Admin
The administrator-only settings — AI provider, anomaly detection, sampling caps, SLO defaults, service catalog, integrations, users, license, retention, Astra PII, and telemetry health. What each subpage is for.
The admin section is visible only to administrators (the ADMIN role). It's where the install-level settings live. Most of these are also readable (not editable) by regular users.
Admin → AI
Choose which LLM provider the AI features (RCA, Replay, Astra) use.
- Active providerOne active provider at a time, for citation consistency: Anthropic Claude (default) / OpenAI / Azure OpenAI / Google Gemini / Ollama / self-hosted OpenAI-compatible. Pick the active one with the radio; switching is transactional and takes effect immediately (past outputs aren't re-run).
- Configure (connection)Each provider's Configure opens a drawer holding that provider's own settings — its model, an API key (encrypted at rest, takes effect at runtime), and for on-prem providers a base URL + TLS. The key is write-only — the list shows only a "stored / from env / not configured" flag and the last 4 characters.
- On-prem endpoint + TLSFor the on-prem providers (Ollama, self-hosted OpenAI-compatible) the drawer also takes a base URL and TLS trust: use the system trust store, validate against an uploaded custom CA (PEM), or skip verification for a sealed self-signed endpoint. Cloud providers show only the model + key fields.
- Per-call defaults & policyTemperature, max tokens, system prompt, response caching, per-principal token budget, provider failover chain, and Replay/RCA evidence guards. (The Anthropic prompt cache is provider-specific, so it lives in Anthropic's Configure drawer.)
- Test connectionSends a tiny ping with the live — or, in the drawer, the draft — connection and surfaces latency or the exact error. Nothing is persisted.
Stored keys override env, at runtime
A key (or on-prem endpoint/TLS) saved here takes effect immediately and overrides the matching environment variable — no restart. Env vars remain the bootstrap and the fallback (changing an env value still needs a restart). Set ORBTRACE_SECRET_KEK to encrypt stored keys at rest; without it they're stored in plaintext (a warning is logged). Stored keys are never shown again — only a "stored" flag and a last-4 hint.
Admin → Anomaly
On/off and sensitivity per (service, signal) for the z-score / seasonal anomaly detector. If nothing is enrolled here, no anomaly detection runs at all — and since RCA is triggered from anomalies, an empty list means no auto-incidents. Enroll the services you care about.
Admin → Sampling
Per-service monthly trace-count caps. Each row shows the cap, the live burn-rate against it, and the current keep-rate Orbtrace is publishing. Orbtrace computes the probabilistic floor and republishes /api/sampling/policy.yaml, which your Collector's tail_sampling processor consumes. The hard-keep rules (errors, traces over p99, novel paths, SLO violations, anomaly-tagged) live in your Collector config and run regardless of the floor.
Admin → SLO Defaults
The default SLO targets applied to services that don't have an explicit contract — a global default plus per-namespace-tier overrides, stored in runtime_config so changes take effect with no restart. Rows show "Customised" vs "Default"; reverting an override drops back to the inherited value. (This is distinct from the per-service SLO contracts you pin on the SLOs screen.)
Admin → Service Catalog
Per-service metadata: owner, tier, runbook URL, and docs URL. This joins into the service list and detail pages and powers the owner filter on the Services and Overview screens — so an on-call engineer can jump straight from a failing service to its runbook.
Admin → Integrations
Inbound webhook integrations that feed the Time-Travel timeline with change events (deploys, flag flips, config changes): GitHub, LaunchDarkly, and a generic signed-webhook option. Create one inline; the signing secret is shown once in a one-time modal right after you create or rotate it, then it's redacted. These events are what Replay and the Deployments screen read. (Alert delivery — Slack/PagerDuty/etc. — is configured separately under Alerts → Channels, not here.)
Admin → Users
A table of every user account. Columns: email, name, role, the sign-in method (which OIDC provider they used), and last-login.
Users are created automatically the first time someone signs in through your IdP — there is no separate invite step and no passwords to manage. Actions:
- Change role — toggle between the two roles,
USERandADMIN. It takes effect on the user's next token refresh (have them sign out and back in to apply it immediately). - Delete — remove the account. You can't change your own role or delete the last remaining administrator; Orbtrace blocks both server-side so you can never lock everyone out.
Admin → License
Shows your license status and your install fingerprint (read-only for regular users). Administrators can upload a new .orblic token here; it's verified and persisted to PostgreSQL. The fingerprint is what you send to Nivorbit to have a license minted. Full flow in Licensing.
Admin → Retention
Runtime-mutable retention for the audit log and the Replay/timeline history — an enabled flag plus a max-age, taking effect on the next nightly sweep (03:00 UTC). (Telemetry retention for logs/traces/metrics is a Doris-profile setting, not here — see Configuration.)
Admin → Astra PII
Runtime-mutable PII redaction for the Astra assistant: an enable flag, per-built-in toggles (email, US SSN, US phone, AWS access key, Luhn-validated credit card), and custom regexes. When on, matches are scrubbed from operator text and the active query before they reach the LLM or the saved history. Off by default. See Astra.
Admin → Health
Orbtrace's self-monitoring dashboard — read it during an incident. It polls every 10 seconds and shows:
- Component healthEach actuator component (PostgreSQL, Doris, Valkey) as UP / DOWN / OUT_OF_SERVICE / UNKNOWN.
- JVM runtimeUptime, heap usage, thread count, available processors.
- Build & gitThe running commit SHA, branch, and build timestamp — confirm which version is live.
- Ingest ratesRoughly how many logs/traces/metrics arrived in the last minute — a quick "is data flowing?" check.
(Your Collector is a separate process Orbtrace doesn't run, so its internal queue/drop stats live in the Collector's own metrics, not here — check docker logs <your-collector>.)
If a component is red and you don't immediately know why, Troubleshooting has a decision tree.
Next: Daily workflows.