Get desktop application:
View/edit binary Protocol Buffers messages
Collect performance raw data from browser.
report once per page
report one or more web vitals data for pages, could report multiple times.
Service version in browser is the Instance concept in the backend.
Perf data time, set by the backend side.
Page path in browser is the endpoint concept in the backend Page path in the browser, mostly it is URI, without parameter
First Meaningful Paint time
Cumulative Layout Shift time
Largest Contentful Paint time
report one or more resource data for pages, could report multiple times.
Service version in browser is the Instance concept in the backend.
Perf data time, set by the backend side.
Page path in browser is the endpoint concept in the backend Page path in the browser, mostly it is URI, without parameter
Resource URL
Resource load time
Resource size
Resource load protocol
Resource type
report one or more web interactions data for pages, could report multiple times.
Service version in browser is the Instance concept in the backend.
Perf data time, set by the backend side.
Page path in browser is the endpoint concept in the backend Page path in the browser, mostly it is URI, without parameter
Interaction to Next Paint time
report one or more error logs for pages, could report multiple times.
Fetch the latest dynamic configurations of the service.
fetchConfigurations service requests the latest configuration. Expect command of Commands is: command: CDS # meaning ConfigurationDiscoveryService's response args: Include string key and string value pair. The key depends on the agent implementation. The value is the latest value in String value. The watcher of key owner takes the responsibility to convert it to the correct type or format. One reserved key is `UUID`. The value would help reducing the traffic load between agent and OAP if there is no change. Commands could be empty if no change detected based on ConfigurationSyncRequest.
Current agent service name.
[Optional] UUID is the unique id to represent the signature of the latest configuration. The agent usually uses its bootstrap configuration running in default, and this id could be empty when doing the 1st round sync. The agent could/is recommended to cache the UUID from the last command, and put it as the next round UUID parameter, then the OAP only returns the empty Commands if no configuration change happenned.
Query continuous profiling policy
current agent contains service and policies
Report the profiling task when the policy threshold is reached Use the returned task ID to perform the profiling task through EBPFProfilingService#collectProfilingData.
over threshold process entity
reached thresholds causes
The execution duration for this triggered profiling. This is set at the agent side.
target profiling task
current node information, only not null when first message or have update
local process and remote process connection information
kernel level metrics
application protocol log if the protocol is detected, the kernel logs is works the related logs otherwise, the kernel log is not related and is sent periodically
(message has no fields)
Define the detected processes and report them.
Report discovered process in Rover
An ID generated by eBPF agent, should be unique globally.
Keep the process alive in the backend.
An ID generated by eBPF agent, should be unique globally.
Define the Rover Process profiling task and upload profiling data.
Query profiling (start or stop) tasks
rover instance id
latest task update time
collect profiling data
task metadata
profiling data
When reporting an event, you typically call the collect function twice, one for starting of the event and the other one for ending of the event, with the same UUID. There are also cases where you have both start time and end time already, for example, when exporting events from a 3rd-party system, the start time and end time are already known so that you can call the collect function only once.
Unique ID of the event. Because an event may span a long period of time, the UUID is necessary to associate the start time with the end time of the same event.
The source object that the event occurs on.
The name of the event. For example, `Reboot`, `Upgrade` etc.
The type of the event. This field is friendly for UI visualization, where events of type `Normal` are considered as normal operations, while `Error` is considered as unexpected operations, such as `Crash` events, therefore we can mark them with different colors to be easier identified.
The detail of the event that describes why this event happened. This should be a one-line message that briefly describes why the event is reported. Examples of an `Upgrade` event may be something like `Upgrade from ${from_version} to ${to_version}`. It's NOT encouraged to include the detailed logs of this event, such as the exception stack trace.
The parameters in the `message` field.
The start time (in milliseconds) of the event, measured between the current time and midnight, January 1, 1970 UTC. This field is mandatory when an event occurs.
