| 1 | # Events Tab |
| 2 | |
| 3 | The **Events tab** provides a powerful feed that tracks key activities across your infrastructure and Space. It helps you investigate historical events, making it easier to correlate changes with anomalies or node behavior. |
| 4 | |
| 5 | Use the Events feed to: |
| 6 | |
| 7 | - Quickly identify what happened before or after a node went offline. |
| 8 | - Attribute sudden metric changes to specific environment events. |
| 9 | - Access a detailed history of alert transitions and node state changes. |
| 10 | |
| 11 | :::note |
| 12 | |
| 13 | Based on your Space plan, the time range available for querying past events may vary. |
| 14 | |
| 15 | ::: |
| 16 | |
| 17 | ## Available Event Domains |
| 18 | |
| 19 | The Events feed provides visibility into the following event types: |
| 20 | |
| 21 | | **Event Domain** | **Community** | **Homelab** | **Business** | **Enterprise On-Premise** | |
| 22 | |-----------------------------------------|---------------|-------------|--------------|---------------------------| |
| 23 | | **[Auditing events](#auditing-events)** | 4 hours | 90 days | 90 days | User-dependent | |
| 24 | | **[Topology events](#topology-events)** | 4 hours | 14 days | 14 days | User-dependent | |
| 25 | | **[Alert events](#alert-events)** | 4 hours | 90 days | 90 days | User-dependent | |
| 26 | |
| 27 | ## Auditing Events |
| 28 | |
| 29 | These events log user actions and Space configuration changes: |
| 30 | |
| 31 | | **Event Name** | **Description** | **Example** | |
| 32 | |-------------------------|------------------------------------------|---------------------------------------------------------------------------------| |
| 33 | | Space Created | A new Space was created. | Space `Acme Space` was **created**. | |
| 34 | | Room Created | A Room was added to the Space. | Room `DB Servers` was **created** by `John Doe`. | |
| 35 | | Room Deleted | A Room was removed from the Space. | Room `DB Servers` was **deleted** by `John Doe`. | |
| 36 | | User Invited to Space | A user was invited to join the Space. | User `John Smith` was **invited** by `Alan Doe`. | |
| 37 | | User Removed from Space | A user was removed from the Space. | User `John Smith` was **removed** by `Alan Doe`. | |
| 38 | | Silencing Rule Created | A new silencing rule was added. | Silencing rule `DB Servers schedule silencing` was **created** by `John Smith`. | |
| 39 | | Silencing Rule Changed | An existing silencing rule was modified. | Silencing rule was **changed** by `John Doe`. | |
| 40 | | Silencing Rule Deleted | A silencing rule was removed. | Silencing rule was **deleted** by `Alan Smith`. | |
| 41 | |
| 42 | ## Topology Events |
| 43 | |
| 44 | These events track changes to node connectivity and state: |
| 45 | |
| 46 | | **Event Name** | **Description** | **Example** | |
| 47 | |---------------------|--------------------------------------------------|---------------------------------------------------------| |
| 48 | | Node Became Live | Node started streaming metrics to Cloud. | Node `netdata-k8s-state-xyz` is **live**. | |
| 49 | | Node Became Offline | Node stopped streaming metrics, fully offline. | Node `ip-xyz.ec2.internal` is **offline**. | |
| 50 | | Node Created | Node was created but not yet seen by Cloud. | Node `ip-xyz.ec2.internal` was **created**. | |
| 51 | | Node Deleted | Node was hard deleted from the Space. | Node `ip-xyz.ec2.internal` was **deleted (hard)**. | |
| 52 | | Agent Connected | Agent connected to the Cloud server (MQTT link). | Agent `7d87bqs9-cv42-4823-8sd4-3614548850c7` connected. | |
| 53 | | Agent Disconnected | Agent disconnected from the Cloud server. | Agent disconnected due to **Connection Timeout**. | |
| 54 | |
| 55 | ## Alert Events |
| 56 | |
| 57 | These events log alert state transitions for node metrics: |
| 58 | |
| 59 | | **Event Name** | **Description** | **Example** | |
| 60 | |--------------------------|---------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| |
| 61 | | Node Alert State Changed | Records state changes such as Cleared, Warning, Critical, Removed, Error, or Unknown. | Alert `httpcheck_web_service_bad_status` on node `netdata-parent-xyz` escalated to **CRITICAL** with value **25%**. | |
| 62 | |
| 63 | ## Who Can Access Events? |
| 64 | |
| 65 | | **User Role** | **Event Domains Accessible** | |
| 66 | |--------------------|-------------------------------------------------| |
| 67 | | Administrators | All event domains (Auditing, Topology, Alerts). | |
| 68 | | Non-administrators | Topology and Alerts only. | |
| 69 | |
| 70 | :::note |
| 71 | |
| 72 | See the [Role-Based Access model](/docs/netdata-cloud/authentication-and-authorization/role-based-access-model.md) for details. |
| 73 | |
| 74 | ::: |
| 75 | |
| 76 | ## How to Use the Events Feed |
| 77 | |
| 78 | 1. Click the **Events** tab. |
| 79 | 2. Define the timeframe using the [Date and Time selector](/docs/dashboards-and-charts/visualization-date-and-time-controls.md#date-and-time-selector). |
| 80 | 3. Apply filters from the right-hand bar, such as **event domain**, **node**, **alert severity**, or **time range**, to focus on the data you need. |
| 81 | |
| 82 | :::note |
| 83 | |
| 84 | If your query exceeds the retention limits of your plan, an error will indicate that the requested data is outside your allowed timeframe. |
| 85 | |
| 86 | ::: |