Reading infrastructure status
The Infrastructure page shows every node, pod, and container that one of your sources is reporting on. The page is per-source — but if you land on /infrastructure without one selected, the page renders a picker grid.
Source picker (when "All sources" is selected)
When the source switcher is set to "All sources" (the default after sign-in), the page shows a card grid — one card per source you have access to. Each card shows:
- The source name.
- The type (Kubernetes / Docker / Linux server).
- A status pill:
CONNECTED(green),NEVER_SEEN(gray), or other (amber).
Click a card to scope the page to that source. The URL updates to /infrastructure?source_id=<id> and the source switcher in the left rail flips to that source.
You can also click any source in the left-rail switcher at any time to change scope.
Once a source is picked
What you see depends on the source's type, because the things worth listing are different:
| Source type | What the page shows |
|---|---|
| Kubernetes | Nodes, pods and containers — List and Tree views, described below |
| Docker | The host's containers |
| Linux server / VM | One card per machine — see Linux hosts |
| Service / OpenTelemetry app | Nothing — the page says infrastructure is not collected for this source type, and lists the ones it is. No agent runs, so there is nothing to report. That is expected, not a fault. |
For Kubernetes, the header reads Infrastructure · Browse nodes, pods, and containers across your sources plus a count line: <n> nodes · <n> pods · <n> containers.
Agent advisories
Above everything else, a source may show an amber banner: "This agent is collecting less than you asked for."
This is the agent telling you about a condition that silently reduces what it collects — the class of problem that otherwise shows up weeks later as "why are there no logs from that box?" and takes an afternoon to trace. Nothing here is fatal; the agent keeps running and everything else keeps flowing.
It appears for every source type, not just Linux hosts. Typical messages:
| Message | Means |
|---|---|
| *log source X matches no files* | A log_files glob matches nothing. A typo, or the file has not been created yet. |
| *at the tailed-file limit of N* | The file cap is reached and further matched files are not collected. Narrow the globs, or raise host.max_log_files — and the process fd limit with it. |
| *…is matched by both X and Y* | Two log sources claim the same file. Only one collects it, so the other's labels and multiline rule are not being applied. |
| *journald collection is configured but journalctl was not found* | journald.enabled is on, on a host with no systemd journal. No system logs are being collected. |
| *health endpoint is not serving on port N* | /healthz and /readyz answer nothing. On Kubernetes this matters a lot — a liveness probe will restart the pod even though collection is working fine. |
The banner ages. A warning is a statement about a moment, not a permanent property. After five minutes with no fresh report the wording shifts to the past tense — *"This agent last reported…"* — so a disconnected source never shows a stale complaint phrased as a live one. That five minutes is the same threshold that flips the source's connected badge, so the two never disagree.
Warnings clear themselves. Fix the cause and the entry disappears on the agent's next scan; there is nothing to acknowledge or dismiss.
Linux hosts
A Linux server / VM source shows one card per machine:
| Section | Contents |
|---|---|
| Hostname | The machine's name |
| CPU | Current usage, percent |
| Memory | Used / total |
| Filesystems | One row per mount: used / total, with a usage bar |
| Log sources | One row per configured source — its name, its path, and how many entries it produced in the last hour |
The Log sources list is the fastest way to check a host is doing what you configured. A source you defined in log_files that shows no entries, or is missing from the list entirely, is a glob matching nothing — usually a path typo. *"No log sources have produced entries in the last hour"* on a freshly installed host normally means the agent has not been pointed at anything yet, which is the default: see Agent configuration.
Filesystem rows carry no pseudo-filesystems by default (tmpfs, overlay and friends are excluded), so every bar shown is a disk that can genuinely fill.
Two views: List and Tree
These apply to Kubernetes sources.
Toggle top-right.
List view (default)
Three tabs: Nodes (n) | Pods (n) | Containers (n).
Each tab has:
- A Filter input that does substring match against the entity name.
- A table with columns appropriate to the entity:
- Pods: Pod | Namespace | Node | Containers | Logs (1H) | Actions
- Nodes: node name + counts.
- Containers: container name, pod, namespace, status.
- Per-row Actions (right side) — three small icons that deep-link to the same entity in Logs, Live Tail, and Metrics.
Tree view
The same data rendered as a hierarchy:
Node aks-private-... 5 pods ├── Pod cargospot-api-qa-... cargospot-qa │ └── Container cargospot-api-qa ├── Pod cargospot-tms-svc-... cargospot-qa │ └── Container cargospot-tms-svc-qa ...
Click the chevron on any node or pod to expand/collapse. Tree view is more useful when you want to see "which pods live on which node".
Note
The same Infrastructure panel also appears on the Source detail page (/sources/<id>), pre-scoped to that source. The standalone /infrastructure page is the same content, with the source picker on the left rail rather than in the URL.
What this page is not
- Not a multi-source aggregation. Pick one source at a time.
- Not for editing pod/node config. It's read-only — observe, then act in your Kubernetes tooling, or on the host itself.
- Not real-time. It refreshes when you reload or change tabs. For streaming, use Live Tail.