This the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

  • 1:
    • 2:
      • 3:
        • 4:
          • 5:
            • 6:
              • 7:
                • 8:


                  This feature is available in the Enterprise tier of the Sysdig product. See for details, or contact

                  The Sysdig Monitor web interface centers around the Explore module, where you perform the majority of infrastructure monitoring operations. Explore provides you the ability to view and troubleshoot key metrics and entities of your infrastructure stack. Sysdig Monitor automatically discovers your stack and presents pre-built views in Explore. You can drill down to any layers of your infrastructure hierarchy and view granular-level data. Grouping controls how entities are organized in Explore. Grouping is fully customizable by logical layers, such as containers, Kubernetes clusters, or services.

                  In addition to the Explore interface, Sysdig provides a PromQL Query Explorer and PromQL Library. They help you understand metrics and corresponding labels and values clearly, to create queries faster, and to build Dashboard and Alerts easily.

                  Learn more about using Explore in the following sections:

                  1 -

                  Explore Interface

                  The sections below outline the key areas of the interface and detail basic navigation steps.

                  The C-Frame Structure

                  The image below provides a complete view of the Explore UI in the Sysdig Monitor c-frame style interface:

                  There are several key areas highlighted in the image above:

                  • Product Selector: This allows you to switch between Sysdig products.

                  • Grouping: Groupings are hierarchical organizations of tags, allowing users to organize their infrastructure views using the Grouping Wizard in a logical hierarchy. For more information on groupings, refer to Grouping, Scoping, and Segmenting Metrics.

                  • Modules: Quick links for each of the main Sysdig Monitor modules: Explore, Dashboards, Alerts, Events, and Captures.

                  • PromQL Query Explorer: Run PromQL queries to build your infrastructure views and get an in-depth insight into what’s going on. See PromQL Query Explorer.

                  • Management: Quick links for Sysdig Spotlight, help material, and the user profile configuration settings.

                  • Drill-Down: This allows you to explore deep down the infrastructure stack and retrieve all the components in a certain category in a single organized element.

                  • Search Metrics and Dashboards: Helps you select desired metrics or dashboards.

                  • Time Navigation: Helps you customize the time window used for displaying data

                  • Key Page Actions: Quick links to create events, alerts, and dashboards.

                  2 -

                  Navigate the Explore Interface

                  This section helps you navigate the Explore menu in the Sysdig Monitor UI.

                  Switch Groupings

                  Sysdig Monitor detects and collects the metrics associated with your infrastructure once the agent is deployed in your environment. Use the Explore UI to search, group, and troubleshoot your infrastructure components.

                  To switch between available data sources:

                  1. On the Explore tab, click the My Groupings drop-down menu:

                  2. Select the desired grouping from the drop-down list.

                  Groupings Editor

                  The Groupings Editor helps you create and manage your infrastructure groupings.

                  Use Drill-Down Menu

                  Sysdig Monitor users can drill down into the infrastructure by using the numerous dashboards and metrics available for display in the Explore UI. These displays can be found by selecting an infrastructure object, and opening the drill-down menu.

                  Sysdig Monitor only displays the metrics and dashboards that are relevant to the selected infrastructure object.


                  Sysdig Monitor users can view specific metrics for an infrastructure object by navigating the drill-down menu:

                  1. On the Explore tab, open the drill-down menu.

                  2. Navigate to Search Metrics and Dashboard.

                  3. Select the desired metrics.

                    The metric will now be presented on the Explore UI, until the user navigates away from it.

                    The scope of the metric, when viewed via the drill-down menu, is set to the infrastructure object that you have selected.

                  Troubleshooting Views

                  The drill-down menu displays all the default dashboard templates relevant to the selected infrastructure object. These Troubleshooting Views are broken into the following sections:

                  The scope of the Troubleshooting View, when viewed via the drill-down menu, is set to the infrastructure object that you have selected from the drill-down.

