Skip to content
CosmoTrace
Menu

Platform

Many edges. One stream. One lake. Console and Agent on top.

CosmoEdge on every node collects, parses, masks and classifies. CosmoStream applies a signed policy per class and routes. CosmoLake writes open columnar files to your storage. CosmoConsole and Ops Agent read from the lake. Every event carries the same five-level name and the same coordinate from the first byte to the last query.

The estate

Everything, then one thing

This is the picture CosmoConsole opens on and the picture the bill is written in. Datacenters contain regions, regions contain clusters, clusters contain nodes, nodes run services. Drill into any node and you see its services and the agent beside them. The names are yours: the agent reads them from the environment it lands in and you correct them once, centrally.

One hierarchy: datacenter, region, cluster, node, service A datacenter contains two regions. Each region contains clusters. Each cluster contains nodes. One node is expanded to show the services running on it. The same five levels are used everywhere in CosmoTrace. DATACENTER ams-1 REGION eu-west CLUSTER payments node-17 node node node node node node node node node node CLUSTER edge-retail REGION eu-central CLUSTER core NODE node-17 · 2 vCPU · 4 GiB SERVICES payment-worker systemd checkout-api container postgres systemd sshd systemd cosmotrace-agent systemd Same five levels in the console, the query language and the bill.
The hierarchy diagram. Node names and services shown are placeholders; no customer identifiers appear on this site.

The components

Watch each one work

Seven components, one hierarchy, one coordinate. Each diagram below is the component doing its job on placeholder data. Nothing here is a screenshot; the console does not ship yet and we do not fake screens. If your system asks for reduced motion, every diagram holds its final frame.

Collect

CosmoEdge

Discovers sources, parses what it knows, keeps the rest opaque, masks before anything leaves, and reports what it could not reach.

One statically linked binary or a DaemonSet. Runs on a store POS, a plant gateway, a telco far-edge box, a Kubernetes node or a plain host. Does not need root.

measured: 110k events/s on 1 vCPU under 100 MB

The agent page
CosmoEdge: what happens to data on the node Events from five sources on a node flow through discover, parse, mask and a disk buffer, then leave over port 443. A coverage report underneath records what was refused, sampled or lost. Animated; static when reduced motion is requested. ON THE NODE CosmoEdge · one binary · no configuration file /var/log/* journald container stdout auth · sudo · exec process tree discover what exists parse or keep opaque mask · classify before it leaves buffer on disk CosmoStream outbound 443 coverage report refused /var/log/secure no permission for user cosmo sampled container stdout 1:8 over search budget lost 0 events buffer 14% · link up shipped with the data measured: 110k events/s · 1 vCPU · under 100 MB resident

Classify

CosmoStream

One signed policy per class decides where each event goes. Evidence is never sampled. Economy skips the hot tier.

Assigns the coordinate at acceptance. Routes to hot storage, the lake, cold object storage, or a copy to the tools you already run.

measured: 400 GB/day ingest per vCPU

The stream page
CosmoStream: one signed policy per class decides where each event goes Events of three classes arrive from many agents. A signed policy sends evidence to hot storage and the lake, search data to the lake with an index, and economy data straight to cold object storage. A copy can go to existing tools. Each event receives a coordinate at the gate. Animated; static when reduced motion is requested. FROM EVERY CosmoEdge evidence · auth, sudo, exec, 5xx search · request logs, metrics economy · debug, raw traces CosmoStream policy · signed stream_id + epoch + seq seq 8,214,907 seq 8,214,908 seq 8,214,909 hot + CosmoLakeevidence · milliseconds to query CosmoLake + indexsearch · your bucket cold object storageeconomy · hot tier skipped existing toolsa copy, if you want one measured: 400 GB/day ingest per vCPU · evidence is never sampled

Own

CosmoLake

Open columnar files in your bucket, in your region. One query over hot and cold. Leaving is a copy.

