Skip to content

Platform Overview

Auditty AI data engine overview and architecture

Auditty is an AI data engine that cuts log noise at the source — keeping only the data that matters. Running inside your cluster with no changes to your existing stack, it analyzes and filters logs in real time before data even reaches observability platforms.

Key Benefits

  • No changes required to pods, logs, existing logging agents or cluster
  • Seamless installation and uninstallation via Helm
  • Typical 80-95% cost reduction on observability platforms (workload- and pricing-dependent)
  • No silent loss: Correlation keys are indexed inline in every summary, and suppressed original log lines stay recoverable via one-click backfill from the Vault

How It Works

Auditty Edge deploys two components in your cluster:

  • Edge DaemonSet (auditty-edge): Runs on each node to intercept and process container logs. Runs as root with two scoped Linux capabilities, not in privileged mode
  • Edge API (auditty-edge-api): Non-privileged cluster-level service with RBAC permissions to query the K8s API

Data Flow

  1. Container logs to stdout/stderr (no changes needed)
  2. Edge intercepts logs based on configured rules
  3. Edge processes logs (deduplicate, summarize, add insights)
  4. Edge writes optimized logs to node log files
  5. Edge API collects metrics from all nodes and sends to Auditty
  6. Your logging agents read from log files as usual

Edge API Benefits

  • Accurate workload names: Automatically resolves pod names to their parent workload (Deployment, StatefulSet, etc.)
  • Efficient metrics: Batches and compresses metrics before sending to Auditty

Privacy Guarantees

  • The Edge does not export any raw logs from the cluster
  • Only writes original logs and Auditty suppression messages to local log files
  • Only data transmitted is usage metrics and log fingerprints