                  To navigate to the Troubleshooting Views:

                  1. On the Explore tab, select an infrastructure object.

                  2. Open the drill-down menu and select the desired infrastructure element

                  3. Navigate to Search Metrics and Dashboard.

                  4. Select the desired troubleshooting view.

                    The selected dashboard will now be presented on the screen, until you navigate away from it.

                  Pin and Unpin the Drill-Down Menu

                  1. On the Explore tab, select an infrastructure object.

                  2. Open the drill-down menu.

                  3. Click Pin Menu to pin the menu to the Explore tab.

                    To unpin the menu, click Unpin Menu at the bottom of the menu.

                  3 -

                  PromQL Query Explorer

                  Use the PromQL Query Explorer to run PromQL queries and build infrastructure views. It allows you

                  • Write PromQL queries faster by automatically identifying the common labels and labels among different metrics.

                    See Run PromQL Queries Faster with Extended Label Set.

                  • Query metrics by leveraging advanced functions, operators, and boolean logic.

                  • Interactively modify the PromQL results by using visual label filtering.

                  • Use label filtering to visualize the common labels between metrics, which is key when combining multiple metrics.

                  About the PromQL Explorer UI

                  The main components of the PromQL Query Explorer UI include widgets, time navigation, and dashboard and time series panel.

                  You’ll find PromQL Explore under the Explore tab on the Sysdig Monitor UI.

                  PromQL Query

                  The PromQL field supports manually building PromQL queries. You can manually enter simple or complex PromQL queries and build dashboards and create alerts. The PromQL Query Explorer allows running up to 5 queries simultaneously. With the query field, you can do the following:

                  • Explore metrics and labels available in your infrastructure.

                    For example, calculate the number of bytes received in a selected host:


                    Calculate the number of bytes received in all the hosts except one:


                    Compare current data with historical data:

                    sysdig_host_net_total_bytes offset 7d
                  • Use arithmetic operators to perform calculations on one or more metrics or labels.

                    For example, calculate the rate of incoming bytes and convert it to bits:

                    rate(sysdig_host_net_total_bytes[5m]) * 8
                  • Build complex PromQL queries.

                    For example, return summary ingress traffic across all the network interfaces grouped by instances

                    sum(rate(sysdig_host_net_total_bytes[5m])) by (container_id)

                  Label Filtering

                  Label filtering to automatically identify common labels between queries for vector matching. In the given example, you can see that A and B metrics have only the host_mac label in common.

                  You can also filter by using the relational operators available in the time series table. Simply click the operator for it to be automatically applied to the queries. Run the queries again to visualize the metrics.

                  Filtering simultaneously applies to all the queries in the PromQL Query Explorer.


                  PromQL Query Explorer supports only time series (Timechart). You can run advanced (PromQL) queries and build dashboard panels. PromQL Explorer does not support building form-based queries.

                  Time Navigation

                  PromQL Query Explorer is designed around time. After a query has been executed, Sysdig Monitor polls the infrastructure data every 10 seconds and refreshes the metrics on the Dashboard panel. You select how to view this gathered data by choosing a Preset interval and a time Range. For more information, see Time Navigation.


                  The legend is positioned on the upper right corner of the panel. Each query will have associated legends listed in the same execution order.

                  Build a Query

                  1. On the Explore tab, click PromQL Query.

                  2. Enter a PromQL query manually.


                    Click Add Query to run multiple queries. You can run up to 5 queries at once.

                  3. Click Run Query or press command+Enter.

                    A dashboard will appear on the screen. You can either Copy to a Dashboard or Create an Alert.

                  Copy to a Dashboard

                  1. Run a PromQL query.

                  2. Click Create > Create a Dashboard Panel.

                  3. Either select an existing Dashboard or enter the Dashboard name to copy to a new Dashboard.

                  4. Click Copy and Open.

                    The new Dashboard panel with the given title will open to the Dashboard tab.

                    You might want to continue with the Dashboard operations as given in Dashboards.

                  Create an Alert

                  1. Run a PromQL query.

                  2. Click Create > Create Alert.

                  3. If you have multiple queries, select the query you want to create the alert for.

                    A new PromQL Alert page for the selected query appears on the screen.