The end time (in milliseconds) of the event. , measured between the current time and midnight, January 1, 1970 UTC. This field may be empty if the event has not stopped yet, otherwise it should be a valid timestamp after `startTime`.
[Required] Since 9.0.0 Name of the layer to which the event belongs.
Define the JVM metrics report service.
Report collected logs into the OAP backend
Recommend to report log data in a stream mode. The service/instance/endpoint of the log could share the previous value if they are not set. Reporting the logs of same service in the batch mode could reduce the network cost.
Log data is collected through file scratcher of agent. Natively, Satellite provides various ways to collect logs.
[Optional] The timestamp of the log, in millisecond. If not set, OAP server would use the received timestamp as log's timestamp, or relies on the OAP server analyzer.
[Required] **Service**. Represents a set/group of workloads which provide the same behaviours for incoming requests. The logic name represents the service. This would show as a separate node in the topology. The metrics analyzed from the spans, would be aggregated for this entity as the service level. If this is not the first element of the streaming, use the previous not-null name as the service name.
[Optional] **Service Instance**. Each individual workload in the Service group is known as an instance. Like `pods` in Kubernetes, it doesn't need to be a single OS process, however, if you are using instrument agents, an instance is actually a real OS process. The logic name represents the service instance. This would show as a separate node in the instance relationship. The metrics analyzed from the spans, would be aggregated for this entity as the service instance level.
[Optional] **Endpoint**. A path in a service for incoming requests, such as an HTTP URI path or a gRPC service class + method signature. The logic name represents the endpoint, which logs belong.
[Required] The content of the log.
[Optional] Logs with trace context
[Optional] The available tags. OAP server could provide search/analysis capabilities based on these.
[Optional] Since 9.0.0 The layer of the service and servce instance. If absent, the OAP would set `layer`=`ID: 2, NAME: general`
Define the service reporting the extra information of the instance.
Report custom properties of a service instance.
Keep the instance alive in the backend analysis. Only recommend to do separate keepAlive report when no trace and metrics needs to be reported. Otherwise, it is duplicated.
Meter data is reported in a certain period. The agent/SDK should report all collected metrics in this period through one stream. The whole stream is an input data set, client should onComplete the stream per report period.
Reporting meter data in bulk mode as MeterDataCollection. By using this, each one in the stream would be treated as a complete input for MAL engine, comparing to `collect (stream MeterData)`, which is using one stream as an input data set.
query all sniffer need to execute profile task commands
collect dumped thread snapshot
report profiling task finished
Define metrics report service. The metrics format is typically representing the data model collected in the service mesh case.
(message has no fields)
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// ebpf agent(SkyWalking Rover) collects extra information from the OS(Linux Only) level to attach on the traced span. Since v3.1 //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Collect SpanAttachedEvent to the OAP server in the streaming mode.
SpanAttachedEvent represents an attached event for a traced RPC. When an RPC is being traced by the in-process language agent, a span would be reported by the client-side agent. And the rover would be aware of this RPC due to the existing tracing header. Then, the rover agent collects extra information from the OS level to provide assistance information to diagnose network performance.
The nanosecond timestamp of the event's start time. Notice, most unit of timestamp in SkyWalking is milliseconds, but NANO-SECOND is required here. Because the attached event happens in the OS syscall level, most of them are executed rapidly.
The official event name. For example, the event name is a method signature from syscall stack.
[Optional] The nanosecond timestamp of the event's end time.
The tags for this event includes some extra OS level information, such as 1. net_device used for this exit span. 2. network L7 protocol
The summary of statistics during this event. Each statistic provides a name(metric name) to represent the name, and an int64/long as the value.
Refer to a trace context decoded from `sw8` header through network, such as HTTP header, MQ metadata https://skywalking.apache.org/docs/main/next/en/protocols/skywalking-cross-process-propagation-headers-protocol-v3/#standard-header-item
Define a trace segment report service. All language agents or any trace collecting component, could use this service to send span collection to the SkyWalking OAP backend.
