Observability¶

Pixee Enterprise Server provides comprehensive observability tools to help you monitor and understand your deployment's behavior.

Available Tools¶

Metrics & Dashboards¶

Monitor real-time metrics and visualize system performance with custom dashboards. Track AI service performance, per-finding task metrics, and more.

Learn more about Metrics →

Logs & Debugging¶

Access pod status, view application logs, and query centralized logs with VictoriaLogs. When local metrics is enabled, logs from all Pixee components are automatically collected and searchable via the VictoriaLogs VMUI.

Learn more about Logs & Debugging →

Pod Log Storage¶

Understand where kubelet writes container output on disk, why that placement decides whether a runaway container can fill a volume unnoticed, and how to relocate it — at install time or on a running cluster.

Learn more about Pod Log Storage →

Traces¶

Inspect distributed traces from the analysis service with VictoriaTraces. When local metrics is enabled, trace telemetry is automatically collected, allowing you to search by service name, trace ID, or span attributes.

Learn more about Traces →

Programmatic Access with the Pixee CLI¶

The metrics, logs, and traces backends are also reachable over HTTP under the /o11y/ path, protected by your deployment's built-in identity provider (Authentik). The Pixee CLI authenticates you and mints a short-lived, per-user token so you can query observability data from scripts or a coding agent — no shared API key to manage.

Authenticate once per deployment using the OAuth2 device flow:

pixee auth login --server https://pixee.example.com

This opens your browser to sign in through your identity provider, then caches an access token and refresh token locally (file permissions 0600). Retrieve a currently-valid bearer token at any time — it refreshes automatically — and pass it to the observability HTTP APIs:

TOKEN=$(pixee auth token --server https://pixee.example.com)

# Logs (VictoriaLogs / LogsQL)
curl -sG -H "Authorization: Bearer $TOKEN" \
  https://pixee.example.com/o11y/logs/select/logsql/query \
  --data-urlencode 'query=_time:1h | limit 100'

# Metrics (VictoriaMetrics / PromQL)
curl -sG -H "Authorization: Bearer $TOKEN" \
  https://pixee.example.com/o11y/metrics/prometheus/api/v1/query \
  --data-urlencode 'query=up'

# Traces (VictoriaTraces / Jaeger API)
curl -s -H "Authorization: Bearer $TOKEN" \
  https://pixee.example.com/o11y/traces/select/jaeger/api/services

Use pixee auth status to check your session and pixee auth logout to clear it. Because authentication goes through your identity provider, each person queries as themselves and access is governed by your existing IdP policies.

Note

Programmatic observability access requires the observability stack (local metrics) to be enabled on your deployment — see Enabling Local Metrics. --server may be omitted once you have logged in, in which case the stored server is used.

Getting Started¶

For most operational tasks, you'll need:

kubectl access to your cluster
SSH access to the cluster host (for Embedded Cluster deployments)
Knowledge of your deployment namespace:
- Embedded Cluster: kotsadm
- Helm Deployment: pixee-enterprise-server