How can we help?

Check the Time range in the top bar first. It applies to almost every page and defaults to a short window. Choose a longer one and look again. The picker offers ranges up to what your plan keeps: 14 days on Trial, 30 on Standard and 90 on Enterprise.

Then check the Workspace in the account menu. Each workspace and environment has its own data.

Open the account menu and look at Time zone. It is either Local or UTC and it applies to every timestamp in the app. Usage counts on Usage & Billing always reset at 00:00 UTC, whichever you choose.

The Solution Area pages (NexusView, AppPulse, NeuralWatch, Prism, StreamLens, VaultGuard, SentinelView, FlowForge, LedgerPulse) and the Payments pages have a Preview with sample data switch. When it is on, the page shows a banner reading “Sample data — not from your systems” and every card carries a Sample badge. None of it describes your workspace. Choose Hide sample data to return to your own data.

In Query Studio, the section called “Sample-data query (legacy)” also reads example data only, never your OpenTelemetry data.

The top bar shows “Updated … ago”. Choose Refresh there, or Reload in the account menu to reload the whole workspace. If the status line says “Refresh failed”, wait a minute and try again. If it keeps failing, contact support with the time it started.

You are probably a Viewer. Viewers can read everything in the workspace but cannot change it. Pages say so with notes such as “View only”, “Read-only mode” or “Only workspace admins can…”. Your role is shown at the top of the account menu. Ask an admin in your organization to make the change or to make you an admin. See what each role can do.

Continue with Google or Microsoft always means a personal account. If your company has set up single sign-on, those buttons are refused and you must use the company SSO button instead.

The message is the same whether the email is unknown or the password is wrong. We do this on purpose so the form cannot be used to discover who has an account.

• Check the email for typos, and that you are using the address you signed up or were invited with.
• Use Show beside the password field to check what you typed.
• If you normally use a company SSO button or Google or Microsoft, your account may have no password at all. Use that button.
• Otherwise choose Forgot password?

Five failed attempts in 15 minutes locks sign-in for that email from your network. See the next answer.

After 5 failed attempts within 15 minutes, sign-in for that email address from your network is blocked for 15 minutes. Nobody can lift the block early, including support. Wait 15 minutes, then sign in once with the right password. If you are not sure of the password, request a reset link while you wait.

1. On the sign-in form choose Forgot password?
2. Enter the email you sign in with and choose Send reset link.
3. Open the email with the subject “Reset your Onyx Insights password” and follow the link within 1 hour.
4. Choose a new password of at least 8 characters. Longer, with numbers or symbols, is stronger.

The form always answers that a link is on its way if the account exists. It never confirms whether an address is registered.

• Check spam and quarantine folders for the subject “Reset your Onyx Insights password”.
• Make sure you entered the address the account uses. No email is sent for an address with no account.
• Accounts that sign in through a company identity provider have no password, so no reset email is sent. Use your company SSO button.
• If your company filters mail, ask your mail administrator to allow mail from Onyx Insights.

Reset links work for 1 hour and only once. A link can also stop working earlier when the service is updated. Request a new link and use it straight away. If you requested several, only use the newest email.

Your organization's admins connected an identity provider, and it now decides how people in your organization sign in. Personal Google or Microsoft sign-in and Onyx accounts are refused so that they cannot bypass your company's own sign-in rules. Type your work email on the sign-in form and use the Continue with <company> SSO button that appears.

A session lasts 12 hours from the moment you sign in, whether or not you are active. After that you sign in again. There is no separate idle timeout.

That is intended. When you choose Logout, the next single sign-on from that browser asks your identity provider to authenticate you again instead of silently reusing its session. It protects shared computers.

Each email address belongs to one account. Sign in instead, or reset the password. If you were trying to join a colleague's organization, you need an invite sent to an address that does not already have an account. See joining an existing team.

Organizations in banking and government are hosted in a dedicated region and cannot be created through self-service sign-up on this site. Contact support to have one set up. If you chose that industry by mistake, pick a different one and submit again.

