Overview
XIMP is composed of multiple service layers that collect, transport, store, and serve observability data to operators and automation systems. Understanding the architecture helps administrators plan deployments, troubleshoot ingestion issues, and optimize resource allocation for the monitoring platform itself.- XDeploy
- CLI
XIMP services are enabled and configured through the XDeploy Configuration panel:
Enable monitoring components
Toggle the monitoring services your deployment requires:
| Setting | Description |
|---|---|
| Enable Prometheus | Metric collection and time-series storage |
| Enable Grafana | Visualization dashboards and metric exploration |
| Enable Central Logging | Log collection, indexing, and search (OpenSearch + Fluentd) |
| CIS Compliance Level | Security compliance scanning tier |
| Scan Schedule | Automated compliance scan frequency |
Architecture Diagram
Service Components
| Layer | Component | Role |
|---|---|---|
| Collection | Metric Agent | Runs on each node; scrapes metrics from local services and exports to metric store |
| Collection | Log Collector | Tails log files and forwards structured log events to the log index |
| Collection | Flow Collector | Receives NetFlow/sFlow exports from network devices for traffic analysis |
| Storage | Metric Store | High-performance time-series database for metric retention and query |
| Storage | Log Index | Full-text search engine for log data with configurable retention |
| Storage | Flow Store | Database optimized for network flow record storage and aggregation |
| Serving | Query API | Unified query interface for metrics, logs, and flow data |
| Serving | Alert Engine | Evaluates rules against live metric and log streams; fires notifications |
| Serving | Dashboard | Web interface for visualization, exploration, and alert management |
Component Deep Dive
Metric Agent
Metric Agent
The Metric Agent runs as a systemd service (
ximp-agent) on every managed node.
It scrapes metrics from:- Local node exporters (CPU, memory, disk, network)
- Service-specific exporters registered as scrape targets
- Application endpoints exposing metrics in the standard format
Log Collector
Log Collector
The Log Collector tails configured log file paths and forwards events to the
Log Index. It handles:
- Multi-line log entries (stack traces, long SQL queries)
- JSON-structured log parsing for service logs
- Syslog reception for services that write to syslog instead of files
/etc/ximp/log-sources.yaml on each
managed node and managed by XDeploy.Alert Engine
Alert Engine
The Alert Engine evaluates all active alert rules against the metric and log
streams on each collection cycle. When a rule’s condition is met for the
full evaluation period:
- An alert event is created and stored
- Notifications are sent to all configured channels
- The alert remains active until the condition is no longer met (resolution event)
Deployment Topology
- Standard (Single-Node XIMP)
- Scaled (Multi-Node XIMP)
For environments up to ~50 monitored nodes, all XIMP services can run on a
single dedicated node:
- Metric Store, Log Index, Flow Store co-located
- Query API and Dashboard on the same node
- Alert Engine evaluates all rules
- Estimated resources: 8 vCPU, 32 GB RAM, 2 TB SSD storage
Next Steps
Agent Configuration
Deploy and configure monitoring agents on managed nodes
Metric Endpoints
Configure scrape targets and metric namespaces
Log Collection
Set up log source paths and syslog forwarding
Retention Policies
Configure how long metric and log data is retained