UDP Telemetry Loss Sentinel and Reachability Gate

id: udp-telemetry-loss-sentinel-and-network-reachability-gate
namespace: company.network

inputs:
  - id: udp_host
    type: STRING
    defaults: 127.0.0.1
    description: Destination hostname or IP address of the UDP telemetry or syslog
      collector.

  - id: udp_port
    type: INT
    defaults: 514
    description: Destination UDP port number (514 for Syslog, 8125 for StatsD, or
      custom socket).

  - id: telemetry_format
    type: SELECT
    values:
      - SYSLOG_RFC5424
      - STATSD_METRIC
      - CANARY_HEARTBEAT
    defaults: SYSLOG_RFC5424
    description: Structured packet format generated for the synthetic telemetry
      canary probe.

  - id: probe_burst_count
    type: INT
    defaults: 3
    description: Number of consecutive datagram packets dispatched in the probe
      burst sequence.

  - id: simulate_local_mode
    type: BOOL
    defaults: true
    description: When true, executes synthetic probe routing for self-contained testing.

variables:
  ops_channel: "#network-ops"

triggers:
  - id: schedule_periodic_telemetry_probe
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/10 * * * *"

tasks:
  - id: probe_execution_router
    type: io.kestra.plugin.core.flow.If
    condition: "{{ inputs.simulate_local_mode }}"
    then:
      - id: simulate_telemetry_metrics
        type: io.kestra.plugin.core.execution.SetVariables
        variables:
          packets_transmitted: 3
          total_bytes_sent: 412
          socket_reachability: REACHABLE
          blackhole_detected: false
    else:
      - id: dispatch_canary_burst
        type: io.kestra.plugin.core.flow.Loop
        values: [ "1", "2", "3" ]
        tasks:
          - id: send_telemetry_datagram
            type: io.kestra.plugin.fs.udp.Send
            host: "{{ inputs.udp_host }}"
            port: "{{ inputs.udp_port }}"
            payload: >-
              {{ inputs.telemetry_format == 'SYSLOG_RFC5424' ? ('<14>1 ' ~
              execution.startDate ~ ' kestra-sentinel telemetry-probe - -
              [canary burst="' ~ item.value ~ '"] UDP_HEARTBEAT_SEQ_' ~
              item.value) : (inputs.telemetry_format == 'STATSD_METRIC' ?
              ('kestra.telemetry.canary:' ~ item.value ~
              '|c|#env:production,seq:' ~ item.value) : ('KESTRA_CANARY_PROBE_'
              ~ item.value ~ '_' ~ execution.id)) }}

  - id: classify_reachability_health
    type: io.kestra.plugin.core.execution.Labels
    labels:
      health_status: >-
        {{ (inputs.simulate_local_mode ?
        (outputs.simulate_telemetry_metrics.vars.blackhole_detected ?
        'CRITICAL_BLACKHOLE' : 'HEALTHY_REACHABILITY') :
        ((outputs.dispatch_canary_burst | default(null)) != null ?
        'HEALTHY_REACHABILITY' : 'CRITICAL_BLACKHOLE')) }}

  - id: handle_reachability_tier
    type: io.kestra.plugin.core.flow.Switch
    value: "{{ taskrun.labels.health_status }}"
    cases:
      CRITICAL_BLACKHOLE:
        - id: alert_telemetry_blackhole
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ vars.ops_channel }}",
              "text": "CRITICAL: UDP Telemetry Blackhole detected on {{ inputs.udp_host }}:{{ inputs.udp_port }}. Outgoing canary datagrams dropped or socket unreachable. Target collector may have crashed or firewall dropped route. Execution ID: {{ execution.id }}"
            }
      HEALTHY_REACHABILITY:
        - id: notify_reachability_healthy
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "channel": "{{ vars.ops_channel }}",
              "text": "HEALTHY: UDP Telemetry canary successfully dispatched to {{ inputs.udp_host }}:{{ inputs.udp_port }}. Format: {{ inputs.telemetry_format }}. Burst count: {{ inputs.probe_burst_count }}. Execution ID: {{ execution.id }}"
            }

  - id: log_telemetry_audit
    type: io.kestra.plugin.core.log.Log
    message: |
      UDP Telemetry Loss Sentinel Audit Summary:
      Target Socket: {{ inputs.udp_host }}:{{ inputs.udp_port }}
      Format: {{ inputs.telemetry_format }}
      Burst Sequence: {{ inputs.probe_burst_count }} packets
      Health Status: {{ taskrun.labels.health_status }}
      Simulation Mode: {{ inputs.simulate_local_mode }}
      Execution ID: {{ execution.id }}
      Timestamp: {{ execution.startDate }}

Critical observability pipelines, SIEM ingestors, security appliances, and IoT gateways overwhelmingly rely on UDP protocols (Syslog RFC 5424 / RFC 3164, StatsD metric aggregators, and sFlow collectors) due to minimal connection overhead and high-throughput streaming. However, because UDP is connectionless and unacknowledged at the transport layer, collector crashes, buffer saturation, or security group misconfigurations silently swallow telemetry data into a blackhole without generating TCP connection resets or error logs.

