- Linux · macOS · Windows · Docker · Kubernetes
Hosts, Kubernetes and cloud
The Infrastructure section of the console shows what runs where and how hard it is working: hosts, containers, Kubernetes clusters and the resources in your cloud accounts. This page explains where each view gets its data and how to read it.
Hosts
A host appears in Infrastructure › Hosts once a collector on it sends host metrics. The Host Metrics integration, on Linux, macOS and Windows, collects CPU, memory, load, disk I/O, filesystem, network and system metrics by default. Per-process metrics, process counts, paging and NFS are off until you turn them on in the integration's settings.
Explorer
Explorer lists every host with its status, environment, CPU, memory and disk use, load, uptime, instance, region and collector version. Search by name, tag, region or instance type, filter by any facet or metric range on the left, and use Group by to group hosts by cloud provider, region, availability zone, instance type, operating system, agent version, environment or project. Columns adds network throughput, operating system, zone and account.
| Status | Meaning |
|---|---|
| Reporting (OK in the list) | The host reported in the last 2 minutes. |
| Stale | No report for 2 to 10 minutes. |
| Offline | No report for 10 minutes or more. |
Map
Map draws every host as a hexagon. Group by cloud provider, region, availability zone or operating system, and Fill by status, CPU %, memory %, disk % or load. A hatched hexagon means that host does not report the metric. Select a hexagon to find the host in Explorer.
A host's details
Open a host to see:
- Host Summary: its current CPU, memory, disk, load, uptime and network, and its account, region, instance type and tags.
- Metrics: CPU, memory, load averages, disk use by mount, network throughput and swap, over the time range you pick.
- Logs: its 100 most recent log lines.
- Network: throughput by interface.
- Processes: a count of processes by state, when process counts are turned on.
- Agent: the collector on the host, its version, policy and configuration revision.
The time range, 15 minutes by default, applies to the charts, logs and network rates. Status and the current CPU, memory and disk values always show the latest report.
Containers
Infrastructure › Containers lists the containers running in your Kubernetes clusters and on Docker hosts, with their status, image, restarts, CPU and memory. Docker containers come from the Docker integration, which reads stats from the Docker socket. Select a Kubernetes container to open its pod in the Kubernetes explorer. The Map tab draws containers grouped by namespace, cluster, pod, image or source.
Infrastructure › Container Images lists each image and tag with the containers, pods and clusters running it.
Kubernetes
Install in a cluster
The collector runs in a cluster as a DaemonSet, one pod on every Linux node, installed with Helm. In the console, open Collectors, select Deploy collector and choose Kubernetes to get the commands for your workspace and policy. See Install the Tracix Collector.
The Kubernetes integration in the collector's policy decides what is collected:
| Section | What it collects |
|---|---|
| Cluster metrics | Cluster, node and workload state |
| Pod & container usage | CPU and memory per pod and container, against requests and limits |
| Object inventory | Object manifests, every 60 seconds |
| Cluster events | Kubernetes events |
| Network flows | Connections between pods, with throughput, retransmits and round-trip time. On by default. |
| Container logs | Pod logs. The Helm release must allow it, which the console's command does when the policy needs it. |
Set Cluster name so every signal carries k8s.cluster.name, and use the same name as your EKS, AKS or GKE cluster so cloud discovery can match it.
Explore a cluster
Open Infrastructure › Kubernetes. Its tabs are:
- Overview: counts of clusters, nodes, pods, pending or failed pods, namespaces and restarts, with pods per namespace and the pods that restart most.
- Explorer: pods, nodes, namespaces, clusters, workloads (deployments, replica sets, stateful sets, daemon sets, jobs and cron jobs) and services. Add endpoints and persistent volume claims under Objects in the Kubernetes integration. Group pods by namespace, node, workload, status or cluster, and open an object for its Overview, Metrics (for pods and nodes), YAML and Events.
- Utilization: each pod's CPU or memory use against its requests and limits, with its idle capacity, and how many pods have no requests or limits set.
- Map: pods or nodes as hexagons, filled by status, by CPU and memory use against limits or allocatable capacity, or by restarts.
- Network: throughput, retransmits and round-trip time between pods, grouped by service, namespace, host, IP or port, with a table of conversations.
With a time range of 15 minutes or less, the views show the cluster as it is now, and an object that has not reported for 5 minutes counts as gone. Wider ranges show everything that reported in the range.
Some kinds stay empty for now
The Explorer also lists kinds such as ingresses, network policies, persistent volumes, storage classes, RBAC objects and custom resources. The collector does not collect those yet, so they show as empty.
Cloud accounts
Tracix discovers the resources in your AWS, Azure and Google Cloud accounts from its own cloud gateway, with read-only credentials you provide. Nothing is installed in your accounts.
Connect an account
Start the wizard
Open Integrations and select Connect account, then pick AWS · Auto-discovery, Azure · Auto-discovery or GCP · Auto-discovery. Choose Agentless collection.
Give it read-only access
- AWS: choose Cross-account IAM role (recommended). Create a role in your account that trusts the principal shown in Trust this Tracix principal, with the External ID condition, grant it read-only access and paste Your role ARN. A Static access key works too.
- Azure: enter the Subscription IDs and a service principal's Directory (tenant) ID, Application (client) ID and Client secret. Give the service principal the Reader role on the subscriptions.
- Google Cloud: enter the Project IDs and upload the JSON key of a service account with the Viewer role.
Review and connect
Choose the services and regions to scan, review and connect. Discovery scans every 5 minutes, in all regions by default.
| Provider | Discovered resources |
|---|---|
| AWS | EC2, RDS, load balancers, S3, Lambda, ECS, EKS, CloudFront and Route 53, plus more types through Cloud Control when you turn it on |
| Azure | Virtual machines, networking, Azure SQL, load balancers, storage, Functions, AKS, CDN and DNS |
| Google Cloud | Compute Engine, Cloud SQL, load balancing, Cloud Storage, Cloud Functions, Cloud Run, GKE, Cloud CDN and Cloud DNS |
Discovery gives you the inventory. For cloud metrics and logs, add the AWS integration for CloudWatch metrics and logs, or the Azure integration for Azure Monitor metrics. Google Cloud metrics and logs arrive only through a Pub/Sub subscription you export them to, with the GCP integration.
Browse cloud assets
Open Infrastructure › Cloud. Assets shows one card for each account, with its regions and resource count. Open an account to see its network layout, its security groups and what is exposed to the internet, a filterable list of resources, and its container services. Export PDF saves the view.
Tracix matches discovered instances to the hosts your collectors monitor, by instance ID, resource ARN, or host name and private DNS name, and clusters by cluster name. A matched resource shows Monitored by Tracix, with links to the host and the services that ran on it.