Tracer

With a host tracer, you can collect and analyze local system metrics such as CPU utilization, memory consumption, or process activity as time series. This allows you to directly identify and evaluate performance and behavior changes of individual hosts.

You can access the view via: Hosts - Tracer.

Tracer

You can access the view via Hosts - Tracers - Tracers:

In this view, you will find all tracers created so far, as well as information about assigned references and field names on which the data analysis is based.

Edit or delete individual entries by clicking on the respective icon in the corresponding row.

Add Tracer

Click on the “+Add Tracer” button to create a new tracer. This will take you to the following page:

1. Name Assign a unique name.

2. Description Enter a brief description of your model.

3. Field Name The field name determines which field of the selected stream the aggregation is applied to.

4. Aggregator The aggregator represents the calculation method for the source field to be defined below.

   Depending on the data type of the selected field, not all aggregators are useful or available. Numeric fields are suitable for calculating averages or sums, for example, while text fields can usually only be used for unique or counted values.

   Choose from the options:

   1. Average Calculates the average of all values in the source field within the defined time interval.

   2. Minimum Determines the smallest value recorded within the interval.

   3. Maximum Finds the largest value recorded within the interval.

   4. Sum Adds up all values in the field for the respective time interval.

5. Assigned references Specify which hosts the tracer applies to. The data collected and analyses performed relate exclusively to the systems assigned here. Specify individual hosts explicitly or use assigned tags for automatic assignment.

   1. Hosts Clicking on the Hosts field opens an overview of existing hosts. Use the free text input field or click on entries in the overview to add them.

   2. Tags

      1. Tag logic

         Tag logic determines which hosts are considered by the tracer based on the tags selected below.

         1. All tags are present in the reference Only hosts that have all specified tags are included.

         2. At least one of the specific tags is present All hosts that have at least one of the specified tags are included.

      2. Tags Clicking on the “Tags” field opens an overview of existing tags. Use the free text input field or click on entries in the overview to add them.

6. Define exceptions Click on the “Define exception” button to exclude specific references from the observation. The following view will then open:

   

   1. Hosts Clicking on the Hosts field opens an overview of existing hosts. Use the free text input field or click on entries in the overview to explicitly exclude them.

   2. Tags

      1. Tag logic Tag logic determines which hosts are excluded from the tracer based on the tags selected below.

         1. All tags are present in the reference Only hosts that have all specified tags are excluded.

         2. At least one of the specific tags is present All hosts that have at least one of the specified tags are excluded.

      2. Tags Clicking on the “Tags” field opens an overview of existing tags. Use the free text input field or click on entries in the overview to add them.

7. Add Tracer Save the tracer with the desired configurations. To do this, click on the “Add Tracer” button.

Models

The models display the analyses based on a tracer. Each tracer can be assigned to multiple references (e.g., hosts or tags), for each of which a separate model is generated. Each model thus shows the individual time series analysis per assigned reference based on the underlying tracer.

You can access the view via Host - Tracer - Models:

In this view, you will find all created models as well as information about their status, reference, field name, and whether they are active or inactive.

Edit or delete individual entries by clicking on the corresponding icon in the relevant row.

Click on the box to select one or more entries from the list. Then use the “Action” button. This allows you to activate or deactivate the previously selected models.

Detailview

Click on an entry in the model overview to view details.

General Information

The view shows the name of the model, the referenced hosts, and the field name on which the analysis is based.

These values cannot be changed in the model detail view. Adjustments can only be made centrally in Tracer.

Graphs

Time series progression

This view shows the progression of the monitored metric over time. The line represents the measured value, while the highlighted area indicates the confidence interval, i.e., the expected value range. Deviations outside this range are identified as potential anomalies.

Click on “Show details” to display additional time series for standard deviation and rating:

• Standard deviation Shows how much individual values deviate from the expected average within a time interval. A high standard deviation indicates irregular or unusual behavior of the monitored metric.

• Score Represents the anomaly score that evaluates the criticality of the detected deviation. The thresholds displayed (Low, Medium, High, Critical) indicate the score value at which an anomaly is classified as relevant.

Time series variation

This view shows the variance or fluctuation of the monitored metric. It shows how much the values differ from the expected average within a time interval. Here, too, the confidence interval marks the expected fluctuation range, and the retraining time signals an update of the model to improve detection accuracy.

Click on “Show details” to display additional time series for standard deviation and evaluation:

• Standard deviation Shows how much individual values deviate from the expected average within a time interval. A high standard deviation indicates irregular or unusual behavior of the monitored metric.

• Score Represents the anomaly score that evaluates the criticality of the detected deviation. The thresholds displayed (Low, Medium, High, Critical) indicate the score value at which an anomaly is classified as relevant.

Anomalies

The Anomalies tab lists all deviations detected by the tracer model that fall outside the expected value range. Each anomaly contains information on severity, source, and start and end time of the detected deviation.

Severity Shows the classification of the anomaly (e.g., Low, Medium, High, Critical). This is based on the calculated anomaly score and the thresholds defined in the model.

Name Specifies the analysis area (e.g., time series fluctuation or time series progression) in which the deviation was detected.

Start date / End date Specify the exact time period during which the anomaly occurred.

Editing a model

In the top menu bar, you can adjust the advanced settings and the start and end times for your model. To do this, follow these instructions:

Advanced Settings

You will find the “Advanced Settings” button at the top right of the screen. Click on it to customize the model in more detail.

1. Time series progression

   1. Threshold for Anomaly Detection Defines the quantile at which a deviation is considered an anomaly. A lower value makes the model more sensitive, while a higher value reduces false alerts.

   2. Grace Period Determines the amount of time that elapses after an event before an analysis or action is performed. This helps to ignore short-term fluctuations and avoid false alerts.

2. Time series variation

   1. Threshold for Anomaly Detection Specifies the deviation from the expected fluctuation at which an anomaly is detected. The value is interpreted as a percentage of the calculated reference range.

   2. Grace Period Defines how long to wait after a fluctuation is detected before triggering a new analysis or action. This filters out short-term highs or lows.

3. Save advanced settings Click the “Apply” button to save your configuration.

Start- and End period

Clicking on the “Start time” or “End time” button opens a window for manually selecting the analysis period. Here you can specify the period over which the underlying data is to be viewed or calculated.

1. Relative time period A relative time period refers dynamically to the current time, e.g., “last 24 hours” or “last 7 days.” The time period under consideration shifts automatically as time progresses.

   

   1. Enter a number and then specify the time period.

   2. Click on the arrow icon to choose from the available options:

      1. Seconds ago

      2. Minutes ago

      3. Hours ago

      4. Days ago

      5. Weeks ago

   3. Then click Apply to save the configuration for your model.

2. Templates

   1. Click on an entry from the templates to select a relative time period from the options:

      1. 1 day ago

      2. 7 days ago

      3. 14 day ago

      4. 30 days ago

   2. Then click "Apply" to save the configuration for your model.

3. Absolut time period An absolute time period is defined precisely, e.g., from October 1, 2025, to the current date. It remains unchanged and always refers to exactly this period.

   

   1. Calender

      1. Use the arrows to navigate through the months and years.

      2. Then click on the desired date.

   2. Time

      1. Click on the “Time” button. The following window will open:

         
      2. By clicking on the digitally displayed hour or minute display, you can switch between the displays and thus define the hour or minute specifically in the following.

      3. Then click on the desired minute or hour on the clock shown.

      4. Then click Apply to save the configuration for your model.