1. Open the account menu and choose Security.
2. Beside Authenticator app choose Set up. Scan the QR code with an app such as 1Password, Google Authenticator, Microsoft Authenticator or Authy. If you cannot scan, type the key shown under the code.
3. Enter the 6-digit code from the app. You have 15 minutes before the setup times out.
4. Save the 10 recovery codes that appear. Use Copy or Download .txt. This is the only time they are shown.

You can also turn on Email code, which sends a 6-digit code to your address each time you sign in. We recommend the authenticator app, with email codes as a second method.

• Authenticator codes change every 30 seconds. Enter the current one.
• Set your phone's clock to automatic. A phone that is a minute or more off produces codes we cannot accept.
• Each code works once. If you just used it, wait for the next one.
• Make sure you picked the right method at the top of the form. An email code typed into the Authenticator field fails.
• Email codes expire after 10 minutes, and each one allows 5 attempts.

5 incorrect codes lock two-step verification on your account for 15 minutes. The lock covers every method, so switching from the authenticator to a recovery code does not get round it. Wait for the time shown, then try once with a code you are sure of.

1. On the verification step choose Recovery code and enter one of the codes you saved, in the form xxxxx-xxxxx. Each works once.
2. Or, if you turned on email codes, choose Email code.
3. Once you are in, open Security, remove the old authenticator, set up the new one, and choose Make new codes to replace your recovery codes.

If you have no working method left, write to support from the email address on the account. We have to verify who you are before changing sign-in settings, so this is slower than using a recovery code.

Look for the subject “Your Onyx Insights sign-in code”, including in spam. The code is never in the subject line. You can ask for another after 30 seconds, up to one a minute and five an hour. Only the newest code works. If none arrive, use a recovery code or your authenticator app.

After entering your password you have 10 minutes to complete the verification step. Go back to sign in and start again.

A QR code is valid for 15 minutes. Choose Set up again, delete the entry you added to your authenticator app earlier, and scan the new code.

This is a problem on our side, not with your code. Sign in with an email code or a recovery code, and tell support so we can look at it. Treat it as S2 if it stops people signing in.

An admin in your organization requires it for everyone. You are asked to turn on at least one method before you can continue, and the only other option is to sign out. While the requirement is on you cannot remove your only method. Add a second method first if you want to replace one.

1. Turn it on for your own account first. The setting stays disabled until you do.
2. Open Governance and find the two-step verification policy.
3. Tick Require two-step verification for all members.

Governance then shows how many people have not set it up yet. They are asked to the next time they use Onyx Insights. People who sign in through your single sign-on are not affected, because your identity provider handles their verification.

You sign in through your organization's single sign-on. Two-step verification for your account is handled by your identity provider, so ask your IT team about it.

You can use the product normally. Four actions wait for confirmation: creating API tokens, inviting team members, changing billing and enabling single sign-on. If you try one, you see “Confirm your email address before you …”.

Accounts created through your company's single sign-on, or with a Google account, are already confirmed. Accounts created with a personal Microsoft account are always asked to confirm.

Sign in and choose Resend email in the banner at the top of the app. The subject is “Confirm your email address for Onyx Insights”. The link works for 24 hours and only once. You can resend once a minute and five times an hour. If you see “A confirmation email was sent moments ago” or “Too many confirmation emails were requested”, wait for the time shown.

Sign in and use Resend email to get a new link. If you have several emails, only the newest link works. “This confirmation link is incomplete” means the address was cut off when copied. Open the link from the email itself.

If the app already says your address is confirmed, there is nothing more to do.

Open Governance, then Single sign-on. The “Service provider details” panel has the two values to copy into your identity provider:

• Metadata URL, which is also the SP entity ID. It ends in /api/sso/saml/metadata.
• ACS (reply) URL. It ends in /api/sso/saml/callback.

For OpenID Connect, register the redirect URI ending in /api/sso/oidc/callback on the same host.

SAML requirements: assertions must be signed, the response is sent by HTTP-POST, and the NameID should be the user's email address. Sign-in must start from Onyx Insights. A response we did not ask for is refused.

