| 1 | --- |
| 2 | title: Healthcheck (InfluxDB + Telegraf) |
| 3 | description: Monitor endpoint and SIEM health signals via Telegraf metrics stored in InfluxDB. |
| 4 | --- |
| 5 | |
| 6 | # Healthcheck (InfluxDB + Telegraf) |
| 7 | |
| 8 | **Menu:** Healthcheck |
| 9 | |
| 10 | **Best for:** Admin / Engineer (primary) + Operator (awareness) |
| 11 | |
| 12 | CoPilot’s Healthcheck ties into **InfluxDB** to surface health signals collected by **Telegraf**. |
| 13 | |
| 14 | Typical signals include: |
| 15 | - CPU consumption |
| 16 | - memory consumption |
| 17 | - disk space utilization |
| 18 | |
| 19 | This is useful for detecting spikes, capacity issues, and “slow burn” failures before they impact your SIEM. |
| 20 | |
| 21 |  |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | ## How it works (high level) |
| 26 | |
| 27 | 1) **Telegraf** runs on endpoints/servers and collects metrics (cpu/mem/disk) |
| 28 | 2) Metrics land in **InfluxDB** (CoPilot queries the InfluxDB `_monitoring` bucket) |
| 29 | 3) Health checks and thresholds create alert states (ok/info/warn/crit) |
| 30 | 4) CoPilot displays the resulting alerts in the Healthcheck UI |
| 31 | |
| 32 | --- |
| 33 | |
| 34 | ## What you can do in CoPilot |
| 35 | |
| 36 | ### Review active alerts |
| 37 | |
| 38 |  |
| 39 | |
| 40 | Use this to quickly see: |
| 41 | - what is currently broken / at risk |
| 42 | - which systems are trending toward failure |
| 43 | |
| 44 | ### Triage by severity |
| 45 | |
| 46 | Healthcheck alerts are categorized by severity (for example: **Critical**, **Warning**, **Info**, **Ok**). |
| 47 | |
| 48 |  |
| 49 | |
| 50 | --- |
| 51 | |
| 52 | ## What to monitor (recommended) |
| 53 | |
| 54 | ### CPU |
| 55 | - sustained high CPU on Graylog/Wazuh components can cause ingestion/alerting lag |
| 56 | |
| 57 | ### Memory |
| 58 | - memory pressure can lead to OOM kills and unstable services |
| 59 | |
| 60 | ### Disk |
| 61 | - disk thresholds are the most common SIEM failure mode (indexes stop accepting writes) |
| 62 | |
| 63 | --- |
| 64 | |
| 65 | ## Practical runbook (when something trips) |
| 66 | |
| 67 | 1) Identify what triggered (disk vs cpu vs mem) |
| 68 | 2) Identify the system/host |
| 69 | 3) Decide whether this is: |
| 70 | - a transient spike |
| 71 | - a sustained capacity issue |
| 72 | - a misconfiguration (wrong retention / noisy ingestion) |
| 73 | 4) Take action: |
| 74 | - disk: snapshot/restore + retention tuning + index cleanup |
| 75 | - cpu/mem: scale resources, tune ingestion, investigate heavy queries |
| 76 | |
| 77 | Related pages: |
| 78 | - [Index management (Wazuh Indexer)](/user/ui/indices-management) |
| 79 | - [Snapshot & restore (cold storage)](/user/ui/indices-snapshots) |
| 80 | |
| 81 | --- |
| 82 | |
| 83 | ## Advanced: check names and thresholds |
| 84 | |
| 85 | Depending on your deployment, Influx may expose many checks. |
| 86 | |
| 87 |  |
| 88 | |
| 89 | If you want to standardize what shows up in CoPilot, define consistent Telegraf inputs and consistent alert thresholds. |
| 90 | |
| 91 |  |
| 92 | |
| 93 | --- |
| 94 | |
| 95 | ## Common gotchas |
| 96 | |
| 97 | ### “Healthcheck is empty” |
| 98 | Common causes: |
| 99 | - Telegraf isn’t deployed or isn’t shipping metrics |
| 100 | - InfluxDB connector isn’t configured in CoPilot |
| 101 | - wrong org/bucket configuration (CoPilot expects `_monitoring`) |
| 102 | |
| 103 | ### “Alerts are noisy” |
| 104 | Tune thresholds to avoid flapping (especially CPU) and focus on sustained conditions. |