5.7 KiB
Events Tab
The Events tab provides a powerful feed that tracks key activities across your infrastructure and Space. It helps you investigate historical events, making it easier to correlate changes with anomalies or node behavior.
Use the Events feed to:
- Quickly identify what happened before or after a node went offline.
- Attribute sudden metric changes to specific environment events.
- Access a detailed history of alert transitions and node state changes.
:::note
Based on your Space plan, the time range available for querying past events may vary.
:::
Available Event Domains
The Events feed provides visibility into the following event types:
| Event Domain | Community | Homelab | Business | Enterprise On-Premise |
|---|---|---|---|---|
| Auditing events | 4 hours | 90 days | 90 days | User-dependent |
| Topology events | 4 hours | 14 days | 14 days | User-dependent |
| Alert events | 4 hours | 90 days | 90 days | User-dependent |
Auditing Events
These events log user actions and Space configuration changes:
| Event Name | Description | Example |
|---|---|---|
| Space Created | A new Space was created. | Space Acme Space was created. |
| Room Created | A Room was added to the Space. | Room DB Servers was created by John Doe. |
| Room Deleted | A Room was removed from the Space. | Room DB Servers was deleted by John Doe. |
| User Invited to Space | A user was invited to join the Space. | User John Smith was invited by Alan Doe. |
| User Removed from Space | A user was removed from the Space. | User John Smith was removed by Alan Doe. |
| Silencing Rule Created | A new silencing rule was added. | Silencing rule DB Servers schedule silencing was created by John Smith. |
| Silencing Rule Changed | An existing silencing rule was modified. | Silencing rule was changed by John Doe. |
| Silencing Rule Deleted | A silencing rule was removed. | Silencing rule was deleted by Alan Smith. |
Topology Events
These events track changes to node connectivity and state:
| Event Name | Description | Example |
|---|---|---|
| Node Became Live | Node started streaming metrics to Cloud. | Node netdata-k8s-state-xyz is live. |
| Node Became Offline | Node stopped streaming metrics, fully offline. | Node ip-xyz.ec2.internal is offline. |
| Node Created | Node was created but not yet seen by Cloud. | Node ip-xyz.ec2.internal was created. |
| Node Deleted | Node was hard deleted from the Space. | Node ip-xyz.ec2.internal was deleted (hard). |
| Agent Connected | Agent connected to the Cloud server (MQTT link). | Agent 7d87bqs9-cv42-4823-8sd4-3614548850c7 connected. |
| Agent Disconnected | Agent disconnected from the Cloud server. | Agent disconnected due to Connection Timeout. |
Alert Events
These events log alert state transitions for node metrics:
| Event Name | Description | Example |
|---|---|---|
| Node Alert State Changed | Records state changes such as Cleared, Warning, Critical, Removed, Error, or Unknown. | Alert httpcheck_web_service_bad_status on node netdata-parent-xyz escalated to CRITICAL with value 25%. |
Who Can Access Events?
| User Role | Event Domains Accessible |
|---|---|
| Administrators | All event domains (Auditing, Topology, Alerts). |
| Non-administrators | Topology and Alerts only. |
:::note
See the Role-Based Access model for details.
:::
How to Use the Events Feed
- Click the Events tab.
- Define the timeframe using the Date and Time selector.
- Apply filters from the right-hand bar, such as event domain, node, alert severity, or time range, to focus on the data you need.
:::note
If your query exceeds the retention limits of your plan, an error will indicate that the requested data is outside your allowed timeframe.
:::