Hot data is indexed for fast answers; economy data is written cold and queried in place. Retention is a policy; deletion is a file operation on storage you own.

measured: 15 MB/s per vCPU · ≤20 vCPU-h per TB

The lake page
CosmoLake: open files on your bucket, one query over hot and cold The writer lands open columnar files into a bucket in your account and region. Hot files are indexed; cold files are written directly. A query sweeps both tiers. A file copies out to any reader without CosmoTrace in the path. Animated; static when reduced motion is requested. CosmoStream classed, coordinated YOUR BUCKET · YOUR REGION eu-west · s3://acme-telemetry writer open columnar hot indexed · evidence and search index cold object storage · economy writes here directly query both tiers · one hierarchy 9 files · 2 hot, 7 cold · 41 ms leaving is a copy · any reader, no CosmoTrace in the path measured: 15 MB/s per vCPU · ≤20 vCPU-h per TB landed

Investigate

CosmoConsole

Rebuilds who did what, when, and what it broke, in seconds, from evidence already on the node.

Timeline, evidence graph, and a finding where every sentence points at a raw event you can open. Shown here as designed; in development.

phase two

CosmoConsole: who changed payment-worker, and did it break checkout? A timeline of six events builds from left to right: login, sudo restart, process start, 503 errors, a dip in checkout success, recovery. An evidence graph connects user, sudo, process, service and trace. A finding appears with every sentence linked to a raw event. Animated in ten-second loops; static when reduced motion is requested. CosmoConsole case · payments-03 · design, not a shipped screen checkout.success_rate 91.2% ssh login14:02:07 sudo restart payment-worker14:02:31 pid 4182214:02:32 503s14:02:33 success ↓14:02:34 recovered14:02:41 evidence graph · observed links j.okaforuser sudosystemctl restart payment-workerpid 41822 checkout503 spans FINDING Privileged restart caused a short checkout dip. Cold cache after restart → 503s for ~7 s. Success 99.7% → 91.2% → 99.6%. 4 claims · 4 raw events · click any

Operate

Ops Agent

Runs the same four steps unattended and proposes an action. A person approves. On-call gets the finished case, not the page.

Native to the fabric, ships with CosmoConsole, and never acts without approval. The target is fewer L1 and L2 hours; we will publish the number when we have measured it.

phase two · included with CosmoConsole

Ops Agent: the same investigation, unattended, acted on only with approval An alert arrives. Ops Agent runs collect, timeline, graph and finding as a checklist, proposes an action, and waits. A person approves; the case closes. Animated in twelve-second loops; static when reduced motion is requested. ALERT checkout.success_rate < 95% for 30 s · 03:02 OPS AGENT runs unattended Collect · ssh, sudo, exec, process, logs, traces Timeline · login → command → process → metric Graph · observed links, not guesses Finding · every claim → raw event PROPOSED ACTION Warm cache before restarting payment-worker on payments-03. Waiting for a person. ON-CALL 03:04 · one look Case #2041 Finding, evidence and a proposed action, already written. Approve Case #2041 · closed Approved by a person at 03:04. Action ran. No 3 a.m. page. acts only with approval · always under human control

Govern

Hub

One registry of every node, its agent version and its active signed policy. Roll a policy out; see who refused it.

A node cannot be told to route around a policy by anything on the node. An unsigned policy is refused and reported, never applied.

phase two

Hub: a signed policy rolls out across the fleet; an unsigned one is refused The Hub holds a registry of every node, its agent version and its active policy. A newly signed policy rolls across a grid of thirty-two nodes; each turns purple as it applies. One node refuses an unsigned policy and is flagged. Animated in nine-second loops; static when reduced motion is requested. HUB fleet registry · node, agent version, active policy policy auth-and-privilege v3 signed: platform-team class: evidence route: hot + lake mask: user.ip, session.token roll out → 32 nodes 31 on v3 1 refused · unsigned policy agent 0.9.2 on 30 · 0.9.1 on 2 ams-1 · eu-west · payments + edge-retail node-29 refused: policy not signed reported, not applied a node cannot be told to route around a policy by anything on the node · phase two

Protect

Seal

Fields masked on the node, before the event leaves. Data held inside a region boundary you draw.

