Observability

Observability is where administrators and data teams watch the platform: its health, the SQL queries that run on your data, the logs of activity and scheduled email alerts. Use this page to find the right tab, see which permission opens it, and learn how periods, filters and exports behave across the section.

Open a tab

In the sidebar, click Observability.
In the row of tabs at the top of the page, click the tab you need.

The row shows only the tabs you may open. Each tab has its own web address, so you can bookmark a view or share it with a colleague who holds the same permissions.

The section's two monitoring cards, System Overview (Real-time system memory usage) and Service Overview (Service metrics and detected incidents), open those views directly.

An address carries what you have open: the metric on System Overview, the item open in Query Management, the view inside ClickHouse, the mode on Mind Analytics, or an individual alert. Older addresses keep working: one ending in audit-logs opens Logs, and ones ending in running-queries, database-overview or table-ddl-logs open the ClickHouse views Queries, History and DDL log. The address is rewritten to the current form when it opens. On System Overview, cache in the address means RSS + Cache, and an unknown metric falls back to RSS.

What each tab shows

Tab	What it shows	Permission that opens it
System Overview	Memory, CPU and storage use of the platform and each service over time, with incidents.	View System Overview
Query Management	The history of SQL queries run on the database, with views for repeated, failed and resource-heavy queries.	View Query Management
ClickHouse	Queries running now, merges, mutations, view refreshes, memory, storage, history and the DDL log.	Depends on the view, see below
Logs	Audit, SSO, AI, socket, PII and notification logs.	View Audit Log
Mind Analytics	Mind usage by Mind, user and role.	View Mind Overview
Live Metrics	Memory, storage and service health, live.	View Dashboard
Alerts	SQL queries that run on a schedule and email people when their conditions are met.	Any one of Create Alerts, Notify Others With Alerts, View Everyone's Alerts or Manage Everyone's Alerts

Each view in ClickHouse needs its own permission. Most views need View Active Queries. History needs View Database Overview, and DDL log needs View Table DDLs. The Queries view is described in Running queries.

Each sub-tab in Logs needs its own permission as well:

Audit needs View Audit Log.
SSO Logs needs View SSO Login Logs.
AI and Sockets need View AI Logs.
PII needs View PII Logs, which sits in the PII permission category.
Notifications needs View Notification Logs.

For more on each tab, read:

System Overview and Live Metrics for platform health, and Service Overview for one service's incidents.
Query Management, Running queries, ClickHouse activity and ClickHouse storage and maintenance for queries and the database.
Audit, sign-in and notification logs, SSO login logs, AI, socket and PII logs, Socket logs, PII detection logs and Table DDL logs for the logs.
Mind Analytics for Mind usage.
Create an alert and Manage alerts for alerts.
Platform services and Platform container logs for the platform's own services and their logs.

Lineage is a separate item in the sidebar, not a tab of Observability. See Lineage. When something goes wrong, see Observability troubleshooting.

Who can see what

Observability has two high-level presets in the Observability category of roles:

Preset	What it allows
Observability Administrator	Viewing every tab, plus stopping running queries, ClickHouse maintenance, exporting the logs, and managing alerts, including the alerts of other users.
Observability Viewer	Viewing every tab except Alerts. It cannot stop queries, run maintenance, or export the audit, SSO, notification and DDL logs or the query log.

Neither preset includes the PII log permissions. See AI, socket and PII logs.

Some actions have their own permissions, so you can grant them on their own:

Stop Active Queries stops running queries and kills mutations.
Manage ClickHouse Maintenance merges parts into partitions and empties staging tables.
Export Audit Log exports the audit log and the query log.
Export SSO Login Logs, Export Notification Logs, Export Table DDLs and Export PII Logs export their own logs.

Roles are set up in Roles and permissions. The full list is in the Permission reference.

Periods, filters and exports

The log and query tables share one toolbar.

Open a table, for example Logs > Audit.
Set Period next to the search box: Today, Last 7d, Last 30d or Custom.
Type in the search box or filter the columns. To clear a column filter, click Reset in that filter.
To reload the table, click the refresh button. Its tooltip reads Refresh data.
To export, pick a format in the export control, then click the download icon next to it. Its tooltip reads Download as and the format. The export needs the export permission for that log, for example Export Audit Log.

Setting	What it does	Default
Period	Sets the time window of a log or query table.	Last 7d
Custom	Lets you pick a start and end date for the period.	Not set
Export format	CSV, Excel, JSON or TSV. The format you pick becomes your default for later exports. The AI log exports as JSON only.	Excel

Observability also remembers your last tab, your Period and some sub-tab choices in your browser. These choices do not follow you to another browser or device.

The full detail of these shared controls, including rows per page and how the date pickers work, is in Periods, filters and exports and Date and period pickers.

Limits and edge cases

A custom period can be at most one year in most tables and charts. A longer range shows Date range too large, with the message "Custom date range cannot exceed 1 year."
An export of a log or query table contains at most 300,000 rows. To get more, narrow the Period or add filters, and export in parts.
If a table fails to refresh after it has loaded, it stays on screen with an error bar that gives the reason and a Retry button.
If a shared link points to a tab you cannot open, Observability opens the first tab you may see instead.
If you open Observability without a tab in the address, it opens the tab you used last, if you can still see it. Otherwise it opens the first tab you may see.
If none of the tabs is open to you, Observability is not in the sidebar, and a direct link sends you to the unauthorised page.

Questions, answered

Why don't I see Observability in the sidebar?

Your roles hold none of the permissions that open a tab. Ask an administrator for the permission of the tab you need, for example View System Overview or Create Alerts.

Why do I see only some tabs?

Each tab needs its own permission. Tabs you cannot open are hidden, and the page opens the first tab you may see.

A colleague sent me a link to a tab, but I land on another tab. Why?

You do not hold the permission for the linked tab, so Observability opens the first tab you may see.

What is the difference between Observability Viewer and Observability Administrator?

The Viewer preset lets you look at every tab except Alerts, but you cannot stop queries, run maintenance or export most logs. The Administrator preset adds those actions and full alert management. Neither includes the PII log.

Why is the Mind Analytics tab missing although I have View Mind Overview?

Your installation can turn off the Mind Analytics tab. When it is off, nobody sees it, whatever their permissions are.

How far back can I search?

Pick Custom in Period and choose a range of up to one year. To search further back, choose another range.

My export stops at 300,000 rows. Is that a limit?

Yes. An export of a log or query table contains at most 300,000 rows. Narrow the Period or add filters, and export in parts.

I have an older link to Observability. Does it still work?

Yes. An address ending in audit-logs opens Logs, and ones ending in running-queries, database-overview or table-ddl-logs open the matching ClickHouse views. The address is rewritten to the current form when it opens.