Machines and identity

Monitor → Infrastructure → Machines brings agent-backed hosts and discovered devices into one inventory. A server seen by an installed agent and by SNMP can appear as one machine with both sources attached, instead of two unrelated rows.

Search by name, IP address, MAC address, chassis serial, or agent ID. Open a row to investigate its identity and the observations available for it.

What puts a machine in the inventory

The Manifested by badges explain which sources found a machine:

• agent: an installed agent reports its host’s interfaces, addresses, and agent health. Host resource measurements require a Host Metrics check.
• SSH: a Remote Host Metrics check reads a remote Linux host through verified SSH. The collecting agent is an observer; it is not installed on that target.
• SNMP: a poll reads the device’s own identity, interfaces, and supported MIBs.
• flows: a host-local eBPF collector reports kernel telemetry.
• LLDP: neighbour announcements provide link and chassis identity evidence.
• ARP: a local scan observed an address and a hardware address.

These badges describe provenance, not interchangeable levels of monitoring. A machine found through ARP alone has no measured CPU, disk, or application health. Adding an SNMP check or installed agent supplies new evidence; it does not make the earlier ARP observation more comprehensive.

Inspect identity before correlating symptoms

The machine’s Overview includes its canonical ID, network scope, hardware information where available, confidence, first/last seen times, and the sources that were joined. Addresses and hardware exposes interface and address claims with their provenance and confidence.

Correlation uses hardware and source evidence, including MAC addresses and chassis identity. Matching text in an address field is not enough. Reused private addresses in different network scopes can describe different machines, and the management address polled by SNMP may differ from the interface address seen in a path measurement.

When a machine has multiple sources, inspect what supports the merge before using it to connect an incident to a physical device. Conflicting or incomplete identity evidence can prevent correlation. A low-confidence entry is a reason to inspect the claims, not a reason to assume the machine is unhealthy.

Choose a detail tab

• Overview explains identity, sources, addresses, and hardware claims.
• Host describes the reporting agent: version, platform, reporting status, runtime health, spool, memory use, and collection activity.
• Device contains SNMP observations or host resource measurements from the local operating system or remote SSH target. Its sections depend on the source.
• Containers shows container activity reported from this host.
• Network flows shows passive TCP peers, processes, and collector coverage.
• Kernel shows Linux scheduler, disk, softirq, and process-lifecycle evidence.

Tabs depend on the sources associated with the machine. Some available tabs show a setup or capability explanation until a relevant check reports data. The presence of a tab alone does not prove that collection is running.

For a remote SSH machine, the Device tab includes its resource readings, selected service states, disk I/O, target, and collecting agent. See Remote Host Metrics for setup and credentials.

Investigate one machine

1. Select the Infrastructure window that covers the symptom and find the machine.
2. In Overview, verify its network scope, addresses, and collection sources.
3. If an agent runs there, inspect Host for stale reporting or a degraded collector before trusting a lack of measurements.
4. Use Device for resource or interface evidence, then Containers, Network flows, or Kernel to examine the relevant workload or behavior.
5. Compare each panel’s sample time with the incident. The panels do not all represent the same collection instant.
6. Use Ask Spear → Investigate machine or Check telemetry coverage to examine the machine in context. Verify the cited evidence and its time range.

Machine links retain the selected tab and relative window. Device subsection links also retain the selected section. If identity processing merges an older machine ID, its detail view can redirect to the canonical machine and explain the change.

When something looks missing

A machine can take a few minutes to appear after its first measurement because inventory processing follows ingestion. If a known system is absent, widen the window, clear the search, and confirm a successful source record before changing its checks.

A machine known only from LLDP may have no claimed IP address. A device without an installed agent will not have that agent’s runtime health or host-local collectors. These are different coverage states, not necessarily failures.

Continue with host and kernel diagnostics, network devices, or the troubleshooting guide.