Investigate
Traces
A trace is the set of spans that one request produced across services. MonitOps shows it as a waterfall, uses its spans to build the observed edges on the service map, and says plainly when the trace it shows is truncated or incomplete.
How it works#
Where a trace comes from#
A trace exists only if a sender sends spans. MonitOps stores them with the logs and metrics of the same source. A log line that carries a trace identifier links to its trace, and going back from that trace returns you to the same log line and filters. Traces are also reachable from the service map and from incidents.
Edges from spans#
When a span in one service has a parent span in another, MonitOps creates or refreshes an observed edge from the caller to the callee. Logs and service names alone never create an edge. See Service map.
The waterfall#
The waterfall lays the spans out in time under their parents. Each span shows its service, name, status and duration. Durations are computed from the timestamps the spans carry, as integer nanoseconds. A span's self time is its duration minus the time covered by its children, with overlapping children counted once, never summed.
In INC-20931, a trace through checkout-web, order-api and payments-gw shows the time spent in the call from order-api to payments-gw.
Error marks#
Spans with an error status are marked. The first error observed is labelled First observed error, qualified when the trace is incomplete. It marks where an error was first seen in the data. It is not a confirmed cause; the cause assessment weighs it with other evidence (see Cause assessment).
What a trace needs from the sender#
- Spans with trace and span identifiers, and a parent identifier propagated across service calls.
- The service name on the resource, as for any other signal.
- Logs that carry the trace identifier, so a log line can open its trace.
A service that sends no traces has no observed edges. A peer that sends no spans is shown as uninstrumented rather than drawn as observed.
What you see in the console#
The trace view shows a header with the number of spans returned and the total, the waterfall, a table and a keyboard-selectable tree, and a count of the logs for the trace in the window. Identifiers can be copied in full. Span attributes are shown as text, filtered by your role like log attributes (see Logs).
Limits and defaults#
- A trace read covers a window of at most 60 minutes.
- At most 2,000 spans are shown. When a trace has more, the view says how many are shown of how many.
Failure states#
| State | What the view shows |
|---|---|
| Truncated | A frame stating the span limit and the exact counts. Self-time totals are qualified |
| Incomplete | Spans whose parent is missing are grouped as orphans. A trace without its root is incomplete, not a healthy complete trace |
| Not found | An explanation that spans are missing, with the logs for that trace identifier |
| No trace identifier | The log line has no trace action |
| Busy | A read that exceeds capacity is refused with a retry interval, not shown as empty |
Related#
Last updated October 2026