Policies name the fields; Seal enforces them per class and per hierarchy level. Residency is where the bucket is, not a clause in a contract.

phase two

Seal: fields masked on the node, data held inside a region boundary An event record with user, IP address, session token and command passes through Seal on the node. The IP and token are masked before the record leaves. The record then lands inside a dashed region boundary around the lake; a lock closes. Animated in nine-second loops; static when reduced motion is requested. ON THE NODE values are masked before anything leaves Seal mask · residency EU-WEST · YOUR ACCOUNT CosmoLake · nothing crosses this line EVENT · sudo user j.okafor ip 10.4.8.21 token eyJhbGciOiJIUzI1 cmd systemctl restart hier ams-1/eu-west/payments/node-17 Masked on the node. CosmoStream, CosmoLake and CosmoTrace never receive the original value. Held in your region. Residency is where the bucket is, not a contract clause. policies name the fields; Seal enforces them per class and per hierarchy level · phase two

The coordinate

One identity for every event

At acceptance CosmoStream assigns stream_id + epoch + seq. It is carried unchanged through hot storage and the lake. Dedup, watermarks and gap detection are properties of the coordinate, so there is no overnight reconciliation job and no drift between what the console shows and what the lake holds.

stream_id  = <datacenter>/<region>/<cluster>/<node>/<source>
epoch      = monotonically increasing per agent restart
seq        = monotonically increasing within an epoch

Two durability planes sit under that one identity. The stream plane carries audit, errors and protected evidence from node to query in milliseconds. The object plane takes economy data straight to open columnar storage and skips the hot tier.

Investigate

Who changed payment-worker, and did it break checkout?

The question an on-call engineer asks at 3 a.m. This is how CosmoConsole answers it from evidence CosmoEdge already captured on the node, and what Ops Agent does with the same steps. CosmoConsole is in development; this describes the design, not a shipped screen.

1 · Collect
SSH login, sudo, exec, the process tree, logs, traces and error metrics — captured on the node by CosmoEdge, classified as evidence, never sampled.
2 · Timeline
The console rebuilds login → command → process → metric shift in seconds, from the coordinate, with no join across tools.
3 · Graph
User → sudo → process → service → trace. Observed links, not inferred ones.
4 · Finding
A privileged restart caused a short checkout dip. Every sentence in the finding points at a raw event you can open.
Ops Agent
Runs steps one to four unattended and proposes an action — here, warm the cache before restarting. A person approves it. On-call gets the finished case, not the page.

Where it sits

Not another dashboard. A controlled telemetry fabric.

Three kinds of product exist in this category. CosmoTrace is deliberately none of the first two.

| | CosmoTrace | Full platforms | Collectors | | --- | --- | --- | --- | | Investigate incidents | Evidence-first | Strong UIs | No | | Pay for raw ingest? | Classify first | Often yes | Not applicable | | Own your storage | Open formats on your bucket | Varies; often lock-in | No | | Small edge footprint | Measured, published | Varies | Strong | | Unattended operations | Ops Agent, native | Add-on modules | No | | Rip and replace? | No — coexists | No | Yes |

Modules

Buy what you need. Run it where you must.

CosmoEdge
Collection on the node. Required. Ships now.
CosmoStream
Policy and routing. Required if you use the lake or the console. Ships now.
CosmoLake
Storage and query on your object store. Ships now.
CosmoConsole + Ops Agent
The estate view, timelines, evidence graph, unattended investigation. Phase two.
Hub
Fleet registry: node, agent version, signed policy. Phase two.
Seal
Masking and residency controls for regulated estates. Phase two.

Managed or on your own hardware, the modules are built from the same artifacts: the images and binaries we operate for you are the ones you can download and run yourself. What you evaluate managed is what you would run on-prem — there is no separate enterprise build to trust.

Start with CosmoEdge.

It is the part engineers judge us on, and the part you can test on one node this week.

Read the agent pageRequest a demo