List your domains in Email domains, separated by commas. When someone types an address on one of those domains on the sign-in form, the company SSO button appears for them. People on those domains can then no longer use personal Google or Microsoft sign-in.

A domain can belong to one organization only. “The email domain … is already claimed by another workspace” means another organization listed it first. Contact support if that organization is not yours.

Their account is created automatically as a Viewer, with the email marked as confirmed. They have no Onyx Insights password and cannot set one, and the Security dialog tells them two-step verification is handled by your identity provider. An admin can change their role on the Team page.

1. Save the settings, then choose Test single sign-on. It opens your sign-in page in a new tab.
2. Keep your current admin tab signed in while you test, so you can correct the settings if the test fails.
3. Test with a second person before telling the whole company.

You can switch Status to Off at any time to go back to the previous sign-in methods.

1. Open Team and find Invite a member.
2. Enter their work email and choose a role, Viewer or Admin.
3. Choose Send invite. We email them a link and also show it to you once, so you can share it yourself.

An invite link works once, for that email address only, and expires after 7 days. The link is not shown again. If it is lost, send a new invite. Inviting the same address again cancels the earlier link.

• “Someone with this email already has an account.” An email belongs to one organization only. They must use a different address, or have their existing account removed by its own admin first.
• “All N seats on your plan are taken or invited.” Pending invites count towards seats. Revoke an invite you no longer need, remove a member, or upgrade.
• “Confirm your email address before you invite team members.” Confirm your own address first.
• “The email to … couldn't be sent.” The invite still exists. Copy the link shown and send it to them yourself.

Creating an account, including with Continue with Google or Microsoft, always creates a new organization. It never adds you to an existing one. To join your team, an admin there must invite you. Because an email can belong to one organization only, ask them to invite an address that does not already have an account, or contact support to have the account you created by mistake removed.

Custom roles are not available yet.

On Team, use Make admin, Make viewer or Remove on the member's row. Removal takes effect immediately and you can invite them again later. You cannot remove your own account (“Cannot remove own account”). Ask another admin. Keep at least two admins so that one person leaving does not lock the organization out of its settings.

Removing someone does not revoke API tokens they created. Review the token list in Governance when an admin leaves.

Work through these in order. Most cases end at step 1 or 2.

1. Open System. If requests are being refused, “Ingestion requests” lists them with the reason. A reason there tells you exactly what to fix.
2. Check the token. It must be the complete value, have the Ingest telemetry scope, belong to this workspace, and be neither revoked nor expired. A 401 always means the token. See 401 Unauthorized.
3. Check the endpoint. Copy it from Connect data rather than typing it. OTLP over HTTP uses the paths /v1/traces, /v1/logs and /v1/metrics. Most SDKs add them for you when you set only the base endpoint. If your workspace has its own address (https://<key>.<domain>), send to that address; a token is only accepted on its own workspace’s address once the shared address is retired, and a wrong address also answers 401.
4. Check the network. Your service needs outbound HTTPS to the ingest endpoint. Proxies and egress firewalls are the usual cause when nothing at all reaches us and System shows no requests.
5. Wait a minute, then widen the time range. Traces and logs usually show within a minute of your service starting. Metrics are exported about once a minute by default, so they arrive after traces and logs.
6. Check the workspace and the service name. Data goes to the workspace the token belongs to. Each service needs its own service.name, or several services appear as one.

To test the path without touching your code, open the Connect data setup page and expand “Check the connection with a test event”. It gives you a ready-made command that sends one event as the service onyx-test-event.

Every credential problem returns the same 401, so that the response cannot be used to probe for valid tokens. The System page shows the real reason to your admins. Check, in this order:

• The header is Authorization: Bearer <token>. For gRPC it is the authorization metadata key with the same value.
• The whole token was copied. Tokens begin with onyx_v2. and have three parts separated by dots. A missing last character is enough to fail.
• No quotes, spaces or line breaks were added by your secret store or YAML file.
• The token has the Ingest telemetry scope, has not expired and has not been revoked. Check it in Governance, under API tokens.
• The token belongs to the workspace you expect.

