Events
/jabali-admin/notifications/events. The catalog of event sources the panel can emit. Configure routing on Routing.
Built-in event sources
| Event source | When it fires |
|---|---|
cert_renew |
Let’s Encrypt issuance or renewal completes — success or failure. |
disk_full |
A user crosses the high-watermark threshold against their disk quota. |
service_down |
A watched systemd unit enters failed, restarts unexpectedly, or remains degraded for longer than its grace period. |
crowdsec_spike |
CrowdSec emits more decisions in a short window than the configured threshold (default: 50 decisions per 5 minutes). |
domain_expiry |
A managed TLS certificate enters the 14-day expiry window. (Note: the source name dates back to a planned WHOIS expiry detector that is not implemented; the current behavior is cert-only.) |
aide_diff |
The daily AIDE host-integrity scan reports a difference outside the panel’s drop-in paths. |
cron_failed |
A systemd-user cron timer’s service unit exits non-zero. |
backup_succeeded |
A scheduled backup completes successfully. |
backup_failed |
A scheduled backup fails. |
mail_quarantined |
Stalwart or the async post-delivery YARA scan moves a message to quarantine. |
malware_file_hit |
A M33 detector (ClamAV, LMD, YARA, Tetragon) hits on a file. |
db_root_rotated |
The administrator rotates the MariaDB root password. |
mail_throttle_suspended |
A sender is suspended after repeated throttle hits. |
Stub sources
Defined but not yet wired to producers:
domain_registrar_expiry— would observe WHOIS expiry data; deferred pending an external WHOIS lookup pipeline.backup_future_warnings— predictive backup-failure detection.
Severity
Each event has a default severity (info, notice, warn, error, critical). Routing rules may filter by severity threshold.
Custom event sources
Adding a new source is one Go file under panel-api/internal/notifications/sources/. The dispatcher discovers sources by interface registration at boot; no schema migration required.
Discovery in the UI
Each event row shows: description, default severity, producer module, default routing rule(s), and last 24 h emission count.