Traces

Distributed traces, collected without code changes.

Finding a trace

Three tools, usable together:

• A facets sidebar — service, operation, status, duration bucket, and the rest — with counts, so you can narrow before you know what you are looking for.
• A KQL bar for precise queries when you do.
• A time-range bar, shared with Metrics and Logs, so switching tabs keeps your window.

The waterfall

Selecting a trace opens the span waterfall: every span, its parent, its duration, and its attributes.

The earliest span is not always the root

Queueing spans start before the span they belong to. The waterfall shows real parentage rather than ordering by start time — sorting by timestamp and calling the first row the root gives you the wrong answer on any request that waited in a queue.

HTTP attributes

Trace attributes come from eBPF instrumentation, so coverage varies by what the kernel could see. Where a field is genuinely empty it is shown empty — not backfilled with a plausible value.

From the CLI

rtz signals            # slowest operations by p99
rtz signals traces     # slowest individual traces
rtz trace list --since 2h --errors
rtz trace get <trace-id>   # the span tree, errors marked

See Logs, traces & metrics.