                    Continue with PromQL Alerts.

                  Remove a Query

                  Click the three dots next to the query field to remove the query.

                  Toggle Query Results

                  Click the respective query buttons, for example, A or B, to show or hide query results.

                  4 -

                  PromQL Library

                  PromQL is a powerful language to query metrics, but it could be challenging for beginners. To ease the learning curve of PromQL, Sysdig provides a set of curated examples, called PromQL Library. It helps you perform complex queries against your metrics with one click and get insight into your infrastructure problems which was not previously possible with Sysdig querying. For example, identify containers > 90% limit and counting pods per namespace, and so on.

                  You have the following categories currently to experiment with PromQL:

                  • Kubernetes

                  • Infrastructure

                  • Troubleshooting

                  • PromQL 101

                  Access PromQL Library

                  1. Log in to Sysdig Monitor.

                  2. Click Explore from the left navigation pane.

                  3. On the Explore tab, click PromQL Library.

                    The tab opens to a list of PromQL examples.

                  Use PromQL Library

                  Click Try me to open PromQL Query Explore. A visualization corresponding to the query will be displayed. You can do the following with the query:

                  • Create a dashboard panel

                  • Create an alert

                  See PromQL Query Explorer for more information.

                  To copy a query, click the copy icon next to the query.

                  Filter PromQL Queries

                  Automatic tag filtering identifies common tags in the given examples. You can use the following to filter queries:

                  • Visual label filtering: Simply click the desired color-coded label to filter queries based on tags.

                  • Text search: Use the Text Search bar on the top-left navigation pane.

                  • Label search: Use the Label drop-down list on the top-left navigation pane.

                  • Filter using categories: Use the All Categories checkboxes.

                  5 -

                  Groupings Editor

                  Groupings are hierarchical organizations of labels, allowing you to organize your infrastructure views on the Explore UI in a logical hierarchy.

                  An example grouping is shown below:

                  The example above groups the infrastructure into four levels. This results in a tree view in the Groupings Editor with four levels, with rows for each infrastructure object applicable to each level.

                  As each label is selected, Sysdig Monitor automatically filters out labels for the next selection that no longer fit the hierarchy, to ensure that only logical groupings are created.

                  Sysdig Monitor automatically organizes all the configured groupings that are inapplicable to the current infrastructure under Inapplicable Groupings.

                  Manage Groupings

                  You can perform the following operations using the Groupings Editor:

                  • Search existing groupings

                  • Create a new grouping

                  • Edit an existing grouping

                  • Rename a groupings

                  • Share a grouping with the active team

                  Search for a Grouping

                  1. Do one of the following:

                    • From Explore, click the Groupings drop-down. Search for the desired grouping.

                      Either select the desired grouping, or search for it by scrolling down the list or by using the search bar, and then select it.

                    • Click Manage Groupings and open the Groupings Editor.

                      Either select the desired grouping, or search for it by scrolling down the list or by using the search bar, and then select it.

                  Create a New Grouping

                  1. In the Explore tab, click the Groupings drop-down, then click Manage Groupings.

                  2. Open the Groupings Editor.

                  3. Click Add.

                    The New Groupings page is displayed.

                  4. Enter the following information:

                    • Groupings Name: Set an appropriate name to identify the grouping that you are creating.

                    • Shared with Team: Select if you want to share the grouping with the active team that you are part of.

                    • Hierarchy: Determine the hierarchical representation of the grouping by choosing a top-level label and subsequent ones. Repeat adding the labels until there are no further layers available in the infrastructure label hierarchy.

                      You can search for the label by entering the first few characters in the Select label drop-down or scrolling down. As you add labels, the preview displays associated components in your infrastructure.

                  5. Check the preview to ensure that the label selection is correct.

                  6. Click Save&Apply.

                  Rename a Grouping

                  Renaming is allowed only for groupings that are owned by you. To rename a shared grouping, create a copy of it and edit the name.

                  1. Do one of the following in Explore:

                    • Click the Groupings drill-down. Search for the desired grouping. Click the Edit button next to the grouping.

