Platform Architecture

Overview

The WxCDI observability platform combines inventory-driven metric collection with pushed logging and event ingestion.

graph LR
    subgraph Sources
        A[UC Applications]
        B[Network and Security]
        C[Compute and Infrastructure]
    end

    subgraph Metrics
        D[SNMP and Custom Exporters]
        E[Prometheus]
        F[Mimir]
        G[Grafana]
    end

    subgraph Events
        H[Syslog-ng]
        I[SNMP Trap Receiver]
        J[SFTP and CDR Processing]
        K[Splunk Cloud]
    end

    L[Inventory and Metadata] --> D
    L --> H
    L --> I
    L --> J
    A --> D
    B --> D
    C --> D
    A --> H
    B --> H
    C --> I
    A --> J
    D --> E
    E --> F
    F --> G
    H --> K
    I --> K
    J --> K
    G --> M[EMS / KeepHQ]
    K --> M
    M --> N[Response Destinations]

The platform observes UC applications and their voice edge, WAN/security edge, data-center fabric, compute/virtualization, identity, and utility dependencies.

Infrastructure

The source audit documents two production Kubernetes clusters:

• wxcdi-prod-us-dfw
• wxcdi-prod-us-sjc

Helm charts are maintained under kubed-charts/wxcdi-observability. Service lists, chart versions, cluster targeting, and runtime values are managed in wxcdi-kubed-configs and deployed through WBX3/Argo.

Network Topology

Prometheus and exporters pull metrics from inventory-defined device targets. Syslog, SNMP traps, collectd, and SFTP/CDR data are pushed into resilient ingress services. Inventory metadata is shared across those paths to identify device, region, data center, and customer context.

Most collection/processing services use an active/standby model to avoid duplicate work. Pushed-telemetry ingress services are documented as active/active with resilient/Anycast ingress. Confirm current values before failover or maintenance.

Scaling

KEDA controls active/standby scale behavior in the documented runtime model. Capacity should be reviewed separately for Prometheus scrape load, exporter concurrency, remote-write volume, Mimir cardinality, syslog/trap throughput, SFTP/CDR volume, and Splunk ingestion.

Do not use static device or time-series counts from this documentation for capacity decisions; use current inventory and telemetry.