Skip to content

Observability

Where to watch EAP at runtime and what it emits — metrics, logs, traces, and alerting.

Metrics

All EAP dashboards live in the EAP folder on Grafana.

Resource Metrics

From the Kubed baseline instrumentation — CPU, memory, disk, etc.

Service Health Metrics

EAP Health Metrics

Instrument Prometheus name Type Labels Meaning
eap_health_component_up eap_health_component_up Gauge (0/1) component Whether a component is available: down→0, otherwise (ok/degraded/unknown)→1
eap_health_component_status eap_health_component_status Gauge (enum) component Numeric status: ok=1, degraded=0.5, down=0, unknown=-1 (for Grafana threshold coloring)
eap_health_check_latency_ms eap_health_check_latency_ms_milliseconds Gauge (ms) component Latency of the component's last probe (ms); not reported when no latency data is available
eap_health_overall_up eap_health_overall_up Gauge (0/1) endpoint Overall readiness: HTTP 200→1, otherwise 0
eap_health_requests_total eap_health_requests_total Counter endpoint, http_status, status Count of health-endpoint responses

LLM Call Metrics

Instrument Prometheus name Type Labels Meaning
eap_llm_requests eap_llm_requests_total Counter method, path, http_status, status_class, outcome LLM Request Count
eap_llm_request_duration eap_llm_request_duration_milliseconds_bucket / _sum / _count Histogram (ms) method, path, http_status, status_class, outcome Request Duration (until the upstream response headers are received)

Codex & OpenCode Metrics

Emitted by the Codex and OpenCode OTel exporters.

Convention — histogram instruments expose three Prometheus series each (_bucket, _count, _sum), written below as _{bucket,count,sum}.

OpenCode Metrics

opencode_cache_count_total
opencode_cost_usage_USD_total
opencode_message_count_total
opencode_model_usage_total
opencode_retry_count_total
opencode_session_count_total
opencode_session_cost_total_USD_{bucket,count,sum}
opencode_session_duration_milliseconds_{bucket,count,sum}
opencode_session_token_total_tokens_{bucket,count,sum}
opencode_token_usage_tokens_total
opencode_tool_duration_milliseconds_{bucket,count,sum}

Codex Metrics

codex_api_request_duration_ms_milliseconds_{bucket,count,sum}
codex_api_request_total
codex_plugins_startup_sync_final_total
codex_plugins_startup_sync_total
codex_process_start_total
codex_remote_models_load_cache_duration_ms_milliseconds_{bucket,count,sum}
codex_shell_snapshot_duration_ms_milliseconds_{bucket,count,sum}
codex_shell_snapshot_total
codex_sqlite_init_count_total
codex_sqlite_init_duration_ms_milliseconds_{bucket,count,sum}
codex_sse_event_duration_ms_milliseconds_{bucket,count,sum}
codex_startup_phase_duration_ms_milliseconds_{bucket,count,sum}
codex_thread_skills_description_truncated_chars_{bucket,count,sum}
codex_thread_skills_enabled_total_{bucket,count,sum}
codex_thread_skills_kept_total_{bucket,count,sum}
codex_thread_skills_truncated_{bucket,count,sum}
codex_thread_started_total
codex_tool_call_duration_ms_milliseconds_{bucket,count,sum}
codex_tool_call_total
codex_tool_unified_exec_total
codex_turn_e2e_duration_ms_milliseconds_{bucket,count,sum}
codex_turn_memory_total
codex_turn_network_proxy_total
codex_turn_token_usage_{bucket,count,sum}
codex_turn_tool_call_{bucket,count,sum}
codex_turn_ttfm_duration_ms_milliseconds_{bucket,count,sum}
codex_turn_ttft_duration_ms_milliseconds_{bucket,count,sum}

Alerting

EAP gateway alerts: alerting list (service=eap-gateway).

The alert rules are defined in eap-k8s-alert-rules.json and eap-health-status-alert-rules.json. Grafana evaluates both rule groups every 60 seconds. All rules use service=eap-gateway, link to the eap-health-status dashboard, treat a Grafana no-data result as OK, and report rule evaluation errors as Error. Missing telemetry is detected by the explicit health-metrics-missing rules.

Kubernetes Resource Alerts

These rules cover the enterprise-agent-platform (prod) and enterprise-agent-platform-stage namespaces. They retain the cluster, namespace, and affected Kubernetes resource labels so notifications identify the exact container or PVC.

Alert Severity What it covers When it triggers
EAPK8sMemoryHigh Warning Container memory working set compared with its configured memory limit, grouped by cluster, namespace, pod, and container. Memory usage remains above 85% of the limit for 10 minutes.
EAPK8sMemoryCritical Critical The same per-container memory coverage as the warning rule, at the critical threshold. Memory usage remains above 95% of the limit for 5 minutes.
EAPK8sPVCUsageHigh Warning Used capacity compared with total capacity for each PVC, grouped by cluster, namespace, and persistent volume claim. PVC usage remains above 80% for 10 minutes.
EAPK8sPVCUsageCritical Critical The same per-PVC storage coverage as the warning rule, at the critical threshold. PVC usage remains above 90% for 5 minutes.

Health Status and LLM Alerts

Unless a row names a specific environment, these rules cover all eap-gateway metric series available to the alert datasource and retain labels such as cluster, namespace, pod, component, endpoint, method, or path for diagnosis.

