Monitoring the deployment

What to watch so that a problem in the platform is noticed before a customer notices it.

In the console

  • Settings › System shows ingest rates and lag, parser coverage, detection and response activity, fleet state, replication and storage.
  • Settings › Integrations shows each pull connector's events in the last hour, its last event and its last poll or error.
  • Route the Agent went silent notification to an on-call channel.

On the host

  • docker compose ps: every service up and healthy.
  • xenxdrctl status prints the same picture as Settings › System.
  • The health endpoint on the gateway hostname, /api/health, which also reports the number of connected agents.
  • Disk usage on the data volume. Set an alert in your infrastructure monitoring at 80 percent.