IRIS makes SIEM systems integration simple with Structured Logging and Pipes!

This is an excellent candidate for a developer community post (like Dev.to, Medium, or the InterSystems Community). It bridges the gap between high-level architecture and hands-on implementation.

Here is the summarized article format.

Building a Robust Asynchronous Queue Manager with InterSystems IRIS and Angular

As applications scale, handling heavy computational tasks synchronously becomes a bottleneck. Whether it's processing large data sets, sending high-volume emails, or managing API integrations, a decoupled architecture is essential.

I’ve recently developed %ZQueue, a process-based queue

Hey everyone,

I'm just seeking some guidance and confirmation on what I'm doing for my production health monitoring.

We utilize Grafana to have reporting/monitoring dashboards and I have made a REST API to query the health of our productions. I believe I have everything figured out except for one thing that I'm uncertain about and that is the Production Item Color indicators:

Is there an easy way of being able to figure out the status of an item with the legend above?Ideally, I'd like to have this data in my JSON response.

Modern platforms usually treat observability as three core signals:

• Metrics
• Logs
• Traces

OpenTelemetry (OTel) is the standard way to produce and ship all three signals. This article explains a practical setup for InterSystems IRIS running in Docker Compose, with a full local observability stack:

• Prometheus (metrics)
• Loki (logs)
• Tempo (traces, for Grafana Traces Drilldown)
• Jaeger (optional, alternate trace viewer)
• Grafana (unified UI)
• OpenTelemetry Collector

What you’ll build

• IRIS emits OTLP/HTTP telemetry to the OpenTelemetry Collector
• Collector routes:
  • traces -> Tempo (for

Monitoring your IRIS deployment is crucial. With the deprecation of System Alert and Monitoring (SAM), a modern, scalable solution is necessary for real-time insights, early issue detection, and operational efficiency. This guide covers setting up Prometheus and Grafana in Kubernetes to monitor InterSystems IRIS effectively. 

This guide assumes you already have an IRIS cluster deployed using the InterSystems Kubernetes Operator (IKO), which simplifies deployment, integration and mangement.

Why Prometheus and Grafana?

Prometheus and Grafana are widely adopted tools for cloud-native monitoring

I am experimenting with OpenTelemetry and recently connected all IRIS instances to telemetry servers. I'm not interested in emitting custom metrics since IRIS does it fine, regarding tracing - we can use %Trace classes to emit custom traces, but what about logging?

I see that IRIS is able to send system log messages to the OpenTelemetry servers:

{
  "when": "2025-12-10 10:46:25.185",
  "pid": "11852",
  "level": "SEVERE",
  "event": "Generic.Event",
  "text": "ISCLOG: CSPServer  Error displaying login page $ZE= ns=TEST rtn=%SYS.cspServer ...(repeated 2 times)"
}

Is this possible to send custom s

APM normally focuses on the activity of the application but gathering information about system usage gives you important background information that helps understand and manage the performance of your application so I am including the IRIS History Monitor in this series.

In this article I will briefly describe how you start the IRIS or Caché History Monitor to build a record of the system level activity to go with the application activity and performance information you gather. I will also give examples of SQL to access the information.

What is the IRIS or Caché History Monitor?

The History

I was really surprised that such a flexible integration platform with a rich toolset specifically for app connections has no out-of-the-box Enterprise Service Bus solution. Like Apache ServiceMix, Mule ESB, SAP PI/PO, etc, what’s the reason? What do you think? Has this pattern lost its relevance completely nowadays? And everybody moved to message brokers, maybe?

Wiki time: An enterprise service bus (ESB) implements a communication system between mutually interacting software applications in a service-oriented architecture (SOA) ...

We are excited to announce the general availability of JediSoft IRISsync®, our new synchronization and comparison solution built on InterSystems IRIS technology.  IRISsync makes it easy to synchronize and compare IRIS instances.

IRISsync was voted runner-up in the "Most Likely to Use" category at InterSystems READY 2025 Demos and Drinks.

A huge thanks to everyone who supported us — we’re thrilled to see IRISsync resonating with the InterSystems user community!

IRISsync provides clear visibility into differences between environments.

IAM - InterSystems API Manager is a great tool for monitoring your traffic. If you are trying to use it in your Kubernetes cluster you may have tried doing a deployment similar to this one:

apiVersion: intersystems.com/v1alpha1
kind: IrisCluster
metadata:
  name: iris
spec:
  licenseKeySecret:
    name: iris-key-secret
  configSource:
    name: iris-cpf
  imagePullSecrets:
    - name: intersystems-pull-secret
  topology:
    data:
      image: containers.intersystems.com/intersystems/iris-arm64:2024.1
      compatibilityVersion: "2024.1.2"
      mirrored: false

SUB-AGENT auto stopping

This article outlines the process of utilizing the renowned Jaeger solution for tracing InterSystems IRIS applications. Jaeger is an open-source product for tracking and identifying issues, especially in distributed and microservices environments. This tracing backend that emerged at Uber in 2015 was inspired by Google's Dapper and Twitter's OpenZipkin. It later joined the Cloud Native Computing Foundation (CNCF) as an incubating project in 2017, achieving graduated status in 2019. This guide will demonstrate how to operate the containerized Jaeger solution integrated with IRIS.

Jaeger

Hello InterSystems Community,

I'm working with HealthShare, and need to create a user account for our development environment with specific access requirements. This user will need only to:

    Review messaging and environments
    See production and namespaces
    NOT modify anything (read-only access)

After reviewing the documentation on user roles and rights management, I can see the default roles available in our system include:

Ensemble/Interoperability Roles:

    %EnsRole_Administrator - Interoperability Administrator
    %EnsRole_AlertAdministrator - Interoperability user with administrative

Hello, good morning, thank you so much for reading this question. ☺️🙂👍

We are developing a code to get information about our Production's items: services, processes and operations.

