Architecture
InfraSage is a small set of services joined by a message bus and a time-series store. Telemetry comes in through one gateway, is normalized into one form whatever its source, and lands in storage, where detection and analysis read it.
Data flow
Services
Ingestion Gateway (:8080)
The single entry point for telemetry. It:
- Detects the payload format on its own, whether that is Prometheus remote-write, OTLP, or JSON
- Validates timestamp freshness, value ranges, and required fields
- Deduplicates, so a retry cannot write the same record twice
- Parks invalid records in the dead-letter queue for inspection and replay
- Hands valid records to the message bus
Telemetry Operator (:8081)
Reads the stream from the bus, translates every source format into one canonical record, adds what it can infer (service discovery, environment tags), and writes to storage in batches.
AIOps Engine (:8080 plus the :9093 webhook)
Where detection and analysis happen:
- Anomaly detection across metrics, traces and logs, for every service
- Incident correlation: related anomalies grouped into one incident with its likely root cause
- Root cause analysis on request, with an AI model, from evidence InfraSage has gathered
- Incident memory: new trouble matched to similar past incidents
- The runbook executor: remediation against Kubernetes, HTTP, shell and Slack, behind approval gates and with rollback
- Multi-tenancy: RBAC, per-tenant quotas and data isolation
Integration Poller
Polls external systems continuously: AWS CloudWatch for EC2, RDS, Lambda, ALB, DynamoDB and S3 metrics, and Kubernetes for pod and node metrics and namespace events.
RCA MCP Server
Exposes InfraSage's root cause analysis as a Model Context Protocol (MCP) server, so AI agents can query results programmatically.
Infrastructure components
| Component | Version | Purpose |
|---|---|---|
| ClickHouse | v26+ | Time-series storage |
| Redpanda | v23.3+ | Kafka-compatible message bus |
| Prometheus | latest | InfraSage's own metrics and alerting |
| Grafana | latest | Dashboards for InfraSage's own health |
In the managed service these are run for you. Self-hosted, you size and operate them; see scale profiles and deployment options.
Where AI is used
Root cause analysis, the copilot, and a few assistive features (summaries of new log patterns, runbook drafts) call an AI provider. Detection does not: it runs without one. What is sent, and where, is listed under sub-processors; data redaction masks sensitive values before anything leaves your environment.