Observability, as a modern IT O&M management philosophy, goes far beyond traditional monitoring. It emphasizes not only the detection of issues but also the ability to gain comprehensive, in-depth, and understandable insights into a system's runtime state. By collecting and analyzing various observable data — including metrics, logs, Traces, events, and alerts — it builds a holistic monitoring and analysis framework that empowers IT O&M teams to understand system health, performance, and root causes of failures in real time within complex and ever-changing IT environments.
The CanWay BlueWhale Full-Stack Observability Center (hereinafter referred to as the "Full-Stack Observability Center"), a full-stack observability product developed by CanWay, has undergone continuous refinement and iteration. It currently delivers observability across multiple domains, including full-stack monitoring of business system resources, Kubernetes container monitoring, cloud platform monitoring, hardware device monitoring, website synthetic monitoring, unified log management, application performance monitoring (APM), business scenario monitoring, and closed-loop alert management.
01 Product Scenarios
1. System Monitoring
CMDB-based full-stack system resource monitoring of business applications and their associated resources (hosts, databases, middleware, and other business resource components) — all at a glance.
Starting from the business perspective, the platform visualizes business resource topology and supports drill-down into metrics and alert details at each topology node. It also supports switching to a resource-centric view, displaying the monitoring status of all resources grouped by resource type.
2. Container Monitoring
Leveraging container-native resource probes, the platform enables unified monitoring of metrics and logs for containers and the components running within them — an essential Cloud-Native monitoring tool.
Container Metrics Monitoring
Container Log Monitoring
3. Cloud Monitoring
Cross-cloud platform monitoring from a cloud resource perspective, delivering unified Monitoring and Alerting for both private and public cloud environments — with integrated on-premises and cloud resource monitoring.
The platform supports out-of-the-box integration with VMware, FusionCompute, H3Cloud, Alibaba Cloud, Tencent Cloud, and more. It provides both single-cloud and cross-cloud resource views. For private clouds, it supports automatic discovery of resource instance association topology to assist in troubleshooting and fault localization.
4. Hardware Monitoring
Unified monitoring of metrics, logs, and alerts for hardware devices via standard protocols including SNMP, IPMI, Syslog, and Trap.
Hardware Metrics Monitoring
Hardware Log Monitoring
Network Topology Management: Supports user-defined network topology and, combined with automatic topology discovery capabilities, assists in generating network monitoring diagrams to provide a comprehensive overview of the enterprise network landscape.
5. Website Synthetic Monitoring
From a business perspective, black-box monitoring of application services and websites is performed via remote access protocols such as HTTP(S), TCP, UDP, and ICMP (Ping), providing the most fundamental availability monitoring for business services.
6. Unified Log Management
A unified log management solution that covers log ingestion, unified configuration policies, and unified search and retrieval — bridging the "last mile" of IT O&M log troubleshooting.
Supports log collection from host operating systems and container environments, with a variety of built-in log collection templates. Existing logs can be ingested via Elasticsearch or Kafka for centralized log management.
Supports log monitoring for log metrics and keywords, as well as intelligent clustering-based metric monitoring.
Log search supports AI-powered intelligent clustering, union queries, and other retrieval modes, with data masking capabilities.
7. APM
Distributed service call chain monitoring that automatically generates service call topologies. It drills down through four layers — application, service, interface, and invocation — to monitor application health and call performance. It also supports linkage and drill-down analysis with infrastructure monitoring to facilitate Root Cause Analysis (RCA) and improve fault localization efficiency.
Supports multi-perspective analysis and issue tracking through application service call views, application resource association views, service analysis views, interface analysis views, and Trace call chain views.
8. Business Monitoring
Using business scenarios as the entry point, the platform correlates cross-application system calls, maps the invocation relationships between services within associated applications, and traces every activity.
9. Unified Alerting
Designed for enterprise ECCs, monitoring teams, and IT O&M personnel, the platform implements closed-loop alert management based on the alert lifecycle management, improving team efficiency and ensuring business stability.