Recommended trace segment report channel. gRPC streaming provides better performance. All language agents should choose this.
An alternative for trace report by using gRPC unary This is provided for some 3rd-party integration, if and only if they prefer the unary mode somehow. The performance of SkyWalking OAP server would be very similar with streaming report, the performance of the network and client side are affected
Connection information
Used in:
local address
remote/peer address
local address detect point
is the connection using TLS or not
application protocol type
the attachment information about the connection
Used in:
Used in:
first bytes receive/write timestamp
last bytes receive/write timestamp
Used in:
The path portion from the incoming request URI.
Request header and body size.
The trace information if detected.
The host header of the incoming request.
Used in:
Used in:
Response header and body size.
Used in:
Used in:
Starting to accept socket timestamp
Finish accept operation timestamp
Used in:
Starting to close the connection timestamp
Finish close operation timestamp
Is the close operation success or not
Used in:
Starting to connect with peer address timestamp
Finish connect operation timestamp
Is the connect operation success or not
Used in:
Used in:
from network hardware interface index, get the net hardware name through EBPFAccessLogNodeNetInterface#index
total package count
total package size
total duration(nanosecond) of all data packets queued (waiting to be read).
total duration(nanosecond) of all data packets read from the queue.
Used in:
total local receive use duration(nanoseconds) -> kernel: ip_rcv_finish - ip_rcv
total local use duration(nanoseconds) -> kernel: ip_local_deliver_finish - ip_local_deliver
total netfiltering count and duration(nanosecond) -> kernel: nf_hook
Used in:
Used in:
Starting to read data timestamp
Finish read operation timestamp
Which kind of syscall of current read operation
Layer 2-4 related metrics
Used in:
Used in:
total duration(nanosecond) of layer 2
target network hardware interface index, get the net hardware name through EBPFAccessLogNodeNetInterface#index
total enter the net device buffer count
total buffer data ready to send duration(nanosecond), ready_to_send - enter_queue
total send buffer to the net device duration(nanosecond)
Used in:
total duration(nanosecond) of layer 3
total local out use duration(nanoseconds) -> kernel: ip_local_out
total output use duration(nanoseconds) -> kernel: ip_finish_output2 - ip_output
total resolve remote MAC address(ARP Request) count and duration(nanosecond) -> kernel: neigh_resolve_output
total netfiltering count and duration(nanosecond) -> kernel: nf_hook
Used in:
total duration(nanosecond) of layer 4
total send package(contains retransmit count) count(sk_buff in linux)
total retransmit package count(sk_buff in linux)
total losted package count metrics
total package size(bytes)
Used in:
Starting to write data timestamp
Finish write operation timestamp
Which kind of syscall of current write operation
Layer 2-4 related metrics
Used in:
Used in:
Used in:
Used in:
Used in:
[Optional] A string id represents the whole trace.
A unique id represents this segment. Other segments could use this id to reference as a child segment. [Optional] when this span reference
If type == SkyWalking The number id of the span. Should be unique in the whole segment. Starting at 0 If type == Zipkin The type of span ID is string.
Used in:
Used as request type in: BrowserPerfService.collectErrorLogs, BrowserPerfService.collectErrorLogs
UUID
Service version in browser is the Instance concept in the backend.
Error log time, set by the backend side.
Page path in browser is the endpoint concept in the backend Page path in the browser, mostly it is URI, without parameter
Then the PV with error is only calculated when firstReportedError is true.
Used as request type in: BrowserPerfService.collectPerfData, BrowserPerfService.collectPerfData
Service version in browser is the Instance concept in the backend.
Perf data time, set by the backend side.
Page path in browser is the endpoint concept in the backend Page path in the browser, mostly it is URI, without parameter
Unit of all time related field should be `ms`.
