Command Center / n8n forensics

n8n Monitoring & Analysis Dashboard

A forensic dashboard for the failure-rate screen you showed me — with the observed metrics, a manual-disable impact readout, and the two concrete error paths discovered in this chat.
scope last 7 days
mode live feed
focus auto refresh + interaction
last refresh --
refresh 30s
Live view refreshes itself every 30 seconds and keeps the last selected view.
Executive summary

The dashboard says “bad”; the logs say “partly self-inflicted, partly real.”

The raw n8n screen is severe: production volume is roughly flat, while failures more than doubled and the failure rate jumped from the high-20s into the mid-60s. That is not just noise. But the chat also surfaced intentional job pauses and a brittle backup path, so some of the error inflation is likely from jobs you purposely turned off.
Prod executions
2,210
▲ 0.78%
Failed prod executions
1,424
▲ 126.03%
Failure rate
64.4%
▲ 35.7pp
Run time (avg.)
0.31s
▲ 0.04s
Previous failure rate
28.7%
estimated from delta

What changed

current vs prior snapshot

Traffic stayed flat

Production executions barely moved, so the spike is not explained by a volume burst.

Low change in load

Failures exploded

Failed executions rose from an estimated ~630 to 1,424, which is a real regression signal.

High severity

At least one backup path is brittle

The hourly audit showed a Gmail/n8n backup error: HTTP Error 400: Bad Request.

Action needed

Mac mini dependency is timing out

The live monitor repeatedly timed out on SSH + osascript, which points to the Mac-side path, not n8n alone.

Dependency risk

Failure vs success

actual observed counts
64.4%
failure rate
1,424 failed / 2,210 total
Failed executions
up 126.03% vs prior snapshot
1,424
Successful executions
roughly 35.6% of the period
786
Observed runtime
fast failures likely config / auth / dependency
0.31s

Current vs previous

the regression is visible without a chart upgrade
Production executions
2,210 vs 2,193
Failed executions
1,424 vs 630
Failure rate
64.4% vs 28.7%
Avg runtime
0.31s
Reading: This is the signature of a broken path or a bad dependency, not just a busier calendar. The volume stayed almost flat while failures surged.

Adjusted view

what manual disables mean

Intentional pauses reduce the real denominator

confidence: high

A lot of cron jobs were manually paused on the VPS. Any workflow depending on them can look “failed” simply because it was intentionally taken out of service.

But some failures are still real bugs

confidence: high

The email audit returned a Gmail/n8n HTTP 400. The live monitor returned an SSH/AppleScript timeout. Those are genuine operational errors, not just false positives from a pause.

Operational risk

scorecard

Backup email path degradation

95/100

Mac mini SSH / GUI dependency fragility

90/100

Paused-job inflation of failure stats

82/100

Decision

my read
Conclusion: some of the rate is artificially worse because you paused cron jobs, but not enough to dismiss the alert. Treat the email backup path and Mac mini dependency as real problems worth fixing.

Diagnostic heat

analysis, not raw counts

Manual disable / paused-job effect

likely contributor

This explains why the dashboard may look worse than the truly active surface area.

Gmail OAuth / n8n backup problem

confirmed issue

The audit hit an HTTP Error 400: Bad Request path while checking the backup flow.

Mac mini SSH / AppleScript path

confirmed issue

Repeated osascript timeouts show the live-monitor path is brittle or blocked.

What to do with the dashboard number

how to interpret the 64.4%
Use the 64.4% as a red flag, not a final verdict. If you want a precise “manual-disable-adjusted” rate, we need execution export or API data to subtract paused workflows properly.

Likely adjusted reality

qualitative

Lower than 64.4%, because you knowingly paused some jobs.

Still unacceptable if untouched

qualitative

Even after discounting pauses, the backup email route and Mac mini path still need attention.

Most valuable next comparison

recommended

Compare active workflows only vs all workflows to separate operational cleanup from true failure rate.

Failure anatomy

observed error paths from this chat
Error 1
HTTP 400
Gmail / n8n backup audit
Error 2
SSH timeout
Mac mini live monitor path
Error 3
Paused jobs
intentional but still counted in history
Error 4
Fast fail
0.31s average runtime suggests early exit
Job / workflow Evidence seen in chat Likely classification Impact on failure stats
Raziel Hourly Email Audit
/root/raziel-projects/zero-cost-gmail-monitoring/hourly_email_audit.py
Run log showed HTTP Error 400: Bad Request after confirming n8n and Mail were already running. Real issue High — this is a real backup-path failure, not just a disabled-job artifact.
Raziel Live Email Monitor
/root/raziel-projects/zero-cost-gmail-monitoring/live_email_monitor.py
Repeated SSH command timeouts while launching osascript on the Mac mini. Dependency brittle High — the live path is likely a genuine operational bottleneck.
Raziel Inbox Monitor
n8n inbox force-trigger / NAS polling
Observed as silent/empty output in one run, and the workflow was part of the “monitoring stack” that depends on other services. Possibly benign / paused Moderate — could be inflated by intentional disablement or quiet periods.
Paused VPS cron jobs
multiple scheduled workers paused by you
You said you paused a lot of cron jobs that may have dependencies with n8n workflows. Intentional / excluded Medium to high — definitely makes the raw rate look worse if still counted in recent history.

Chart: root-cause priority

what to fix first
Gmail OAuth / backup
95
Mac mini SSH / GUI path
90
Paused jobs muddying stats
82
Need exact active-only export
72

Why this matters

business interpretation
A raw failure rate above 60% is dangerous if it reflects active work. But if some of the jobs are intentionally disabled, the number overstates the live risk surface. The dashboard should therefore split paused / excluded from active / failing before you make a go/no-go decision.

That’s the exact upgrade-worthy view: not just a number, but a breakdown by job state, error signature, and whether the failure is policy-driven or operational.

Timeline of evidence in this chat

what happened when
Step 1

n8n Insights showed 64.4% failure rate

Production volume 2,210; failed executions 1,424; run time 0.31s; failure rate up 35.7 points. That was the initial red flag.

Step 2

Manual cron pauses explained part of the picture

You said you paused several VPS cron jobs that may depend on n8n workflows. That means some of the raw failure stats are likely inflated by intentional disablement.

Step 3

Hourly Email Audit surfaced a Gmail/n8n error

The latest audit log showed HTTP Error 400: Bad Request and confirmed the n8n/Mail services were already running.

Step 4

Live Email Monitor hit SSH + AppleScript timeouts

Repeated ssh ... osascript - calls timed out after 30 seconds, which points to the Mac mini dependency path rather than n8n alone.

Timeline interpretation

what the sequence implies

There was a real regression

yes

Flat volume + sharply rising failures = something changed.

Some jobs were intentionally taken out

also yes

So the raw dashboard probably overstates live failure risk.

But two real failure signatures remain

confirmed

Gmail backup and Mac mini SSH/GUI are the priority fix targets.

Recommended next move

order matters
1

Export active workflow / execution data

Separate active workflows from intentionally paused jobs so you can compute an adjusted failure rate.

2

Fix the Gmail backup credential path

The HTTP 400 needs inspection from the OAuth / token refresh branch, not another generic retry.

3

Stabilize the Mac mini SSH/GUI path

That live-monitor timeout can easily cascade into false operational noise across other automations.

What this page is for

command center note
This page is meant to live alongside your command center as a readable, drill-down analysis view — closer to an upgraded n8n Insights page, but tailored to the failures we actually observed in this chat.

If you later want a live version, the same layout can be wired to n8n exports or API responses and turned into a real dashboard instead of a forensic snapshot.