The platform provides a one-stop alert handling center: including unified alert event ingestion, alert enrichment, alert compression (deduplication, merging, alert suppression, and muting), alert handling (auto-remediation, ticket dispatch, and notification), and closed-loop alert closure management, as well as unified alert querying, statistical reporting, and alert correlation analysis to assist in issue localization.
02 Product Capabilities
To deliver the observability scenarios described above, the product architecture combines the PaaS + SaaS philosophy. It abstracts the common capabilities across scenarios into a unified underlying capability framework that integrates with the enterprise's existing IT O&M toolchain, supporting extensible upper-layer scenarios to meet evolving observability and management needs. From bottom to top, the architecture consists of five layers — Monitoring Objects, Data Integration, Data Platform, Capability Center, and Observability Scenarios — plus an External Integration module.
Monitoring Objects: Following the layered structure of business systems, the enterprise's monitoring objects are categorized as follows: data center facilities (rooms, cabinets, and environmental monitoring objects), computing, storage, networking, and security hardware devices, virtualization, cloud, OS, and container system resources, databases, middleware, and other general infrastructure components, and business applications, scenarios, and services.
Data Integration: Through multiple data ingestion channels — including Agent, Plugin, SNMP, Script, JMX, JDBC/ODBC, OT protocols, SDK probes, synthetic monitoring, and data reporting pipelines — the platform centrally ingests performance metric data, log data, Trace data, event data, and alert data.
Data Platform: Centrally provides data cleansing, data transmission, data storage, data querying, and data computation capabilities.
Capability Center: Provides differentiated data processing capabilities by data type. For example: detection, prediction, correlation, and retrieval for metric data; parsing, keyword monitoring, clustering, and retrieval for log data; call chain, topology, relationship, and analysis for Trace data; deduplication, alert convergence, correlation, and Root Cause Analysis (RCA) for alert data; and dashboard, reporting, and data retrieval visualization capabilities for end users.
Observability Scenarios: Five core scenarios organized by observability for IT O&M domains — Monitoring Center, Log Center, APM Center, Business Monitoring, and Alert Center — plus cross-scenario data linkage analysis and user-defined scenarios built on top of observability capabilities.
External Integration: This can be considered in two parts: first, ingesting data from external systems, such as integrating with third-party monitoring, alerting, and log systems for centralized data management; second, interfacing with external systems for coordinated management, such as integrating with an external Configuration Management Database for monitoring object management, or with external IT automation and ticketing system platforms for alert handling.
Based on the functional architecture outlined above, this article introduces the current capabilities of the Full-Stack Observability Center across five foundational areas: Object and Metric Management, Plugin Integration Management, Policy Configuration Management, Alert View Management, and Scenario View Management.
1. Object and Metric Management
Object Model
A monitoring object model is introduced as the carrier for metric management, linking objects to their metrics. The monitoring object model is designed as follows:
Hierarchical Object Model Framework
Using the tree-based hierarchical design of the monitoring object model, the platform maps to the hierarchical structure of IT O&M objects, enabling object model definition and layered design. For example, under the Component & Service layer for databases, we can abstract a series of monitoring objects such as MySQL, MSSQL, and Oracle, building a three- or even four-tier object model to flexibly accommodate the enterprise's hierarchical management needs.
CMDB Integration for Resource Instance Association
By associating the monitoring object model with the CMDB model, resource instances under the CMDB model are managed as monitoring object model instances, establishing the linkage between monitoring object models and resource instances.
Plugin-Based Collection for Metric Framework Implementation
By associating plugins or metric reporting tasks with the monitoring object model, metrics are linked to objects. This approach serves as the method for metric data acquisition, ensuring that all metrics are genuinely collectible, accessible, and measurable — thereby building the metric framework for each object.
Metric Management
Object-based metric management supports the management of metric classification, name, description, unit, severity level, and data type. It also supports enumeration-type metric value mapping for status metric translation and display.
