The metrics that tell the real story

Signal	What it tells you	Watch for
Sessions by state	How many subscribers are onboarding / connected / behind the portal	A pile-up in OFFERING (onboarding failing); a surge in CAPTIVE (mass expiry or AAA rejecting)
Per-subscriber red counter	A subscriber constantly hitting their rate cap	Upsell candidates; also abuse
Node-wide QoS bands	What the whole box is doing by colour, this second	Aggregate red climbing = policers shedding load
DHCP counters (discovers, offers, requests, acks)	Onboarding health and conversion	Discovers with no matching acks = onboarding trouble; a reset to zero = controller restarted
Pool utilisation	Address headroom per pool	Rising utilisation before it becomes exhaustion
Session cap / onboard-refused	The box is full and refusing new subscribers	A climbing refusal count = time to add a node (relevant to the free-tier cap)
Controller save timing	The controller's own persistence latency	Rising values = approaching the per-node scaling ceiling