> For the complete documentation index, see [llms.txt](https://documentation.grax.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.grax.com/technology/security/telemetry.md).

# Telemetry

GRAX monitors deployed software through egress-only metrics and log streaming to `hq.grax.com`, so the GRAX team can ensure reliability without ingress connections or direct access to your environment.

|                 | Metrics                                                                                                 | Logs                                                                                    |
| --------------- | ------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Purpose         | Detect failures                                                                                         | Investigate issues                                                                      |
| Contains        | System resources (CPU, RAM, disk), boot and update events, configuration changes, task status           | Function names, timings, API methods and paths, performance profiles, function metadata |
| Never contains  | Sensitive, classified, or restricted data, PII                                                          | Salesforce records, PII, secrets                                                        |
| Transport       | Write-only HTTPS connection to `hq.grax.com`, secured with basic authentication (username and password) | Same connection                                                                         |
| Can be disabled | No                                                                                                      | No                                                                                      |

Logs are retained indefinitely. The log collector is forward-only and doesn't transmit logs from an earlier point in time. Logs are written for GRAX engineers and don't document the application's internals, so they're of limited use to your team without help from GRAX Support.

## What GRAX Collects

None of your Salesforce data leaves the app environment. Telemetry covers:

* Names of Salesforce objects (standard and custom) covered by backup and archive operations.
* Number of records for those objects.
* GRAX backup, archive, and restore configurations (schedule, start time, and so on) and statuses.
* Size, performance, and internal metrics for the GRAX storage layer in your storage bucket.
* Size and performance metrics for the attached PostgreSQL database.
* Total data size sent to and received from Salesforce.
* Feature status (feature flags, feature access levels).
* Structured app logs: source function and file names, function timing, API request methods and paths, CPU, memory, and storage performance profiles, and function metadata (object names, batch sizes, record counts, and so on).

Metrics are streamed continuously for system resources, and the app submits specialized events at boot, at update, when backup, search, data lake, or general settings change, and when archive and restore tasks change status (created, started, ended, failed, and so on). The content of backed-up records isn't inspected for telemetry and isn't available to any GRAX engineer.

## Access and Third Parties

Telemetry is encrypted in flight (HTTPS, TLS 1.2+) and at rest, and access is restricted to the engineers who support and manage the GRAX Application. GRAX uses these third-party services:

* [Datadog](https://www.datadoghq.com/) for ingestion and consumption.
* [AWS S3](https://aws.amazon.com/s3/) for archival, encrypted at rest with AES-256.

## Network Requirement

Egress to `hq.grax.com` is required at all times, and the app won't boot or run without it. A static IP for this communication isn't currently available. See [Network Requirements](/technology/requirements/network-requirements.md).

## Frequently Asked Questions

<details>

<summary><strong>Can I keep my own copy of GRAX logs?</strong></summary>

GRAX forwards app logs to a central GRAX service for monitoring and support, and retains them indefinitely. In self-managed deployments you control the server configuration, so you can also forward logs to your own storage. How you do this depends on how your server runs GRAX and which log system you use. With the standard GRAX AWS templates, logs pass through:

* systemd journal
* rsyslog
* `/var/log/grax.log`
* AWS CloudWatch

Work with your cloud team and logging provider to forward from one of these.

</details>

<details>

<summary><strong>Can I use GRAX logs for auditing?</strong></summary>

In self-managed deployments, once you forward logs to your own logging service you control how they're used, including auditing, monitoring, and alerting. The log format is subject to change, but every API call is logged with:

* HTTP method, path, and status
* Remote address and user agent
* Salesforce Org ID and User ID of the caller

This example is the log for the user with ID `0054o000002Yz6lAAC` updating storage settings:

```json
{"keys":{"jwtAuth":"sfid_00D770000008i1kEAA_0054o000002Yz6lAAC","method":"PUT","path":"/api/v1/secrets/StorageSecret","remoteAddr":"[2600:1700:9da3:c850:3c02:8217:4d9f:2507]:52529","route":"/api/v1/secrets/:id","status":200,"userAgent":"Mozilla/5.0"}}
```

</details>