Chapter 19 Compliance, Storage & Ops Admin: #pAlerts

Operations dashboard, alerts and live telemetry

The operations dashboard (#pOps) shows live and as a 24-hour history: mails per minute in and out, deferred and bounced mail, spam rate, failed sign-ins, queue size and age of the oldest message, active connections per protocol, CPU, memory, free disk space, database size, certificate expiry and cluster nodes. Alerts (#pAlerts) report breaches by e-mail, webhook, SMS, Telegram, Signal or WhatsApp. External tools read the same data through /metrics (Prometheus), OpenTelemetry or the live event stream (Server-Sent Events).

Operational Tip & Architecture Note

On first start nextxch creates five rules without targets (queue stuck, disk almost full, certificate expiring, many failed sign-ins, many bounces). They appear in the history; to get notified, add an e-mail address or a webhook under Targets and tick it in the rule. The history survives restarts (Ops:PersistHistory = false turns that off).

Live event stream for monitoring tools

Authentication as for the admin API (an admin's API key via X-Api-Key, Bearer or Basic). Tenant admins only see their tenant. Filters: types, direction, status, q; maxRate limits events per second (default 20, max. 200); excess is reported in a dropped event.

Reference / Configuration

curl -N -H "X-Api-Key: $NEXTXCH_KEY" \
  "https://mail.company.com/api/admin/telemetry/stream?types=delivery,rejection,auth-failure&maxRate=50"

event: delivery
data: {"at":"2026-11-02T08:15:01Z","direction":"Outbound","status":"Delivered","from":"billing@company.com","to":"customer@example.com","code":250,...}

event: auth-failure
data: {"account":"info@company.com","protocol":"IMAP","remoteIp":"203.0.113.7","reason":"invalid password"}

# Types: delivery, rejection, auth-failure, filter, alert, queue

Settings, Default Values & Best Practices

Setting / Location	Description	Default Value	Production Best Practice
`Alarmregel`	Metric, condition (>, >=, <, <=), threshold and duration in minutes. The alert fires only when the condition holds that long without interruption.	`5 min`	Ignore short spikes: at least 5 minutes for rates (per minute), 0 minutes for certificate expiry.
`Abklingzeit, Wiederholung, Entwarnung`	The cooldown is the minimum time between two messages of the same rule; repeat reminds while the alert stays active; recovery reports the end.	`60 min / aus / an`	Keep the cooldown at 30 minutes or more so a fluctuating value does not keep paging.
`Ziele`	E-mail (sender is the admin who saved the settings), webhook (JSON with type nextxch.alert, signed with X-Nextxch-Signature: sha256=...), SMS, Telegram, Signal, WhatsApp through the channels under Notifications.	`-`	Add at least one target outside your own mail server (SMS, messenger or webhook): if delivery is down, an alert mail will not arrive.
`Messwerte in Prometheus und OpenTelemetry`	Every dashboard value is on /metrics: nextxch_mail_inbound_total, nextxch_mail_outbound_total, nextxch_mail_deferred_total, nextxch_mail_bounced_total, nextxch_mail_rejected_total, nextxch_mail_spam_total, nextxch_auth_failures_total, nextxch_mail_spam_rate_percent, nextxch_queue_messages, nextxch_queue_deferred_messages, nextxch_queue_oldest_age_minutes, nextxch_connections_active{protocol}, nextxch_process_cpu_percent, nextxch_process_working_set_bytes, nextxch_disk_free_percent, nextxch_disk_free_bytes, nextxch_database_size_bytes, nextxch_tls_certificate_min_expiry_days, nextxch_tls_certificate_expiry_days{domain}, nextxch_cluster_nodes_active, nextxch_alerts_firing, nextxch_smtp_filter_verdicts_total{type,verdict}, nextxch_smtp_filter_failures_total.	`aktiv`	Over OTLP the instruments carry the same names with dots instead of underscores (nextxch.mail.inbound); conversion to Prometheus yields the same names again.