                    • Click the Groupings drill-down and click Manage Groupings.

                  2. Open the Groupings Editor.

                  3. Either select the desired grouping, or search for it by scrolling down the list or by using the search bar, and then select it.

                  4. Click Edit.

                    The edit window is displayed on the screen.

                  5. Specify the new grouping name, then click Save& Apply to save the changes.

                  Share a Grouping with Your Active Team

                  Custom groupings are owned by you, and therefore you can share them with all the members of your active team. To share a default grouping, create a custom grouping and use the Shared with Team option in the Grouping Editor.

                  1. Click the Groupings drill-down and click Manage Groupings.

                    The Grouping Editor screen appears.

                  2. Highlight the relevant grouping and click Edit.

                  3. Click Shared with Team.

                  4. Click Save &Apply to save the changes.

                  To share a default grouping, create a custom grouping and then use the Shared with Team option in the Grouping Editor.

                  6 -

                  Time Windows

                  By default, Sysdig Monitor displays information in Live mode. This means that dashboards, panels, and the Explore table will be automatically updated with new data as time passes, and will display the most recent data available for the configured time window.

                  By default, time navigation will enter Live mode with a two hour time window.

                  The time window navigation bar provides users with quick links to common time windows, as well as the ability to configure a custom time period in order to review historical data.

                  As shown in the image above, the navigation bar provides a number of pieces of information:

                  • The state of the data (Live or Past).

                  • The current time window.

                  • The configured timezone.

                  In addition, the navigation bar provides:

                  • Quick links for common time windows (one second, one minute, ten minutes, one hour, six hours, one day, and two weeks).

                  • A custom time window configuration option.

                  • A pause/play button to exit Live mode and freeze the data to a time window, and to return to Live mode.

                  • Step back/forward buttons to jump through a frozen time window to review historical data.

                  • Zoom in/out buttons to increase/decrease the time window.

                  Configure a Custom Time Period

                  The Time Navigation dropdown panel can be used to configure a specific time range. To configure a manual range:

                  1. On the Explore tab or the Dashboards tab, click the Custom link in the time navigation bar.

                  2. Configure the start and end points, and click the Adjust Time button to save the changes.

                  Some limitations apply to custom time windows. Refer to the Time Window Limitations section for more information.

                  Time Window Limitations

                  Some time window configurations may not be available in certain situations. In these instances, a modification to the time window is automatically applied, and a warning notification will be displayed:

                  There are two main reasons for a time window being unavailable. Both relate to data granularity and specificity:

                  • The time window specifies the granularity of data that has expired and is no longer available. For example, a time window specifying a one-hour time range from six months ago would not be available, resulting in the time window being modified to a time range of at least one day.

                  • The time window specifies a granularity of data that is too high given the size of the window, as a graph can only handle a certain number of data points. For example, a multi-hour time range would contain too many datapoints at one-minute granularity, and would automatically be modified to 10-minute granularity.

                  7 -

                  Visualize Metrics Using the Topology View

                  Topology View provides an interactive, animated interface to visualize how different components in your system interact with each other in real-time. The interface by default renders a selected host’s top processes and their interaction with processes on remote hosts or host groups. Entities in any valid logical grouping can be visually represented with Topology View. The interaction is depicted as nodes and links. Links connect nodes. Nodes and links radially expand from the left.

                  • Nodes: The entities participating in network communication. A node could be a process, a container, a host, or any label identified by Sysdig Agent. For example:

                    The limit imposed on the maximum number of nodes that can be visualized is as follows:

                    • host groups (hosts in a region): 20

                    • hosts: 20

                    • containers: 20

                    • processes: 10

                    This limit applies to the entities at any node level.

                  • Links: The network connection between nodes.

                  Hosts and their child processes (host.hostName > serve as the default grouping for the Topology View. Scaling a Topology View is limited by the number of processes and connections. Sysdig Monitor creates the Topology View by identifying network endpoints (IP addresses) derived from system call data.