Supports derived metric management, where new derived metrics are defined by computing from plugin-native metrics. The computation engine supports single-metric function calculations, multi-metric arithmetic operations, and complex PromQL-based calculations, flexibly accommodating various derived metric application scenarios.
Dynamic Grouping
Groups monitoring objects based on attribute conditions with dynamic update capabilities, enabling monitoring targets to be automatically applied or removed based on CMDB instance changes.
2. Plugin Integration Management
Through plugins, protocols, SDKs, and other data ingestion methods, the platform supports enterprise full-stack observability data (metrics, logs, Traces, alerts) ingestion.
Metric Ingestion
In addition to built-in metric collection capabilities for operating systems, cloud platforms, Kubernetes containers, and protocol-based synthetic monitoring, the platform supports multiple custom ingestion methods — all of which can be configured and debugged directly from the product UI.
Custom plugins for metric ingestion: Supports online creation of plugins of various types and protocols, including Script, SQL (Oracle/MySQL/DB2), Exporter, DataDog, JMX, BK-Pull, and SNMP.
Custom metric ingestion: Supports HTTP API / bkmonitorbeat CLI.
K8s custom metric ingestion: Supports ServiceMonitor (recommended) and PodMonitor for custom ingestion.
Third-party monitoring metric ingestion: Data integration via monitoring source plugins; built-in Kafka monitoring source plugin.
Log Ingestion
Supports log collection from host operating systems and container environments, with a variety of built-in log collection templates. Existing logs can be ingested via Elasticsearch or Kafka.
Trace Ingestion
Supports SkyWalking and OpenTelemetry protocol probe ingestion.
Alert Ingestion
Supports RestAPI push ingestion by default. Also supports custom alert source plugin development via the UI, with both push and pull modes. Built-in plugins for common monitoring systems are included.
3. Policy Configuration Management
Monitoring Policies: Support four types of configuration — basic information, monitoring targets, detection rules, and alert configuration:
Monitoring Targets: Supports multiple selection modes: instance-based list mode, CMDB instance topology selection mode, dynamic policy deployment based on CMDB topology nodes, and dynamic policy deployment based on dynamic groups.
Detection Rules: Supports 8 anomaly detection algorithms, anomaly debounce and convergence, no-data anomaly detection, and anomaly recovery detection — meeting IT monitoring requirements across various enterprise scenarios.
Alert Configuration: Supports alert dispatching, ticket creation, auto-remediation, and other handling configurations, along with settings for effective time windows, notification templates, notification frequency, and notification channels. Detailed alert handling configurations will be covered in a dedicated article on alert management platform functionality.
4. Alert View Management
A real-time refreshing active alert list with customizable display fields, multiple filtering conditions, real-time alert search, and custom alert views — meeting the viewing needs of ECCs, administrators, and other roles.
Analytics-oriented alert details support unified viewing of details, metrics, correlated alerts, topology associations, and workflow records — enabling one-stop alert analysis.
Object/business-based alert classification, statistical analysis, and built-in alert statistical reports help track the effectiveness of enterprise intelligent alert management governance.
Detailed full alert lifecycle closed-loop management will be covered in a dedicated article.
5. Scenario View Management
In addition to the built-in observability scenarios mentioned at the beginning of this article, the platform also supports custom scenarios. Users can extend monitoring scenario views for each object type based on the monitoring object model, meeting the evolving needs of the enterprise.
Data retrieval supports metric, log, and Trace search — enabling log retrieval and troubleshooting, and unlocking the value of operational data.
Integrated Grafana dashboards allow users to create personalized metric and log analysis dashboards according to their preferences.
Based on the five foundational capability modules — Objects, Collection, Policies, Alerts, and Views — described above, enterprises can freely build the observability scenarios they need. In upcoming articles, we will provide detailed introductions from the observability scenario perspective, covering nine major topics: full alert lifecycle management, infrastructure component monitoring, container monitoring, cloud platform monitoring, hardware monitoring, website synthetic monitoring, unified log management, distributed tracing, and business monitoring. Stay tuned.
