Explore telemetry with Insights

Beta

The ITRS Agentic SRE app is currently available as a beta release. Features, behavior, and documented procedures are subject to change without prior notice during ongoing development. For how to open the chat and choose an agent, see Use Agentic SRE for operations and support in ITRS Analytics.

You can use the Agentic SRE chat functionality to see the logs, metrics, severity changes, and traces for an entity you are investigating. The Insights agent places those records on screen. A chart, grid, timeline, or traces is the data that was returned.

Use case and benefits Copied

Use this when you need the records behind a condition: the log lines, the instant a severity changed, a metric over the period you name, or where a request spent its time.

• You see the records the platform holds. Each chart and table names the check it came from, so you can open that check and compare the values.
• The period you name is the period that is searched. If a metric series is shortened, the answer states the window that was returned and says the request was cut short.
• A follow-up that refers to the current subject stays on the entity from the previous turn. After a question about one gateway, “Find the errors in its logs” and “When did this start?” are about that gateway.
• An empty result names the source, the time window, and the filters. You can tell missing data from a check that could not run, and from an entity that does not publish that kind of telemetry.

This is separate from the other ways to use the chat:

• A question about why something broke is root cause analysis. Insights shows what is there. It does not commit to a cause. See Perform root cause analysis.
• A question about how to configure the product is answered from documentation. “How do I set it up?” stays a documentation question even after you have been looking at an entity. See Get product and setup guidance.
• A question about whether something is healthy is a status summary, with an entity tile built from the checks that were run. A signal name in the tile matches the name in ITRS Analytics.

Explore telemetry with Insights Copied

1. Open the AI chat. Add the entity to the prompt, or name it in the question. For how to add an entity, see Add entity context to a prompt.

2. Ask to see the records. For example, ask for the logs, the errors in those logs, when the condition started, a metric over a period, or the traces for a service and where the time goes.

3. Read the answer while it is still running. The chat says which direction it is taking, then lists each check with the arguments it sent and what came back.

4. Read the view in the completed answer. It can be a metric chart, a severity timeline, a log grid, or a trace waterfall. If a deployment cannot draw one of these views, the same information is shown as a table. In this example, the Server Status metric chart is opened.

5. Continue on the same entity. Ask a follow-up such as “Find the errors in its logs” or “When did this start?”. On a severity timeline, select a band to fill the prompt with a follow-up for that signal and that window. The filled question uses UTC timestamps so the time range can be read exactly.

6. If the result is empty or partial, use the source, window, and filters named in the answer. See Read an empty or partial answer.

In most cases, you can send these questions through SRE and let it direct the request to Insights.

To request a platform-wide summary without entity context, state explicitly that you want an overview of the system or environment. When nothing is selected and the question names no entity, an exploratory question starts from the health of the environment, takes the entities that are in trouble, and then answers the question against the worst of them.

If Insights cannot resolve the entity named in a request, refine the entity reference or try the request again instead of relying on a platform-wide summary.

What the answer can show Copied

Expand table

The span’s own time is its duration minus the time spent in the spans it called. Traces are returned slowest first.

A parent entity often publishes no logs of its own. When you ask for the logs of a Geneos gateway or probe, the answer uses the log sources published by the entities beneath it. In a log question, “errors” means the severity the platform assigned to each line, not a search for the word “error”.

Times in the answer text and in these views use the date format, time format, and time zone from your ITRS Analytics user settings. Each time includes the zone abbreviation, so you can compare it with a log line that uses a different zone.

When you reopen the conversation, the charts, grids, timelines, and entity tiles remain in the answer.

Read an empty or partial answer Copied

An empty result names the source, the time window, and the filters that were applied. Use that to tell these cases apart:

• The data is not there for that source and window.
• The check could not be run.
• The entity does not publish that kind of telemetry.

If you ask for traces from an entity that publishes none, the answer says that it publishes none. It does not substitute a metric chart.

If a reply did not check your telemetry, it says that nothing above was checked.

A long investigation can reach the limit set for one conversation. The answer then includes what was found, and a line that the conversation has reached its budget, so the agent stopped. The line names the limit that was reached. Anything above that line is what it had established. Start a new conversation to continue. A later question in the same conversation is not answered, and the chat says so.

Example questions Copied

Substitute your own entity names. A Geneos gateway is a useful subject for log questions, because the answer has to find the log sources beneath the gateway.

Expand table