Service Overview

Service Overview follows one service's memory, CPU or storage use over time and marks the incidents detected in the period. Use it to see when a service rose well above its usual level, and to open one incident and read its start, peak and duration.

Open a service's overview

1. Open Observability and click the Service Overview card (Service metrics and detected incidents).
2. In the services list on the left, pick the service you want to follow.
3. Above the chart, choose a metric (RSS, RSS + Cache, CPU or Storage) and set Period and Interval.

The toolbar works like the one on System Overview.

Read the incident chart

• The chart draws the metric's Max, Avg and Min values over the period.
• For RSS, RSS + Cache and Storage, the chart also shades each detected incident and adds an Incidents item to the legend. With CPU, incidents are not detected, so there is no shading and no Incidents item.
• Two dashed lines mark the baseline average and the spike threshold; they appear for RSS, RSS + Cache and Storage.
• Hover the chart to highlight the incident under your cursor. When incidents overlap, hovering cycles through them.
• Click to zoom into the highlighted incident. The click works even when it lands on a chart line.
• Clicking the same point again clears the selection. The highlight clears when you move the cursor away only if nothing is selected.
• Changing Period, Interval or the metric resets the hover and any selection.
• If the service has no samples for the period and interval, the chart shows No data available; if it cannot load, it shows Failed to load timeline with the reason. See Observability troubleshooting for the messages in this section.

Zoom into an incident

1. Click a shaded incident on the chart, or click a row in the incident list.
2. Read the eight cards above the chart: Start, End, Duration, Peak, Peak At, Peak Dev, Baseline and Readings.
3. Read the chart. Readings above the spike threshold appear as anomaly dots; hover one to see its value and its deviation, for example Anomaly (2.4σ). The dashed lines mark the spike threshold and the baseline average.
4. Click the back button at the top right to return to that service's incidents; it is labelled with the service name.

While the readings load, the view shows Loading metric.

Read the incident list

• When the service had incidents in the period, a list of them appears under the services list. Each row is numbered, for example Incident 1, and shows a duration chip, the peak value and the start time.
• A sustained incident shows its full start to end span instead of a single start time.
• The Critical, Warning and Total cards count incidents by severity. Click a card to filter the list to that severity; the active card shows a pulsing dot.

Incident types and severity

• An incident is a period when the metric rose well above its usual level.
• Spikes are shown in the error colour; sustained incidents in the warning colour.
• Severity is critical or warning, shown as a badge in the zoom view.

Questions, answered

What is the difference between a spike and a sustained incident?

They are the two incident types. A spike is shown in the error colour and shows its start time in the list. A sustained incident is shown in the warning colour and shows its full start to end span.

What does Peak Dev mean?

Peak Dev shows how far the peak sat from the service's baseline, in standard deviations (σ). A value of 2.4σ means the peak was 2.4 standard deviations above the baseline.

What are the two dashed lines on the chart?

They mark the baseline average (the service's usual level) and the spike threshold; they appear for RSS, RSS + Cache and Storage. On the zoom chart, readings above the spike threshold are shown as anomalies.

How do I leave the zoom view?

Click the back button at the top right of the view; it is labelled with the service name. You return to that service's incidents, and you can pick another one.

Why does the highlighted incident change while I hover?

When incidents overlap on the chart, hovering cycles through the ones under your cursor, so you can reach the one you want. Click to zoom into whichever is highlighted.

Why is there no incident list for my service?

The list appears only when the service has at least one incident in the selected period. If it is empty, no incident was detected; widen the period to look further back.

Why can't I see a chart in the zoom view?

If the readings cannot load, the view shows Failed to load zoom data with the reason. If the incident has no readings for its window, it shows No timeline data with "The incident detail response did not include any chart points for this window." Go back to the service and pick another incident.

Can I see more than one service at once?

No. This screen follows one service at a time. To watch the whole platform, use System Overview.