If the token was lost, it cannot be shown again. Create a new one and revoke the old one.

gRPC uses port 4317 on its own hostname, which is different from the HTTP endpoint. Connect data shows the gRPC endpoint when it is available for your workspace. Authentication and the 10 MB message limit are the same as for HTTP. If your network only allows port 443, use OTLP over HTTP.

• Metrics are exported on a timer, about once a minute by default. Give them two minutes.
• Many SDKs turn on traces by default but need the logs and metrics exporters enabled separately. Check OTEL_LOGS_EXPORTER and OTEL_METRICS_EXPORTER for your language.
• System lists each signal with its own “Last received”. If a signal has never arrived, the exporter for it is not running.

Open Integrations, then the Ingestion Shippers tab, and copy the URL for your shipper. These HTTP endpoints accept logs only. To send traces and metrics as well, use the OpenTelemetry setup instead.

• Authenticate with the header x-onyx-api-key: <token>. A token in the URL is not accepted.
• Name the workspace with ?workspace=<id> or the header x-onyx-workspace.
• Limits per request: 1 MB body, 500 events, 10,000 characters per message, 100 tags and 50 attribute keys per event.
• “No ingest events found in payload” means the body had no events in the shape that endpoint expects. Copy the example payload from the Integrations page.
• Your plan's daily limit applies here. See daily ingest limit.

Card numbers and bearer tokens are removed from every log line before it is stored, on every ingest path. Treat that as a safety net, and do not send secrets, card numbers or full phone numbers on purpose.

To mask anything else, open Logs, then Processing rules, and add a Mask text rule with a regular expression. Use Test on recent logs before saving. Rules run in order from the top, apply to new lines only, and reach the OpenTelemetry endpoint within about 10 seconds. A Drop lines rule discards matching lines permanently.

• Trace not found: no spans with that ID arrived within your plan's retention (7, 30 or 90 days). It has either aged out or is still arriving. Try again in a moment.
• “N spans' parent was not received”: a service in the request path is not instrumented, is sending to a different workspace, or dropped the span through sampling. Those spans are shown at the top level.
• “This trace has more spans than can be shown”: the first spans by start time are listed. Use Find spans to reach the rest.

Real user monitoring data is sent through the HTTP ingest endpoints, not OTLP. Payments pages fill in when your services tag payment spans and logs with payment.id. There are no payment provider credentials to enter. See the Payments monitoring guide. Payments is part of the Enterprise plan.

Name the token after where it will be used, tick the scopes it needs, choose an expiry (Never, 30 days, 90 days or 1 year; 90 days is the default) and choose Create API token. Copy the value at once. It is shown once and is not stored in a form we can show again.

No token, whatever its scopes, can manage members, other tokens, single sign-on or billing changes. Those need a signed-in admin. A workspace can hold 100 active tokens.

1. Create a new token with the same scopes.
2. Deploy it to your services.
3. Watch System until data is arriving and the old token's “last used” stops moving. That value can lag by up to 5 minutes.
4. Revoke the old token.

Revoking is immediate and cannot be undone. Telemetry sent with a revoked token is refused within about 10 seconds.

Give each credential read-only permissions at the provider. Onyx Insights only reads.

Connectors do not poll on a schedule yet. Choose Sync now on the connector, or Pull Data on its detail page, each time you want the latest data. The row then shows what the last pull returned.

For AWS, choose Select Services to pick what to monitor, then sync. Today EC2, RDS, ECS and ALB return metrics. The other services in the list can be selected but do not return data yet.

Saved credentials are write-only. After saving, the form shows asterisks and at most the last 4 characters, so you can tell which credential is in place. Nobody can read the full value back, including admins and Onyx staff. When you edit a connector, leave the masked value alone to keep it, or type a complete new value to replace it.

Queries stop after 10 seconds. Make the query read less: shorten the time range, add a filter on service, and group by fewer fields. A filter on an exact value is much cheaper than “contains”.

Same remedy as a timeout. Narrow the time range, add filters, or group by fewer fields. Grouping by a field with very many values, such as a trace ID, is the usual cause.

