the routers at startup was adopted
link-revert-forced	a forced block or delete went ahead although a link couldn’t be taken down
cleaned	a leftover tagged object was removed from a router