                  Topology View in the Explore tab provides pre-defined dashboards to represent CPU Usage, Network``Traffic, and Response Time metrics, and as such, they are not configurable. It serves as a template diagnostic tool that provides bottom-up inter-process connection metrics as graphs. For a detailed description on each default metric type supported by the Topology View, see Topology Dashboards.

                  About Topology View

                  The UI allows you to zoom in, zoom out, fit, pan, and reset the display, and expand and collapse the nodes.

                  Zoom into an entity by clicking the associated + icon and view the top processes within the selected entity. You can expand the hosts to see individual processes running inside and corresponding metric value. The links indicating network connections are rendered between entities in the selected hierarchy and, when zoomed, between processes and entities. Use the mouse scroll wheel to zoom the content, then left-click and drag to move the map components within the window.

                  Topology View uses legends and color schemes. This section explains what they mean.

                  • The line width (thickness) of the links expresses metric values relative to other connections in the system. Scaling line width is relative to the metric values associated with each link. Topology View dynamically adjusts the legend as the data recorded for each connection changes.

                    • The thin black line(—): Lower metric values.

                    • The thick black line(): Higher metric values.

                    • Dashed lines(—): A previously existed connection. For example, an active connection between node A and B, rendered as a solid line, could dissolve after a data update if that connection does not exist anymore in the new data set. Instead of removing it from the graph, Sysdig Monitor depicts the inactive connection as a dotted line until the next data update. If the connection returns in a subsequent data update, it is rendered again as a solid line. If the connection does not exist, the line will be removed.

                  • The color scheme is determined by color coding for the customizable threshold. The nodes are identified by five colors:

                    • Green indicates the node is healthy.

                    • Yellow indicates the node is in a warning state.

                    • Red indicates the node is in a critical state.

                    • Grey indicates the node state is unknown. An unknown node typically signifies a node where no Sysdig Agent installed.

                    • Light Blue indicates no threshold is defined for the metrics.

                  Configure Topology View

                  You can navigate to the Topology View from the Explore or Dashboard menus.

                  Access from Explore

                  The types of Topology View you can see on Explore are pre-defined dashboard templates that contain only a single panel, and as such, they can’t be edited.

                  1. Click Explore.

                  2. On the Explore tab, click the Switch Data Source drop-down menu.

                  3. Select Sysdig Agents.

                  4. In the My Groupings drop-down, select the desired data source for which you want a topology view.

                  5. From the Search Metrics and Dashboard drill-down, select Topology.

                  6. Select one of the three pre-defined Dashboards.

                    The Topology View for the selected metrics will appear on the screen.

                  8 -

                  Explore Workflows

                  While every user has unique needs from Sysdig Monitor, there are three main workflows that you can follow when building out the interface and monitoring your infrastructure.

                  Workflow One

                  This workflow assumes that an alert has not been triggered yet.

                  Start with Explore , identify a problem area, then drill-down into the data. This workflow is the most basic approach, as it begins with a user monitoring the overall infrastructure, rather than with a specific alert notification. The workflow tends to follow the following steps:

                  1. Organize the infrastructure with groupings.

                  2. Define key signals with alerts and dashboards to detect a problem.

                  3. Identify a problem area, and drill down into the data using dashboards, metrics, and by adjusting groupings and scope as necessary.

                  Workflow Two

                  Start with an event notification, and begin troubleshooting. This workflow begins with an already configured alert and event being triggered. Unlike workflow one, this workflow assumes that pre-determined data boundaries have already been set:

                  1. Explore the event by adjusting time windows, scope, and segmentation.

                  2. Identify the exact area of concern within the infrastructure.

                  3. Drill down into the data to troubleshoot the issue.

                  Workflow Three

                  Customize default dashboard panels to troubleshoot a potential issue. This workflow assumes that an issue has been identified within one of the default dashboards, but alerts have not been set up for the problem area.

                  1. Copy the displayed panel to a new dashboard.

                  2. Create an alert based on the dashboard panel.

                  3. Configure a Sysdig Capture on demand.