# Hosts, Kubernetes and cloud

Explore hosts on a list or a map, containers and Kubernetes clusters with usage against requests, and the AWS, Azure and Google Cloud resources you connect.

The **Infrastructure** section of the console shows what runs where and how hard it is working: hosts, containers, Kubernetes clusters and the resources in your cloud accounts. This page explains where each view gets its data and how to read it.

## Hosts

A host appears in **Infrastructure › Hosts** once a collector on it sends host metrics. The **Host Metrics** integration, on Linux, macOS and Windows, collects CPU, memory, load, disk I/O, filesystem, network and system metrics by default. Per-process metrics, process counts, paging and NFS are off until you turn them on in the integration's settings.

- [Install the collector](https://tracix.io/docs/collect/collector/install): Add hosts to your workspace

### Explorer

**Explorer** lists every host with its status, environment, CPU, memory and disk use, load, uptime, instance, region and collector version. Search by name, tag, region or instance type, filter by any facet or metric range on the left, and use **Group by** to group hosts by cloud provider, region, availability zone, instance type, operating system, agent version, environment or project. **Columns** adds network throughput, operating system, zone and account.

| Status                         | Meaning                                  |
| ------------------------------ | ---------------------------------------- |
| Reporting (**OK** in the list) | The host reported in the last 2 minutes. |
| Stale                          | No report for 2 to 10 minutes.           |
| Offline                        | No report for 10 minutes or more.        |

### Map

**Map** draws every host as a hexagon. **Group by** cloud provider, region, availability zone or operating system, and **Fill by** status, CPU %, memory %, disk % or load. A hatched hexagon means that host does not report the metric. Select a hexagon to find the host in **Explorer**.

### A host's details

Open a host to see:

* **Host Summary**: its current CPU, memory, disk, load, uptime and network, and its account, region, instance type and tags.
* **Metrics**: CPU, memory, load averages, disk use by mount, network throughput and swap, over the time range you pick.
* **Logs**: its 100 most recent log lines.
* **Network**: throughput by interface.
* **Processes**: a count of processes by state, when process counts are turned on.
* **Agent**: the collector on the host, its version, policy and configuration revision.

The time range, 15 minutes by default, applies to the charts, logs and network rates. Status and the current CPU, memory and disk values always show the latest report.

## Containers

**Infrastructure › Containers** lists the containers running in your Kubernetes clusters and on Docker hosts, with their status, image, restarts, CPU and memory. Docker containers come from the **Docker** integration, which reads stats from the Docker socket. Select a Kubernetes container to open its pod in the Kubernetes explorer. The **Map** tab draws containers grouped by namespace, cluster, pod, image or source.

**Infrastructure › Container Images** lists each image and tag with the containers, pods and clusters running it.

## Kubernetes

### Install in a cluster

The collector runs in a cluster as a DaemonSet, one pod on every Linux node, installed with Helm. In the console, open **Collectors**, select **Deploy collector** and choose **Kubernetes** to get the commands for your workspace and policy. See [Install the Tracix Collector](https://tracix.io/docs/collect/collector/install).

The **Kubernetes** integration in the collector's policy decides what is collected:

| Section               | What it collects                                                                                     |
| --------------------- | ---------------------------------------------------------------------------------------------------- |
| Cluster metrics       | Cluster, node and workload state                                                                     |
| Pod & container usage | CPU and memory per pod and container, against requests and limits                                    |
| Object inventory      | Object manifests, every 60 seconds                                                                   |
| Cluster events        | Kubernetes events                                                                                    |
| Network flows         | Connections between pods, with throughput, retransmits and round-trip time. On by default.           |
| Container logs        | Pod logs. The Helm release must allow it, which the console's command does when the policy needs it. |

Set **Cluster name** so every signal carries `k8s.cluster.name`, and use the same name as your EKS, AKS or GKE cluster so cloud discovery can match it.