The text after it says which part is wrong. The limits are: 20 filters, 4 group-by fields, 8 aggregations, 50 values in an “is one of” filter, and 1 to 1,000 rows. Attribute keys may use letters, digits and _ . : / @ -, up to 128 characters.

“Not reachable” is a problem on our side. Try again in a moment, and contact support as S2 if it lasts more than a few minutes. Check System to see whether telemetry is still being accepted. “Not configured” appears on self-hosted deployments with no telemetry store connected. Ask your administrator.

• Every query follows the Time range in the top bar, including saved queries when you load them. Widen it.
• Log search matches text anywhere in the message and ignores case. It does not search attributes. Use the facets or Query Studio for those.
• In Logs, “Not applied while a trace is selected” means you are looking at one trace's lines. Clear the trace filter.
• Queries never read outside the current workspace.

Searches shorter than 4 characters cannot use the message index, so they read the whole time range. Type a longer word or choose a shorter range.

Live tail needs a time range that ends now, so it is disabled for custom ranges in the past. It checks for new lines every 5 seconds and keeps the newest 1,000 on the page. On a very busy service, add a service or severity filter so that the lines you care about are not pushed out.

Only workspace admins can save queries. Viewers can build and run them. A workspace holds up to 200 saved queries.

Service dependencies are worked out from traces, which is expensive, so those views read at most the last 6 hours even when a longer range is selected. Other pages use the full range, up to your plan's retention.

Rules are checked as events arrive, not on a timer. Today a rule fires when an incoming event matches the rule's signal, severity and service. The service match is “contains” and ignores case, and a field left at “Any” matches everything. Each firing opens an incident titled “<rule name> triggered”.

A rule with every field left at “Any” fires on every event. Set at least a service and a severity.

1. Look at the rule. Under Alert Rules, each rule shows either “Notifies: …” with its channels, or “No notification channel: alerts appear under Recent alerts only”. A rule with no channel raises alerts and incidents but tells nobody.
2. Change a rule's channels with Edit channels. A rule's channels are picked when it is created, under “Notify”, and can be changed at any time: choose Edit channels on the rule under Alert Rules, tick or untick channels, and choose Save channels. Rules created before channels could be chosen have none until you do this. Editing channels does not pause or resume the rule.
3. Check the channel. A channel marked “(disabled)” is skipped. Webhook and Slack destinations must be a full https:// URL to a public host: plain http://, private or internal addresses, localhost and URLs carrying a username or password are refused when the channel is saved. A channel saved before those checks existed that would be refused today shows needs attention with the reason; nothing is sent to it until the destination is replaced: choose Edit on the channel and enter the new destination. Saved destinations are masked, so if in doubt add the channel again with the complete value.
4. Check the receiver. Each notification is attempted up to three times, with an 8 second timeout per attempt; a receiver that answers with a 4xx status (other than 408 or 429) is not retried, because the request itself was rejected. The channel shows its last delivery and the error. For email, check spam for the subject “[Onyx Insights] Triggered: …”.

The alert itself is always recorded under Recent alerts and as an incident on Incidents, whether or not a notification went out. If a rule lists a channel, the incident exists, and nothing arrives on any channel type, contact support with the rule name, the channel name and type, and the time of the incident.

Under Alert Rules, Grouping & channels, enter a channel name, choose Webhook, Email, Slack or PagerDuty, and put the webhook URL, email address or routing key in Send to. Add channel does nothing if either the name or Send to is empty. Then choose the channel in step 5 of Create alert rule. A channel notifies nobody until a rule uses it.

Webhook URLs and routing keys are credentials, so after saving they are shown as the host and the last 4 characters only. “Enter the full webhook URL, routing key or email address” means a masked value was submitted as if it were new. Type the complete value. Email addresses are shown in full.

Make the rule narrower first: a specific service, a specific severity. Then, under Noise reduction, add a rule to suppress, deduplicate or throttle repeated alerts for a service.

