How Tracix fits together
Tracix has two layers: an organization for your people, sign-in rules and billing, and one or more workspaces that hold your data. Collectors and OpenTelemetry SDKs send telemetry into a workspace, and policies decide what each collector collects.
The building blocks
| Concept | What it is | Where you manage it |
|---|---|---|
| Organization | Your company's account: members, roles, single sign-on, MFA and billing | The console |
| Workspace | An isolated environment with its own database and address | Created in the console, used at its own address |
| Collector | The agent you install on hosts and clusters | In the workspace, under Collectors |
| Policy | The configuration for a group of collectors | In the workspace, under Collectors › Policies |
| Signals | Traces, metrics, logs and the other data Tracix stores | Sent by collectors and SDKs, explored in the workspace |
Organization
The organization is your company's account in Tracix. It holds your members and their roles, single sign-on and SCIM, the MFA and session policy, and billing. You manage it in the Tracix console at https://cloud.tracix.io. The person who signs up becomes the organization's Owner, and each user account belongs to one organization.
Workspace
A workspace is an isolated Tracix environment inside your organization, such as one for production and one for staging. Each workspace gets its own Kubernetes namespace, its own ClickHouse database cluster and its own address. The Kubernetes cluster that runs them is shared; the namespace, database and address are not. See Trust for how workspaces are isolated.
The address combines the name you gave the workspace with an ID Tracix generates, such as https://production-a7k3p2q9.app.tracix.io. The workspace's other endpoints use the ID: agents-a7k3p2q9.app.tracix.io for collectors and otlp-http-a7k3p2q9.app.tracix.io for OpenTelemetry data. Today, workspaces run on AWS in the us-east-1 region.
Your telemetry, dashboards, monitors, detections and device configurations live in the workspace. Access is granted workspace by workspace: someone can open a workspace only after an admin adds them to it with a workspace role. See Users and roles.
Collector
The Tracix Collector is an OpenTelemetry Collector distribution. You install it on Linux, macOS and Windows hosts, in Docker or on Kubernetes. Each collector enrolls into one workspace and one policy, collects what that policy asks for, such as host metrics, logs, SNMP or flows, and writes it to the workspace. See Install the collector.
Policy
A policy is the configuration for a group of collectors: the integrations they run and where they write. Every change creates a numbered revision. Tracix turns the policy into an OpenTelemetry Collector configuration, signs it with Ed25519 and pushes it to the policy's collectors over a WebSocket, with polling as the fallback. New collectors join a policy with one of its enrollment tokens. See Manage collectors with policies.
Signals
Tracix stores the OpenTelemetry signals (traces, metrics and logs) and adds CPU profiles, network flows (NetFlow, IPFIX and sFlow), SNMP device data, syslog and security events. Applications send traces, metrics and logs with the upstream OpenTelemetry SDKs; Tracix has no SDK of its own.
Two places to work
| Console | Workspace | |
|---|---|---|
| Address | https://cloud.tracix.io | Its own address, such as https://production-a7k3p2q9.app.tracix.io |
| What you do there | Create and delete workspaces, invite members, set roles, single sign-on, SCIM, MFA and billing, and decide who can open each workspace | Install and manage collectors and policies, add integrations, explore data, build dashboards and monitors, and create API keys |
Signing in to a workspace goes through the console, so one sign-in covers both, and your organization's SSO and MFA rules apply everywhere.
How data reaches a workspace
- Applications export traces, metrics and logs over OTLP to the workspace's gateway, such as
https://otlp-http-a7k3p2q9.app.tracix.io, and authenticate with an ingest key. - Collectors connect to the workspace's control plane to enroll and pull their policy, then write what they collect to the workspace's data store.
- The workspace's ClickHouse database holds the data, and every page in the workspace reads from it.
Product areas
| Area | What it covers | Docs |
|---|---|---|
| Applications | APM and distributed tracing, CPU profiling, databases and real user monitoring | Observe |
| Infrastructure | Hosts, containers, Kubernetes, cloud accounts, logs and metrics | Observe |
| Network | Devices over SNMP, discovery and topology, flows and configuration management | Network |
| Security | Detections, entities and attack paths, software inventory and response actions | Security |
| Alerting and response | Monitors, problems and cases, SLOs and on-call | Alerting and response |
| AI and automation | Brain, workflows and agents, and Auto-Fix | AI and automation |