DNS query time
Time to first Byte
TCP connection time
Content transfer time
Dom parsing time
First paint time or blank screen time
Dom ready time
Page full load time
Synchronous load resources in the page
Only valid for HTTPS
Time to interact
First pack time
First Meaningful Paint
Used in:
Used as request type in: CLRMetricReportService.collect, CLRMetricReportService.collect
Used in:
,See: https://docs.oracle.com/javase/8/docs/api/java/lang/management/ClassLoadingMXBean.html
Used in:
Used in:
Used in:
Command represents an protocol customized data when return. When the agent communicates with the OAP side using gRPC, the OAP uses Command to return the data content to the Agent. The available commands are, Name: ConfigurationDiscoveryCommand Args: SerialNumber: String UUID: String properties: Key-value pairs rely on agent-side implementations Ref, Java agent supported configurations, https://skywalking.apache.org/docs/skywalking-java/next/en/setup/service-agent/java-agent/configuration-discovery/ Name: ProfileTaskQuery Args: SerialNumber: String TaskId: String EndpointName: String Duration: Integer MinDurationThreshold: Integer DumpPeriod: Integer MaxSamplingCount: Integer StartTime: Date Timestamp CreateTime: Date Timestamp Name: EBPFProfilingTaskQuery Args: TaskId: String ProcessId: Integer List TaskUpdateTime: Date timestamp TriggerType: Enum, value = FIXED_TIME TargetType: Enum, value = ON_CPU, OFF_CPU or NETWORK TaskStartTime: Date Timestamp ExtensionConfigJSON: JSON serialization of NetworkSamplings. --- NetworkSamplings --- NetworkSamplings: List URIRegex: String MinDuration: Integer When4xx: Boolean When5xx: Boolean Settings: Object RequireCompleteRequest: Boolean MaxRequestSize: Integer RequireCompleteResponse: Boolean MaxResponseSize: Integer ------------------------ FixedTriggerDuration: Long Name: ContinuousProfilingPolicyQuery Args: ServiceWithPolicyJSON: List JSON serialization of ServiceWithPolicy. --- ServiceWithPolicy --- ServiceName: String UUID: String Profiling: Multiple profiling configuration. Map Key: Profiling type. Enum, value = ON_CPU, OFF_CPU, NETWORK Value: Profiling policies. Map Key: Monitoring type. Enum, value = PROCESS_CPU, PROCESS_THREAD_COUNT, SYSTEM_LOAD, HTTP_ERROR_RATE, HTTP_AVG_RESPONSE_TIME Value: Policy configuration. Object. Threshold: String Period(s): Integer Count: Integer URIList: List<String> URIRegex: String --------------------------- Name: ContinuousProfilingReportTask Args: TaskId: String
Used in:
Use command name to distinguish different data type.
Data content in command. The value of content needs to be serialized as string for transmission. Basic data type: convert as string. The list of basic data: multiple data are split by ",". Complex data: serialize string through json.
Transferring multiple Command in agent and OAP.
