---
title: "System Monitoring"
slug: system-monitoring
section: Platform
status: active
description: "This page renders **live infrastructure data** — the health dials, resource grid, and log search results below are fetched from `/api/system-monitoring` and `/api/system-monitoring/logs` on each load and refresh on demand."
last-updated: 2026-07-07
---

# System Monitoring

## System Monitoring

This page renders **live infrastructure data** — the health dials, resource
grid, and log search results below are fetched from `/api/system-monitoring`
and `/api/system-monitoring/logs` on each load and refresh on demand. When
the markdown variant is read by an AI tool, live values won't be present;
this fallback documents what the page shows and how it works.

**What's on the page**
- Three radial health dials (Development / QA / Production), each showing
the proportion of ready resources (GKE pods + Cloud Run services) in
that environment. Dials are clickable — clicking one selects that
environment (highlighted with a border/background) and scopes the
resource grid below to it. Production is selected by default on load.
- A resource grid listing every monitored GKE pod and Cloud Run service
for the selected environment only, with kind, namespace, status,
ready/not-ready, and pod restart counts.
- A Cloud Logging search panel: filter by environment, namespace,
minimum severity, and free-text search, paginated via "Load more". This
panel has its own independent environment filter (not tied to the dial
selection above), since searching logs for one environment while
viewing another's resource grid is a reasonable and common use case.

**Monitored resources**
- GKE pods across the `globus-*` and `host-portal-*` namespaces in each
environment's GKE cluster (discovered live via the GKE clusters.list
API — clusters are not assumed to be in a fixed region, since
production's cluster runs in `us-east1` while development/QA run in
`us-central1`). Completed/stale test pods (`status.phase === "Succeeded"`)
are filtered out of the health rollup.
- Cloud Run services for the confirmed product surface (Keycloak, Host
Portal, PPPToo/ppp2, WildPacks, etc.) — the internal automation-agent
fleet (overseer-agent, security-agent, nexus-hub itself, and similar
platform-team bots) is intentionally excluded.

**QA caveat**
- QA's `manus-agent-sa` impersonation binding
(`roles/iam.serviceAccountTokenCreator`) is not yet granted, pending a
human admin action tracked separately. Until it lands, QA's dial and
resource rows show "Unknown" rather than live data — this is expected,
not an outage.

# System Monitoring

Live pod and service health across development, QA, and prod, plus a searchable Cloud Logging viewer. QA shows "Unknown" until its impersonation IAM grant lands.