Alert Severity What it covers When it triggers
EAPHealthMetricsMissingStage Critical The stage gateway health-metric export path, including the gateway, OTel collector, Prometheus scrape, and metric export pipeline. No eap_health_overall_up sample is received from enterprise-agent-platform-stage for 10 minutes; the rule fires immediately after that lookback becomes empty.
EAPHealthMetricsMissingProd Critical The prod gateway health-metric export path, including the gateway, OTel collector, Prometheus scrape, and metric export pipeline. No eap_health_overall_up sample is received from enterprise-agent-platform for 10 minutes; the rule fires immediately after that lookback becomes empty.
EAPOverallReadinessDown Critical Overall readiness for each gateway health endpoint, grouped by cluster, namespace, service, and exported endpoint. The five-minute lookback contains an eap_health_overall_up value below 1 and the condition remains active for 2 minutes.
EAPCriticalDependencyDown Critical Critical database and NFS dependencies for each gateway pod. The five-minute lookback contains eap_health_component_up=0 for database or nfs and the condition remains active for 2 minutes.
EAPComponentDown Warning Non-critical health components other than database and NFS, evaluated per pod. The ten-minute lookback contains a component status score of 0 (down) and the condition remains active for 5 minutes.
EAPComponentDegradedOrUnknown Warning Non-critical health components reporting degraded (0.5) or unknown (-1); fully down components are handled by EAPComponentDown. The minimum component status in the ten-minute lookback is below 1 but not 0, and the condition remains active for 10 minutes.
EAPHealth503Responses Warning HTTP 503 responses from each exported gateway health endpoint. At least one 503 response occurs in the five-minute lookback and the condition remains active for 1 minute.
EAPHealthCheckLatencyHigh Warning Average probe latency for each health component and gateway pod. Five-minute average health-check latency exceeds 5,000 ms and remains above the threshold for 5 minutes.
EAPLLMProxyTransportErrors Critical LLM proxy transport and connectivity failures, grouped by method, path, and HTTP status. At least one request with outcome="proxy_error" occurs in the five-minute lookback and the condition remains active for 1 minute.
EAPLLMUpstreamErrorRateHigh Warning LLM upstream response failures for each gateway path. The five-minute upstream-error rate exceeds 5%, at least 20 requests occurred in that window, and the condition remains active for 5 minutes.
EAPLLMLatencyP95High Warning LLM proxy p95 time to receive upstream response headers, grouped by method and path. The five-minute p95 latency exceeds 30,000 ms, at least 20 duration samples occurred in that window, and the condition remains active for 10 minutes.
EAPLLMDurationSamplesMissing Warning Consistency between the LLM request counter and duration histogram instrumentation for each method and path. Requests increase during the ten-minute lookback but duration sample counts do not, and the mismatch remains active for 5 minutes.

Logs

Field Value
Portal log.o.webex.com
Index wxm-app:logs*
Filter example k8s.namespace is enterprise-agent-platform-stage, datacenter is wdfwgen-p-5

Traces

OpenSearch

Portal: OpenSearch Portal.

Environment Logs index Traces index
stage ss4o_logs-logs-dev_ai_studio_otel ss4o_traces-traces-dev_ai_studio_otel
prod ss4o_logs-logs-eap_otel ss4o_traces-traces-eap_otel

Tempo + Grafana (LMA)

Environment Endpoint Username Grafana
stage https://tempo-scratch.us-vaameti1.e30.prod.infra.webex.com/v1/traces french_river Explore
prod TBD TBD TBD

How to Find Traces

LMA Sample

Step 1 — Get the Conversation ID

Every trace is keyed by a conversation_id. The easiest way to obtain it is directly from the EAP page:

  1. Open your browser's developer console.
  2. Refresh the page and select the ACP request (see the image below).
  3. Copy the conversation_id from the conversation you want to track.

Conversation ID from page

Step 2 — Search for the Trace in Grafana
  1. Open Grafana and go to the Explore page.
  2. Select the tempo-ccps-poc datasource.
  3. Query by the conversation_id you copied, for example:

    {span.eap.conversation_id="conv_6053668dd24644eea2857e3b3670740a"}
    
  4. Click the matching trace to inspect its details.

Search Trace on Grafana

Step 3 — Inspect an MCP Tool Call

To isolate an MCP tool call within a trace, filter by an attribute such as target = codex_core::mcp_tool_call and turn off the Show all spans switch. The tool calls then stand out clearly.

MCP Tool Call in Trace

What Conversation Issues Can Be Diagnosed?
  • End-to-end tracing across systems — Using eap.conversation_id or codex.thread_id, you can follow the full timeline of a single conversation in one trace—from the gateway receiving the prompt, to forwarding it to Codex, through Codex's internal processing—without manually stitching IDs together from logs.
  • Latency and timeout root cause — Compare the duration of the acp.prompt span with its child Codex spans to tell whether the bottleneck is on the gateway side (e.g., authentication, binding/reconnection) or inside the Codex runtime.
  • Failing conversation turn — Because each prompt turn maps to a span, the conversation_id pinpoints the user and the exact interaction that failed, while child spans locate the point of failure within Codex.
  • Reconnection and binding anomalies — Events from the replace_binding reconnection logic within a prompt appear directly in the span timeline.