Used as response type in: BrowserPerfService.collectErrorLogs, BrowserPerfService.collectPerfData, CLRMetricReportService.collect, JVMMetricReportService.collect, ManagementService.keepAlive, ManagementService.reportInstanceProperties, MeterReportService.collect, ProfileTask.collectSnapshot, ProfileTask.getProfileTaskCommands, ProfileTask.reportTaskFinish, TraceSegmentReportService.collect, TraceSegmentReportService.collectInSync, v10.AsyncProfilerTask.getAsyncProfilerTaskCommands, BrowserPerfService.collectErrorLogs, BrowserPerfService.collectPerfData, BrowserPerfService.collectResourcePerfData, BrowserPerfService.collectWebInteractionsPerfData, BrowserPerfService.collectWebVitalsPerfData, CLRMetricReportService.collect, ConfigurationDiscoveryService.fetchConfigurations, ContinuousProfilingService.queryPolicies, ContinuousProfilingService.reportProfilingTask, EBPFProcessService.keepAlive, EBPFProfilingService.collectProfilingData, EBPFProfilingService.queryTasks, EventService.collect, JVMMetricReportService.collect, LogReportService.collect, ManagementService.keepAlive, ManagementService.reportInstanceProperties, MeterReportService.collect, MeterReportService.collectBatch, ProfileTask.collectSnapshot, ProfileTask.getProfileTaskCommands, ProfileTask.reportTaskFinish, SpanAttachedEventReportService.collect, TraceSegmentReportService.collect, TraceSegmentReportService.collectInSync
Used in:
if the address is monitored under the local machine, then return the kubernetes
if the address cannot be aware, then return the ip address
Used in:
detect contains the environment information
detect the connection have a zTunnel environment(ambient istio)
eBPF Network profiling task
Used in:
eBPF off CPU profiling task
Used in:
(message has no fields)
eBPF on CPU profiling task
Used in:
(message has no fields)
Used in:
Used in:
service name of the each process
UUID represents the version(hash/shasum) of the current policies for the service. This is blank in the initialization stage and is set through the `ContinuousProfilingPolicyQuery` command response for the following rounds of queries.
Used in:
Used in:
Current process CPU usage percent(0-100).
The number of threads in the process.
System load value.
Process response error rate(0-100). HTTP response codes in [500-600) are considered errors. Formula: ErrorCount / TotalCount * 100
Process response average time(ms). Formula: TotalResponseTime(ms) / TotalCount
Used in:
In most cases, detect point should be `server` or `client`. Even in service mesh, this means `server`/`client` side sidecar `proxy` is reserved only.
Used in:
, ,Used in:
Node name
All net interfaces list
System boot time
Cluster name
Policy for the access log
Used in:
Used in:
Which namespaces should be excluded to generate the connection
Used in:
Used in:
[required] Entity metadata Must ensure that entity information is unique at the time of reporting
[required] The Process id of the host
[optional] properties of the process
Kubernetes process downstream
Used in:
Kubernetes process metadata
Used in:
[required] Entity metadata Must ensure that entity information is unique at the time of reporting
[required] The Process id of the host
[optional] properties of the process
Used in:
stack data in one task(thread)
total count of the process is switched to off cpu by the scheduler.
where time(nanoseconds) is spent waiting while blocked on I/O, locks, timers, paging/swapping, etc.
Get nanosecond through offset with node start instant
Used in:
Used in:
stack data in one task(thread)
stack counts
Used in:
Generated process id
Locate the process by basic information
Process Entity metadata
Used in:
, , , ,[required] Process belong layer name which define in the backend
[required] Process belong service name
[required] Process belong service instance name
[required] Process name
Process labels for aggregate from service
Used in:
Process entity
Minimize necessary properties
Used in:
The Process metadata
Used in:
,stack type
stack id from kernel provide
stack symbols
Used in:
Used in:
profiling task id
profiling process id
the start time of this profiling process
report time
Used in:
, , , , ,Used in:
Used in:
Used in:
The type of GC doesn't have new and old phases, like Z Garbage Collector (ZGC)
Used in:
Start timestamp in milliseconds of this RPC, measured between the current time and midnight, January 1, 1970 UTC.
End timestamp in milliseconds of this RPC, measured between the current time and midnight, January 1, 1970 UTC.
Status represents the response status of this calling.
NONE, mTLS, or TLS
The sidecar/proxy internal error code, the value bases on the implementation. The envoy internal error codes are listed here, https://www.envoyproxy.io/docs/envoy/latest/api-v2/data/accesslog/v2/accesslog.proto#data-accesslog-v2-responseflags
Internal request(response) latency is the time cost inside the Envoy sidecar proxy. For more details, check https://www.envoyproxy.io/docs/envoy/v1.22.0/api-v3/data/accesslog/v3/accesslog.proto.html#data-accesslog-v3-accesslogcommon. internalRequestLatencyNanos is the interval between the first downstream byte received and the first upstream byte sent
internalResponseLatencyNanos = time_to_first_downstream_tx_byte - time_to_first_upstream_rx_byte; | ... request workflow ... | upstream | ----- response -----> | proxy | ------- response -------> | client | | time_to_first_upstream_rx_byte | | time_to_last_downstream_tx_byte | | internalResponseLatencyNanos |
Used in:
A ID could be represented by multiple string sections.
