Online, offline and telemetry

pfCentral shows each firewall as online, offline or awaiting enrollment. This page explains what each means and how quickly the status changes.

Heartbeats and a 15-second timer

Every agent sends a small heartbeat to the server every 5 seconds. Each heartbeat refreshes the device’s entry in a NATS key-value bucket called device-presence. Entries in that bucket expire 15 seconds after they were last refreshed.

The rule is simple: a firewall is online while its presence entry exists.

Try it. Cut the WAN link and watch the entry run out:

Agent on fw-hq-01 ♥ heartbeat every 5 s

✕

Presence entry in NATS

15 s left before it expires (TTL 15 s)

pfCentral shows Online

Cut the WAN link

simulated at 3× speed · 0 s Heartbeats keep the entry alive.

What this means in practice:

Event	How soon pfCentral shows it
Agent stopped cleanly (service stop, reboot)	At once. The agent closes its connection and the server sees the disconnect.
Network cut, power loss, crash	Within about 15 seconds, when the presence entry expires.
Link restored	Within a few seconds. The agent retries every 2 seconds or so, and the first heartbeat brings it back.

Missing one heartbeat is harmless. The device goes offline only after three missed heartbeats in a row.

What “offline” shows you

When a device is offline, its pages show the last data the server has, with an Offline banner: “not reachable via NATS”, “Auto-reconnect enabled”. You cannot make changes until it is back, because the agent is not there to apply them.

A device that was added but never enrolled shows Awaiting enrollment instead, with a button to generate a new token.

Live telemetry

Separately from heartbeats, every agent publishes a telemetry sample every 2 seconds: CPU, memory, swap, disk, temperature, pf state table use, per-interface traffic, gateway latency and loss, and VPN counters.

• The Overview tab and the fleet rail draw from these samples in real time.
• Samples are kept in the TELEMETRY stream for 6 hours, so a server restart does not blank the charts.
• The server also exposes the latest values in Prometheus format at /metrics. See Watch fleet health.

Tuning

The defaults suit most fleets. If your sites have very lossy links and flap between online and offline, you can lengthen the timer on the server:

Variable	Default	Effect
PFCENTRAL_NATS_REGISTRY_SWEEP_INTERVAL	5s	Expected heartbeat period
PFCENTRAL_NATS_REGISTRY_MAX_MISSED_SWEEPS	3	Missed periods before a device is offline. TTL = interval × this.

The agent’s heartbeat_interval (default 5s) and telemetry_interval (default 2s) are not exposed in the pfSense package, and the package rewrites the agent’s config file each time you click Save. Leave them at their defaults.