Frequently Asked Questions
General
What is InfraSage?
InfraSage is a self-hosted AIOps platform. It ingests metrics, logs, traces, and events from your Kubernetes infrastructure, runs ML-based anomaly detection, performs AI-powered root cause analysis, and can execute automated runbooks in response to incidents.
Is InfraSage an observability tool like Grafana or Prometheus?
Observability (metrics, logs, traces) is the data layer. InfraSage sits on top of that: it processes the data with ML and AI to tell you what's wrong and why, not just display it. You can run Grafana alongside InfraSage. They complement each other.
What data does InfraSage send externally?
Only what an AI analysis needs, and only when one runs: when you ask for a root cause analysis or use the copilot, the evidence for that question (service and metric names, metric summaries, recent changes, and excerpts of the affected services' logs and traces) goes to your chosen AI provider, with secrets and personal data masked first. You can run with no AI provider, or with a model you host. See Data Residency.
Deployment & setup
How long does it take to deploy?
The Helm chart installs in under 5 minutes. Initial anomaly baselines build after 24 to 48 hours of data collection. See Quick Start.
What are the minimum infrastructure requirements?
For the small profile (up to 1M events/day): 4 vCPUs, 8GB RAM, 100GB storage. For production workloads, see Scale Profiles.
Does InfraSage require Kubernetes?
For self-hosted, yes. The platform is Kubernetes-native and deployed with Helm. InfraSage Cloud has no infrastructure requirements.
Can I run InfraSage on a single node?
Yes for development and evaluation. For production, distribute ClickHouse and Kafka across at least 2 nodes for resilience.
Can I use an external ClickHouse or Kafka?
Yes. Set CLICKHOUSE_ADDR, CLICKHOUSE_USER, and CLICKHOUSE_PASSWORD to point to your existing ClickHouse instance. Similarly for Kafka. This is useful if you already operate these as shared infrastructure.
Data & compliance
Is InfraSage GDPR-compliant?
When self-hosted in an EU VPC, yes: all data stays inside your environment. InfraSage, Inc. does not process your telemetry. If you use a hosted AI provider, confirm its data processing terms satisfy your DPA, or use a model you host, or none.
Do I need a BAA with InfraSage for HIPAA?
No. Because InfraSage is self-hosted and InfraSage, Inc. never processes your data, there is no business associate relationship requiring a BAA.
How long is data retained?
By default, 90 days for metrics and 30 days for logs. Both are configurable via environment variables. See Retention Policy docs.
Can I delete a specific tenant's data?
Yes, via the admin API:
curl -X DELETE http://infrasage:8080/api/v1/tenants/my-tenant \
-H "Authorization: Bearer $SUPER_ADMIN_JWT"
This purges all telemetry, anomalies, and RCA data for that tenant.
Telemetry ingestion & data custody
Does InfraSage need to ingest my raw telemetry to work?
No. With federated telemetry, InfraSage reads metrics from your Prometheus and fetches logs and traces from your Loki and Jaeger only when an investigation needs them, so your raw telemetry stays in your own stack.
Why would I ingest telemetry directly instead of connecting my existing observability stack?
Direct ingestion buys five things that querying an external stack cannot fully match:
- Evidence that works during your worst hour. Incidents are exactly when your observability stack is likely to be degraded too: a log storm slowing Elasticsearch, an API rate limit during a traffic spike. Locally ingested evidence answers in milliseconds regardless of what else is on fire.
- Deeper root-cause analysis. An agentic RCA runs dozens of log, trace, and metric queries per investigation. Local queries are fast and free, so the agent can afford to be thorough; external APIs add seconds of latency, rate limits, and a per-query cost that quietly pushes analyses to be shallower.
- Cross-signal analysis. Linking a metric spike to the specific traces inside it, discovering service topology from trace pairs, and mining log templates for novel-error detection all require the signals to live side by side. This is much of what turns "latency is up" into "this query, on this pod, since this deploy."
- Unsampled, unfiltered fidelity. What sits in an existing stack is post-processing: traces head-sampled at 1 to 10%, logs pre-filtered by cost-saving exclusion rules. Ingesting from the source (OpenTelemetry) builds detection baselines on what actually happened.
- Faster detection and retroactive depth. Streaming ingest detects in near-real-time (polling an external API bounds detection latency to the poll interval), computes high-cardinality per-environment/per-instance aggregates in-flight, and can recompute aggregates historically when you add a new detection dimension, instead of starting that dimension from zero.