Used in:
Used as request type in: ManagementService.keepAlive, ManagementService.keepAlive
Instance belong layer name which define in the backend, general is default.
Used as request type in: ManagementService.reportInstanceProperties, ManagementService.reportInstanceProperties
Instance belong layer name which define in the backend, general is default.
since v3.1 An instantaneous point on the time-line. An instant represents a data point accurate to the nanosecond. It is constituted by a long representing epoch-seconds and an int representing nanosecond-of-second, which will always be between 0 and 999,999,999
Used in:
,The number of seconds from the epoch of 1970-01-01T00:00:00Z.
The number of nanoseconds, later along the time-line, from the seconds field. This is always positive, and never exceeds 999,999,999.
JSON formatted log. The json field represents the string that could be formatted as a JSON object.
Used in:
Used in:
Used as request type in: JVMMetricReportService.collect, JVMMetricReportService.collect
since v3.1 An extension of KeyStringValuePair represents a kind of metric value for the key.
Used in:
Used in:
, , , , , , , , , ,Used in:
Label of the meter
Used in:
,Used in:
The timestamp in milliseconds of this event., measured between the current time and midnight, January 1, 1970 UTC.
String key, String value pair.
The content of the log data
Used in:
A type to match analyzer(s) at the OAP server. The data could be analyzed at the client side, but could be partial
Content with extendable format.
Used in:
String key, String value pair.
Used in:
Used in:
The histogram element definition. It includes the bucket lower boundary and the count in the bucket.
Used in:
The value represents the min value of the bucket, the upper boundary is determined by next MeterBucketValue$bucket, if it doesn't exist, the upper boundary is positive infinity.
If is negative infinity, the value of the bucket is invalid
Single meter data, if the same metrics have a different label, they will separate.
Used as request type in: MeterReportService.collect, MeterReportService.collect
Used as field type in:
Meter data could be a single value or histogram.
Service name, be set value in the first element in the stream-call.
Service instance name, be set value in the first element in the stream-call.
Meter data report time, be set value in the first element in the stream-call.
Histogram
Used in:
Meter name
Labels
Customize the buckets
Meter single value
Used in:
Meter name
Labels
Single value
Used in:
Used as request type in: ProfileTask.getProfileTaskCommands, ProfileTask.getProfileTaskCommands
current sniffer information
last command timestamp
profile task finished report
Used as request type in: ProfileTask.reportTaskFinish, ProfileTask.reportTaskFinish
current sniffer information
profile task
Used in:
Type of the reference
Used in:
Map to the reference targeting the segment in another OS process.
Map to the reference targeting the segment in the same process of the current one, just across thread. This is only used when the coding language has the thread concept.
The segment collections for trace report in batch and sync mode.
Used as request type in: TraceSegmentReportService.collectInSync, TraceSegmentReportService.collectInSync
The segment is a collection of spans. It includes all collected spans in a simple one request context, such as a HTTP request process. We recommend the agent/SDK report all tracked data of one request once for all. Typically, such as in Java, one segment represent all tracked operations(spans) of one request context in the same thread. At the same time, in some language there is not a clear `thread` concept like golang. Then, it could represent all tracked operations of one request context cross threads/goroutines.
Used as request type in: TraceSegmentReportService.collect, TraceSegmentReportService.collect
Used as field type in:
A string id represents the whole trace.
A unique id represents this segment. Other segments could use this id to reference as a child segment.
Span collections included in this segment.
**Service**. Represents a set/group of workloads which provide the same behaviours for incoming requests. The logic name represents the service. This would show as a separate node in the topology. The metrics analyzed from the spans, would be aggregated for this entity as the service level.