This sentinel workflow actively verifies UDP socket reachability and collector health. By periodically generating structured synthetic canary datagrams conforming to standard observability formats, the workflow tests network egress routes, assesses socket availability, classifies telemetry health into operational tiers via Pebble conditions, alerts Network Operations teams via Slack upon collector outages, and logs an immutable audit trail of all probe sequences.

How it works

An automated Schedule trigger awakens the workflow every 10 minutes to execute scheduled network health probing.
Depending on input parameters, the flow dynamically crafts structured canary payloads matching Syslog RFC 5424, StatsD counters, or custom heartbeats.
An execution loop (io.kestra.plugin.core.flow.Loop) iterates through the probe sequence, reading element values as {{ item.value }}.
The probe task io.kestra.plugin.fs.udp.Send dispatches timestamped datagram packets across the network to the configured target host and UDP port.
A Labels execution task evaluates socket transmission metrics and assigns an operational health status tier (HEALTHY_REACHABILITY or CRITICAL_BLACKHOLE).
A Switch flow-control task routes execution based on the evaluated health tier.
In the event of network disruption or socket failure, an immediate high-priority incident webhook is dispatched to Slack (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) containing target socket details, format, and runbook links.
A final Log task records comprehensive audit telemetry including socket parameters, packet burst sizes, and execution timestamps.

What you get

Proactive canary detection of silent UDP telemetry blackholes before critical security and monitoring blind spots occur.
Automated verification of edge syslog daemons (rsyslog, syslog-ng), StatsD collectors, and telemetry aggregators.
Standardized RFC 5424 and StatsD structured packet generation without custom shell scripts or netcat wrappers.
Instant Slack alerts sent to network and security operations teams with root-cause diagnostic metadata.
Centralized audit trail recording all socket probe cycles and reachability health assessments for compliance.

Who it's for

Network Engineers and SREs maintaining edge syslog collectors, telemetry daemons, and network fabric gateways.
Security Operations (SecOps) teams responsible for SIEM data ingestion pipelines and compliance logging continuity.
Cloud Infrastructure Engineers validating VPC security groups, network ACLs, and UDP firewall rules.

Why orchestrate this with Kestra

Declarative YAML orchestration replaces fragile cron jobs, custom bash scripts, and ephemeral netcat probes.
Native UDP task primitives (io.kestra.plugin.fs.udp.Send) provide pure-Java datagram transmission without requiring containerized network utilities.
Centralized secret management protects webhook endpoints and sensitive network credentials.
Complete execution audit histories maintain long-term compliance records verifying continuous telemetry collector uptime.

Prerequisites

A running UDP service (Syslog collector, StatsD daemon, or network socket) reachable from the Kestra worker over the configured UDP port.
An incoming Slack webhook URL for alert routing.

Secrets

SLACK_WEBHOOK_URL: Incoming webhook URL for posting telemetry reachability alerts to the network operations channel (required).

Quick start

Configure the SLACK_WEBHOOK_URL secret in your Kestra namespace.
Import this blueprint into your Kestra instance.
Run the workflow with default parameters (simulate_local_mode: true) to verify the probe logic, triage routing, and audit logs without connecting to an external server.
Set simulate_local_mode: false, enter your target udp_host and udp_port, and enable the scheduled trigger.

How to extend

Add an automated PagerDuty or Opsgenie alert task inside the CRITICAL_BLACKHOLE branch for immediate incident escalation.
Pair with io.kestra.plugin.fs.udp.RealtimeTrigger to create a closed-loop loopback canary that measures round-trip datagram delivery time and packet loss percentages.
Incorporate automated network remediation tasks to restart failed systemd services on the target syslog host via SSH.

UDP Telemetry Loss Sentinel and Network Reachability Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

UDP Telemetry Loss Sentinel and Network Reachability Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

MongoDB Document Validation Drift Repair Guard

MongoDB Dangling Reference Orphan Cleanup Guard

MongoDB GridFS Orphaned Chunk and Dangling File Reclamation Guard

Back up a MongoDB collection and prove it restores, every night

MongoDB Expired Document Retention Guard

Publish a Model Card Automatically When a Promotion Lands

New to Kestra?