--- title: "Observability and troubleshooting" description: "Observe and troubleshoot self-managed Calico Enterprise clusters with Manager UI dashboards, Service Graph, packet capture, and Elasticsearch logs." product: "Calico Enterprise" version: "3.23 (latest)" section: "Observability" canonical_url: "https://docs.tigera.io/calico-enterprise/latest/observability/" --- # Observability and troubleshooting See what's going on in your cluster with network observability tools and detailed logging. ## Getting started ##### [Web console tutorial](https://docs.tigera.io/calico-enterprise/latest/observability/get-started-cem.md) [Tour of the Calico Enterprise Manager UI navbar covering dashboards, Service Graph, policies, alerts, Kibana, and packet capture controls.](https://docs.tigera.io/calico-enterprise/latest/observability/get-started-cem.md) ##### [Manage alerts](https://docs.tigera.io/calico-enterprise/latest/observability/alerts.md) [Configure alerts and review alert events for Calico Enterprise features from the Manager UI or CLI. Use built-in templates for visibility and security.](https://docs.tigera.io/calico-enterprise/latest/observability/alerts.md) ##### [Kibana dashboards and logs](https://docs.tigera.io/calico-enterprise/latest/observability/kibana.md) [Use Kibana with Calico Enterprise Elasticsearch to explore flow, L7, audit, BGP, DNS, and intrusion detection event logs across managed clusters.](https://docs.tigera.io/calico-enterprise/latest/observability/kibana.md) ##### [Packet capture](https://docs.tigera.io/calico-enterprise/latest/observability/packetcapture.md) [Capture live pod traffic in self-managed Calico Enterprise clusters from Service Graph or the CLI and export pcap files to Wireshark for analysis.](https://docs.tigera.io/calico-enterprise/latest/observability/packetcapture.md) ##### [Network visualization](https://docs.tigera.io/calico-enterprise/latest/observability/visualize-traffic.md) [Use Service Graph in the Calico Enterprise Manager UI to visualize namespace, service, and pod communication patterns and investigate traffic flows.](https://docs.tigera.io/calico-enterprise/latest/observability/visualize-traffic.md) ##### [Review unused network policies](https://docs.tigera.io/calico-enterprise/latest/observability/review-unused-network-policies.md) [Find unused Calico Enterprise network policies and rules with Last Evaluated timestamps in the Manager UI or with calicoctl to maintain least privilege.](https://docs.tigera.io/calico-enterprise/latest/observability/review-unused-network-policies.md) ## Getting started with logs ##### [Overview](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md) [Calico Enterprise deploys an in-cluster Elasticsearch and Kibana stack for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to SIEMs.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md) ##### [Configure data retention](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/retention.md) [Set retention windows for Calico Enterprise flow, DNS, audit, BGP, L7, snapshot, and compliance report data in the in-cluster LogStorage resource.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/retention.md) ##### [Archive logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/archive-storage.md) [Forward Calico Enterprise flow, DNS, audit, and L7 logs to Syslog, Splunk, or Amazon S3 to retain compliance data beyond in-cluster Elasticsearch retention.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/archive-storage.md) ##### [Overview](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md) [Calico Enterprise deploys an in-cluster Elasticsearch and Kibana stack for flow, DNS, audit, BGP, and L7 logs with workload context, RBAC, and archival to SIEMs.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/overview.md) ##### [Configure RBAC for Elasticsearch logs and events](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/rbac-elasticsearch.md) [Set fine-grained Kubernetes RBAC permissions in Calico Enterprise to control access to Elasticsearch flow, audit, DNS, and intrusion detection event indices.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/rbac-elasticsearch.md) ##### [BGP logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/bgp.md) [Reference of key/value fields in Calico Enterprise BGP activity logs stored in Elasticsearch, with sample queries for IPv4, IPv6, and per-node lookups.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/bgp.md) ##### [Audit logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/audit-overview.md) [Calico Enterprise audit logs record changes to network policies, tiers, network sets, host endpoints, and other resources for security and compliance review.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/audit-overview.md) ## Flow logs ##### [Flow log data types](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/datatypes.md) [Reference of key/value fields that Calico Enterprise sends to Elasticsearch for flow logs, including endpoints, actions, byte counts, and policy verdicts.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/datatypes.md) ##### [Filter flow logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/filtering.md) [Filter Calico Enterprise flow logs through Fluentd to drop low-significance traffic and reduce in-cluster Elasticsearch volume and cost.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/filtering.md) ##### [Configure flow log aggregation](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/aggregation.md) [Tune Calico Enterprise flow log aggregation levels to balance Elasticsearch volume and cost against pod and IP visibility for allowed and denied traffic.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/aggregation.md) ##### [Enable HostEndpoint reporting in flow logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/hep.md) [Turn on host endpoint reporting in Calico Enterprise flow logs to gain visibility into traffic at HostEndpoint interfaces on Kubernetes nodes.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/hep.md) ##### [Enable process-level information in flow logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/processpath.md) [Add process executable paths and arguments to Calico Enterprise flow logs with eBPF instrumentation for process-level visibility into network activity.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/processpath.md) ##### [Enabling TCP socket stats in flow logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/tcpstats.md) [Add TCP socket statistics to Calico Enterprise flow logs with eBPF programs that capture round-trip time, retransmits, and other per-socket metrics.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/flow/tcpstats.md) ## DNS logs ##### [Configure DNS logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/dns-logs.md) [Reference of key/value fields in Calico Enterprise DNS activity logs stored in Elasticsearch, with guidance for constructing client and query lookups.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/dns-logs.md) ##### [Filter DNS logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/filtering-dns.md) [Suppress low-value Calico Enterprise DNS log entries with Fluentd filters configured through a ConfigMap in the operator namespace.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/dns/filtering-dns.md) ## L7 logs ##### [Configure L7 logs](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7/configure.md) [Deploy Envoy and aggregate Calico Enterprise L7 logs to monitor HTTP traffic patterns between application workloads in self-managed clusters.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7/configure.md) ##### [L7 log data types](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7/datatypes.md) [Reference of key/value fields that Calico Enterprise sends to Elasticsearch for L7 logs, including durations, byte counts, and HTTP request metadata.](https://docs.tigera.io/calico-enterprise/latest/observability/elastic/l7/datatypes.md)