**Service Instance**. Each individual workload in the Service group is known as an instance. Like `pods` in Kubernetes, it doesn't need to be a single OS process, however, if you are using instrument agents, an instance is actually a real OS process. The logic name represents the service instance. This would show as a separate node in the instance relationship. The metrics analyzed from the spans, would be aggregated for this entity as the service instance level.
Whether the segment includes all tracked spans. In the production environment tracked, some tasks could include too many spans for one request context, such as a batch update for a cache, or an async job. The agent/SDK could optimize or ignore some tracked spans for better performance. In this case, the value should be flagged as TRUE.
Segment reference represents the link between two existing segment.
Used in:
Represent the reference type. It could be across thread or across process. Across process means there is a downstream RPC call for this. Typically, refType == CrossProcess means SpanObject#spanType = entry.
A string id represents the whole trace.
Another segment id as the parent.
The span id in the parent trace segment.
The service logic name of the parent segment. If refType == CrossThread, this name is as same as the trace segment.
The service logic name instance of the parent segment. If refType == CrossThread, this name is as same as the trace segment.
The endpoint name of the parent segment. **Endpoint**. A path in a service for incoming requests, such as an HTTP URI path or a gRPC service class + method signature. In a trace segment, the endpoint name is the name of first entry span.
The network address, including ip/hostname and port, which is used in the client side. Such as Client --> use 127.0.11.8:913 -> Server then, in the reference of entry span reported by Server, the value of this field is 127.0.11.8:913. This plays the important role in the SkyWalking STAM(Streaming Topology Analysis Method) For more details, read https://wu-sheng.github.io/STAM/
If the event occurs on a service ONLY, the `service` field is mandatory, the serviceInstance field and endpoint field are optional; If the event occurs on a service instance, the `service` and `serviceInstance` are mandatory and endpoint is optional; If the event occurs on an endpoint, `service` and `endpoint` are mandatory, `serviceInstance` is optional;
Used in:
Used in:
[Optional] A string id represents the whole trace.
A unique id represents this segment. Other segments could use this id to reference as a child segment. [Optional] when this span reference
If type == SKYWALKING The number id of the span. Should be unique in the whole segment. Starting at 0 If type == ZIPKIN The type of span ID is string.
Used in:
Map to the layer of span
Used in:
Unknown layer. Could be anything.
A database layer, used in tracing the database client component.
A RPC layer, used in both client and server sides of RPC component.
HTTP is a more specific RPCFramework.
A MQ layer, used in both producer and consuer sides of the MQ component.
A cache layer, used in tracing the cache client component.
A FAAS layer, used in function-as-a-Service platform.
Span represents a execution unit in the system, with duration and many other attributes. Span could be a method, a RPC, MQ message produce or consume. In the practice, the span should be added when it is really necessary, to avoid payload overhead. We recommend to creating spans in across process(client/server of RPC/MQ) and across thread cases only.
Used in:
The number id of the span. Should be unique in the whole segment. Starting at 0.
The number id of the parent span in the whole segment. -1 represents no parent span. Also, be known as the root/first span of the segment.
Start timestamp in milliseconds of this span, measured between the current time and midnight, January 1, 1970 UTC.
End timestamp in milliseconds of this span, measured between the current time and midnight, January 1, 1970 UTC.
<Optional> In the across thread and across process, these references targeting the parent segments. The references usually have only one element, but in batch consumer case, such as in MQ or async batch process, it could be multiple.
A logic name represents this span. We don't recommend to include the parameter, such as HTTP request parameters, as a part of the operation, especially this is the name of the entry span. All statistic for the endpoints are aggregated base on this name. Those parameters should be added in the tags if necessary. If in some cases, it have to be a part of the operation name, users should use the Group Parameterized Endpoints capability at the backend to get the meaningful metrics. Read https://github.com/apache/skywalking/blob/master/docs/en/setup/backend/endpoint-grouping-rules.md
Remote address of the peer in RPC/MQ case. This is required when spanType = Exit, as it is a part of the SkyWalking STAM(Streaming Topology Analysis Method). For more details, read https://wu-sheng.github.io/STAM/
Span type represents the role in the RPC context.