Statuses, in order: open, acknowledged, investigating, monitoring, resolved. Severities run from SEV1, the most severe, to SEV4. New incidents you declare default to SEV3 with you as commander. Once an incident is resolved, a Postmortem box appears for what happened, the root cause and follow-ups. Only admins can declare or update incidents. Viewers see them read-only. A workspace keeps its most recent 1,000 incidents.

During the trial, data is kept for 14 days. The trial includes 5,000 logs/day as a soft limit; data is still accepted up to a 50,000 logs/day hard stop.

Payments monitoring is included in every plan. If Payments shows a paused notice, your subscription is not active: renew it from Plan and usage and Payments comes straight back.

The 14-day free trial is over, or the subscription has lapsed. An admin chooses Upgrade Plan on the overlay, or opens Usage & Billing and chooses Upgrade. Upgrading restores access. Admins get a reminder email 7 days and 1 day before a trial ends.

While a subscription is expired, the HTTP ingest endpoints answer 402 with “Subscription expired. Upgrade to continue ingesting data.”

The count resets at 00:00 UTC. Admins get an email when a workspace reaches 80% of the day's limit. There is a 10% allowance above the limit, and once usage passes 110% the HTTP ingest endpoints answer 429 until the reset. Either reduce what you send, for example with a Drop lines processing rule for debug logs, or upgrade.

Members and pending invites both count. On Team, revoke invites that will not be used and remove people who have left, or upgrade to a plan with more seats.

Your plan is managed by the Onyx Insights account team, not by card payment in the app. Contact your account manager or support to change plan or add a payment method. “Couldn't open checkout” followed by a note about confirming your email means exactly that. See email confirmation.

Every stored record carries the identity of the organization it belongs to, and every read is filtered by it on the server. The filter is added by the platform from your signed-in session or token. A query cannot name, change or leave it out, and there is no interface that runs free-form SQL. A token is bound to one workspace and is refused everywhere else.

• Passwords are stored only as salted, iterated hashes. Nobody can read a password back.
• API tokens are stored only as salted hashes. That is why a token is shown once.
• Connector credentials, alert webhook URLs and routing keys are write-only. The app shows a mask and at most the last 4 characters.
• Invite, reset and confirmation links are single use, time limited and stored only as hashes.
• Authenticator secrets are encrypted at rest. Recovery codes are stored as hashes.

Traces, logs and metrics are kept for 14 days on Trial, 30 days on Standard and 90 days on Enterprise, each record is kept for that many days from its own timestamp. After that the record is deleted. Usage & Billing shows the figure for your workspace as “Telemetry kept for”, and the time range picker offers ranges up to it. A 14-day trial keeps 14 days of data.

• Upgrading applies the longer period to telemetry received from then on. Records that arrived before the upgrade keep the period they arrived with. If you need your existing history extended as well, ask support and we will re-stamp it.
• Downgrading shortens the ranges the app offers straight away. Records already stored are deleted on the schedule they arrived with.
• After a trial or subscription ends, anything still being sent is kept for 14 days.
• Deletion runs in the background, so a record can stay a few hours past its period. It is not a way to keep data longer.

If Usage & Billing shows a shorter figure than your plan's, that is the figure the platform is applying to your workspace at the moment, and the time range picker follows it. Contact support and we will tell you why and when it changes.

If your contract states a different retention period, ask your account manager how it applies to your workspace.

Organizations in banking and government are pinned to a dedicated region, and a request that reaches the wrong site is refused with “Workspace … is pinned to … and cannot run on …”. If you see that message, contact support. The industry chosen at sign-up decides this, so tell us if yours was set incorrectly. For the hosting location of your own workspace, ask support or your account manager.

Admins can open Governance, then Audit trail, for the 30 most recent changes to tokens, members, invites and sign-in settings in the organization. Each entry names the person or the API token that made the change. It never contains a secret value. If you need older entries for an investigation, contact support with the date range.

There is no bulk export or self-service account closure in the app today. You can copy results from Query Studio and chart data tables, and download recovery codes. To close an organization, or to request deletion or a copy of your data, an admin should write to support from the address on their account. We confirm the request with your admins before acting on it.