### Explore a cluster

Open **Infrastructure › Kubernetes**. Its tabs are:

* **Overview**: counts of clusters, nodes, pods, pending or failed pods, namespaces and restarts, with pods per namespace and the pods that restart most.
* **Explorer**: pods, nodes, namespaces, clusters, workloads (deployments, replica sets, stateful sets, daemon sets, jobs and cron jobs) and services. Add endpoints and persistent volume claims under **Objects** in the Kubernetes integration. Group pods by namespace, node, workload, status or cluster, and open an object for its **Overview**, **Metrics** (for pods and nodes), **YAML** and **Events**.
* **Utilization**: each pod's CPU or memory use against its requests and limits, with its idle capacity, and how many pods have no requests or limits set.
* **Map**: pods or nodes as hexagons, filled by status, by CPU and memory use against limits or allocatable capacity, or by restarts.
* **Network**: throughput, retransmits and round-trip time between pods, grouped by service, namespace, host, IP or port, with a table of conversations.

With a time range of 15 minutes or less, the views show the cluster as it is now, and an object that has not reported for 5 minutes counts as gone. Wider ranges show everything that reported in the range.

> **Some kinds stay empty for now**
>
> The Explorer also lists kinds such as ingresses, network policies, persistent volumes, storage classes, RBAC objects and custom resources. The collector does not collect those yet, so they show as empty.

## Cloud accounts

Tracix discovers the resources in your AWS, Azure and Google Cloud accounts from its own cloud gateway, with read-only credentials you provide. Nothing is installed in your accounts.

### Connect an account

**1. Start the wizard**

Open **Integrations** and select **Connect account**, then pick **AWS · Auto-discovery**, **Azure · Auto-discovery** or **GCP · Auto-discovery**. Choose **Agentless** collection.

**2. Give it read-only access**

* **AWS**: choose **Cross-account IAM role (recommended)**. Create a role in your account that trusts the principal shown in **Trust this Tracix principal**, with the **External ID** condition, grant it read-only access and paste **Your role ARN**. A **Static access key** works too.
* **Azure**: enter the **Subscription IDs** and a service principal's **Directory (tenant) ID**, **Application (client) ID** and **Client secret**. Give the service principal the Reader role on the subscriptions.
* **Google Cloud**: enter the **Project IDs** and upload the JSON key of a service account with the Viewer role.

**3. Review and connect**

Choose the services and regions to scan, review and connect. Discovery scans every 5 minutes, in all regions by default.

| Provider     | Discovered resources                                                                                                               |
| ------------ | ---------------------------------------------------------------------------------------------------------------------------------- |
| AWS          | EC2, RDS, load balancers, S3, Lambda, ECS, EKS, CloudFront and Route 53, plus more types through Cloud Control when you turn it on |
| Azure        | Virtual machines, networking, Azure SQL, load balancers, storage, Functions, AKS, CDN and DNS                                      |
| Google Cloud | Compute Engine, Cloud SQL, load balancing, Cloud Storage, Cloud Functions, Cloud Run, GKE, Cloud CDN and Cloud DNS                 |

Discovery gives you the inventory. For cloud metrics and logs, add the **AWS** integration for CloudWatch metrics and logs, or the **Azure** integration for Azure Monitor metrics. Google Cloud metrics and logs arrive only through a Pub/Sub subscription you export them to, with the **GCP** integration.

### Browse cloud assets

Open **Infrastructure › Cloud**. **Assets** shows one card for each account, with its regions and resource count. Open an account to see its network layout, its security groups and what is exposed to the internet, a filterable list of resources, and its container services. **Export PDF** saves the view.

Tracix matches discovered instances to the hosts your collectors monitor, by instance ID, resource ARN, or host name and private DNS name, and clusters by cluster name. A matched resource shows **Monitored by Tracix**, with links to the host and the services that ran on it.

## Next steps

- [Metrics and dashboards](https://tracix.io/docs/observe/dashboards): Chart any metric and build dashboards

- [Monitors and templates](https://tracix.io/docs/alerting/monitors): Alert on host, Kubernetes and network metrics

- [Cloud integrations](https://tracix.io/docs/collect/cloud): All cloud integrations and what they collect