Span layer represent the component tech stack, related to the network tech.
Component id is a predefinited number id in the SkyWalking. It represents the framework, tech stack used by this tracked span, such as Spring. All IDs are defined in the https://github.com/apache/skywalking/blob/master/oap-server/server-bootstrap/src/main/resources/component-libraries.yml Send a pull request if you want to add languages, components or mapping defintions, all public components could be accepted. Follow this doc for more details, https://github.com/apache/skywalking/blob/master/docs/en/guides/Component-library-settings.md
The status of the span. False means the tracked execution ends in the unexpected status. This affects the successful rate statistic in the backend. Exception or error code happened in the tracked process doesn't mean isError == true, the implementations of agent plugin and tracing SDK make the final decision.
String key, String value pair. Tags provides more informance, includes parameters. In the OAP backend analysis, some special tag or tag combination could provide other advanced features. https://github.com/apache/skywalking/blob/master/docs/en/guides/Java-Plugin-Development-Guide.md#special-span-tags
String key, String value pair with an accurate timestamp. Logging some events happening in the context of the span duration.
Force the backend don't do analysis, if the value is TRUE. The backend has its own configurations to follow or override this. Use this mostly because the agent/SDK could know more context of the service role.
Map to the type of span
Used in:
Server side of RPC. Consumer side of MQ.
Client side of RPC. Producer side of MQ.
A common local code execution.
Used in:
Start timestamp in milliseconds of this RPC, measured between the current time and midnight, January 1, 1970 UTC.
End timestamp in milliseconds of this RPC, measured between the current time and midnight, January 1, 1970 UTC.
NONE, mTLS, or TLS
The sidecar/proxy internal error code, the value bases on the implementation. The envoy internal error codes are listed here, https://www.envoyproxy.io/docs/envoy/latest/api-v2/data/accesslog/v2/accesslog.proto#data-accesslog-v2-responseflags
Internal request(response) latency is the time cost inside the Envoy sidecar proxy. For more details, check https://www.envoyproxy.io/docs/envoy/v1.22.0/api-v3/data/accesslog/v3/accesslog.proto.html#data-accesslog-v3-accesslogcommon. internalRequestLatencyNanos is the interval between the first downstream byte received and the first upstream byte sent
internalResponseLatencyNanos = time_to_first_downstream_tx_byte - time_to_first_upstream_rx_byte; | ... request workflow ... | upstream | ----- response -----> | proxy | ------- response -------> | client | | time_to_first_upstream_rx_byte | | time_to_last_downstream_tx_byte | | internalResponseLatencyNanos |
The received data in bytes
The sent data in bytes
Used in:
Literal text log, typically requires regex or split mechanism to filter meaningful info.
Used in:
See: https://docs.oracle.com/javase/8/docs/api/java/lang/management/ThreadMXBean.html
Used in:
dumped thread snapshot
Used as request type in: ProfileTask.collectSnapshot, ProfileTask.collectSnapshot
profile task id
dumped segment id
dump timestamp
snapshot dump sequence, start with zero
snapshot stack
Used in:
stack code signature list
Logs with trace context, represent agent system has injects context(IDs) into log text.
Used in:
[Optional] A string id represents the whole trace.
[Optional] A unique id represents this segment. Other segments could use this id to reference as a child segment.
[Optional] The number id of the span. Should be unique in the whole segment. Starting at 0.
Used in:
YAML formatted log. The yaml field represents the string that could be formatted as a YAML map.
Used in:
Used in:
the real destination ip address of the connection
how the environment detected
the security policy of the ztunnel communicate with upstream
Used in:
Used in: