> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/tracer.md).

# Tracer

With Enginsight's Tracer feature, you can set up Machine Learning (ML)-based time-series analysis for specific metrics on your hosts. Each [tracer](/docs/manual/english/platform-usage/hosts/tracer.md) creates and trains [ML models](/docs/manual/english/platform-usage/hosts/tracer/models.md) that automatically detect deviations from a calculated normal state, which may indicate an attack.

***

## Requirements

**Training period**

* **At least seven days of data** are required so that an ML model can identify time-based patterns and detect anomalies based on them. We recommend a data basis of at least four weeks for reliable anomaly detection.
* If the data horizon for your models is still **shown as insufficient** after several days, this may be due to a log-entry retention period (time to live; TTL) in the Enginsight component Loggernaut that is set too short. In this case, you must extend the TTL accordingly.

{% hint style="success" icon="lightbulb" %}
For more information on how to change the retention periods for Enginsight log entries, see our Knowledge Base: [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)
{% endhint %}

***

## Important Notes

* The metric defined in the Tracer is used to train the ML models for the assigned hosts. For this reason, once a Tracer has been created, you can only change its display name and the assigned hosts or host groups. If you want to monitor a different metric, you must [add a new Tracer](/docs/manual/english/platform-usage/hosts/tracer/tracers/add-tracer.md).
* If the Tracer is deleted, all previously measured values that the associated ML model used to calculate the baseline and detect anomalies are also deleted. Training a new ML model with a new Tracer will again take at least seven days to establish a reliable data basis for the calculation.

***

## Tracer: Menu Structure

Under **Hosts** → **Tracer**, you will find various options for setting up ML-based time series analyses for your hosts. This helps detect deviations from the normal value that may indicate an attack.

<i class="fa-computer-mouse">:computer-mouse:</i> Click the **Tracer** menu item to expand or collapse the corresponding submenu.

The following submenu items are available:

{% columns %}
{% column width="33.33333333333333%" %}

<figure><img src="https://2423388680-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FV7OrHgKXA0t1jankQBYf%2Fuploads%2FhwRH7aicxBEHsEDyEp6d%2FEnginsight-EN-Menu-Hosts-Tracer.jpg?alt=media&amp;token=564a89ec-7819-43f2-98df-62b033e4f824" alt=""><figcaption></figcaption></figure>
{% endcolumn %}

{% column width="66.66666666666667%" %}

* [Tracers](/docs/manual/english/platform-usage/hosts/tracer/tracers.md)
* [Models](/docs/manual/english/platform-usage/hosts/tracer/models.md)
  {% endcolumn %}
  {% endcolumns %}

<i class="fa-grip-dots-vertical">:grip-dots-vertical:</i> Click and hold the **Tracer** menu item to move it, including all submenu items, within the menu tree using drag and drop.

***

## Further Resources

**Knowledge Base**

* [How can I adjust the retention periods for my Enginsight logs?](https://docs.enginsight.com/docs/knowledge-base/english/logging/how-can-i-adjust-the-retention-periods-for-my-enginsight-logs)

***