The two modes aren't exclusive. A practical path many teams take: connect your existing stack first, then move your most incident-prone services onto direct OpenTelemetry ingestion, where the sharper detection and stack-independent evidence matter most.
If I ingest telemetry, who has custody of my data?
You do. Self-hosted InfraSage keeps everything inside your environment, and RCA sends only structured analytical summaries to the LLM provider, never raw logs or traces (see Data Residency). Raw telemetry itself is transient; long-term storage is the compact aggregate layer, with retention configurable per Retention Policy.
Integrations
Can I use InfraSage with my existing Prometheus setup?
Yes. InfraSage exposes a Prometheus remote-write endpoint at /api/v1/prometheus/remote_write. Add it as a remote_write target in your Prometheus config to forward metrics automatically.
Does InfraSage replace Prometheus + Grafana?
Not necessarily. InfraSage focuses on anomaly detection, RCA, and runbook automation. Many teams run InfraSage alongside Prometheus and Grafana: Grafana for dashboards and ad-hoc querying, InfraSage for AI-driven alerting and incident response.
Does InfraSage support OpenTelemetry?
Yes. The Ingestion Gateway accepts OTLP over HTTP and gRPC. See OpenTelemetry Integration.
Can I ingest from AWS CloudWatch?
Yes. InfraSage's integrationPoller polls CloudWatch metrics from EC2, RDS, Lambda, ALB, DynamoDB, S3, and SNS. See AWS CloudWatch.
Pricing
What is the difference between Free, Pro, and Enterprise?
| Free | Pro | Enterprise | |
|---|---|---|---|
| Events/day | 100K | 10M | Unlimited |
| Users | 3 | 25 | Unlimited |
| Tenants | 1 | 5 | Unlimited |
| RCA | ✅ | ✅ | ✅ |
| Runbooks | ❌ | ✅ | ✅ |
| SLA | None | 99.9% | 99.99% |
See Billing Plans for the full feature comparison.
What counts as an "event"?
Each individual telemetry record counts as one event: a metric data point, a log line, a trace span, or a custom event. Batch submissions count each item in the batch individually.
What does the AI provider cost?
InfraSage is built to use fewer AI tokens than other AI SRE tools: the model investigates from evidence InfraSage has already distilled, not from raw telemetry dumps. RCA runs only when a human or webhook asks (never automatically on every alert), responses are cached, and daily budget caps plus per-tenant rate limits bound the spend. Actual cost per analysis and 30-day spend are metered on the Insights page of your own console. Measure it there rather than trusting anyone's brochure, including ours. See Cost Optimization.
Anomaly detection & RCA
Why am I getting too many false-positive anomalies?
The most common cause is a young baseline: a new service is more sensitive in its first week, and its dashboard says so (young, settling, mature). Also:
- Check whether the service has irregular traffic by design (cron jobs, batch processes)
- Give it two or three days to learn its daily rhythm
- If it is still too noisy, contact support with an example alert
See Anomaly Detection.
How long does RCA take?
Typically 15 to 30 seconds from request to a finished analysis, most of it the AI provider's response time.
Can I disable RCA for specific services?
Yes:
curl -X PUT http://infrasage:8080/api/v1/tenants/my-tenant/services/my-service/config \
-H "Authorization: Bearer $JWT" \
-d '{"rca_enabled": false}'
Does RCA work without an AI provider?
Yes, in a reduced form. With no provider key set, InfraSage still finds where the trouble started, scores blast radius and identifies affected services, and writes a rule-based analysis labeled analysis_mode: fallback_rules. The written investigation and the copilot need a provider; it can be one you host (see Data Residency).
Operations
How do I upgrade InfraSage?
helm repo update
helm upgrade infrasage infrasage/infrasage -n infrasage -f values.yaml
Check the Changelog for breaking changes before upgrading major versions.
What happens if ClickHouse goes down?
Ingestion keeps buffering on the message bus (24 hours by default). Once storage recovers, the backlog is written automatically. No telemetry is lost within that window.
How do I scale InfraSage horizontally?
The Ingestion Gateway and AIops Engine are stateless, so you scale them by raising replica counts. ClickHouse scales vertically (larger nodes) or horizontally via sharding. See Scale Profiles.