We know we can get various configurations of a given item: Category, Port, Enabled...

But we wonder how we could get the date time of the last mesage (most recent) received in an item.

To give a code snippet a small section of the code we have developed (and tested), it looks like:

[...]

For i=1:1:tProduction.Items.Count() {
    #dim item as Ens.Config.Item
    set item = tProduction.Items.GetAt(i)
    
    se

Hello, dear members of our developer community!

In today's article, we're going to take a look at one of the latest remote monitoring features that have been added to the product for our IRIS instances. I'm talking about OpenTelemetry support.

Hello everyone, let me introduce, one of my latest projects. It is a DataSource plugin for Grafana, which can connect directly to InterSystems IRIS and gather any data (in the future). 

Hi community,

The aim of this article is to explain how to create messaging between IRIS and Microsoft Teams.

In my company, we wanted to monitor error messages, and we used the Ens.Alert class to redirect those error messages through a Business Operation that sent an email.
The problem was that we sent those error messages to a support account where there were many emails. We wanted something specific for a specific team.

So we investigated how to make these messages reach the development team directly and they could have, in real time, a notification of an error in our production.
In our company we use Microsoft Teams as a corporate tool, so we asked ourselves: How could we make these messages reach the IRIS development team?

If you are a customer of the new InterSystems IRIS® Cloud SQL and InterSystems IRIS® Cloud IntegratedML® cloud offerings and want access to the metrics of your deployments and send them to your own Observability platform, here is a quick and dirty way to get it done by sending the metrics to Google Cloud Platform Monitoring (formerly StackDriver).

 Hello IRIS Fans and Welcome to IRIS iRacing!

Here were going to take 3 laps of your time and demonstrate how I wired up my Racing SIM to IRIS for "As Real Time as It Gets" Metrics reporting.  I missed the window for the contest, which happens quite often, but I still ended up 3rd I think in the demo race in the video below.

Technical Salad

Below are the technical ingredients for this demonstration for a salad you can post on Instragram.

• Python iRacing SDK ( https://github.com/kutu/pyirsdk/tree/master )
• InterSystems IRIS Community / Python Interop
• Prometheus
• Grafana
• Custom Metric Class

Introduction

Database performance has become a critical success factor in a modern application environment. Therefore identifying and optimizing the most resource-intensive SQL queries is essential for guaranteeing a smooth user experience and maintaining application stability. 

This article will explore a quick approach to analyzing SQL query execution statistics on an InterSystems IRIS instance to identify areas for optimization within a macro-application.

Rather than focusing on real-time monitoring, we will set up a system that collects and analyzes statistics pre-calculated by IRIS once an hour.  This approach, while not enabling instantaneous monitoring, offers an excellent compromise between the wealth of data available and the simplicity of implementation. 

We will use Grafana for data visualization and analysis, InfluxDB for time series storage, and Telegraf for metrics collection.  These tools, recognized for their power and flexibility, will allow us to obtain a clear and exploitable view.

More specifically, we will detail the configuration of Telegraf to retrieve statistics. We will also set up the integration with InfluxDB for data storage and analysis, and create customized dashboards in Grafana. This will help us quickly identify queries requiring special attention.

To facilitate the orchestration and deployment of these various components, we will employ Docker.

Hi, 

i'm with a trouble to take the api/monitor/alerts using prometheus.

i'm using prometheus 3.2.1 with IRIS 2022.1, the api metrics is working fine, but with the alerts, i'm receiving the following error:
 

and this is the answer in the request:

it apears the iris is not using the right way to answer the OpenMetrics the way Prometheus want.

Someone already see this?

I built a monitoring system in Grafana using the IRIS API /api/monitor/metrics (reading with Prometheus) but I noticed that the RAM usage shown was below that shown by the operating system.
I installed the Zabbix agent and the usage values ​​were higher, but with a line with the same highs and lows but shifted.
The metric in the API is iris_phys_mem_percent_used, described as "Percent of physical memory (RAM) currently in use", in Zabbix it is the Item tag: "component: memory" item: "Memory utilization".

Image below of the graphs in Grafana:

Using the command "free -h" the server returns:
         

Runtime Enforcement

IRIS Health Monitor is part of System Monitor (see here).
The intention is to further process the captured sensor reading in order to identify the "health" of a system by checking the sensor reading values against pre-defined Base, Min and Max absolute values, and alert accordingly. Additionally,  instead of absolute values, you can create Charts (which can be different for different periods of a day), that contain a learned minimum and maximum value after a time spent by the system (at least 24 hours) analysing sensor readings.

The sensor readings included in Health Monitor are defined here.
The

So if you are following from the previous post or dropping in now, let's segway to the world of eBPF applications and take a look at Parca, which builds on our brief investigation of performance bottlenecks using eBPF, but puts a killer app on top of your cluster to monitor all your iris workloads, continually, cluster wide!  

Continous Profiling with Parca, IRIS Workloads Cluster Wide

I attended Cloud Native Security Con in Seattle with full intention of crushing OTEL day, then perusing the subject of security applied to Cloud Native workloads the following days leading up to CTF as a professional excercise. This was happily upended by a new understanding of eBPF, which got my screens, career, workloads, and atitude a much needed upgrade with new approaches to solving workload problems. 

So I made it to the eBPF party and have been attending clinic after clinic on the subject ever since, here I would like to "unbox" eBPF as a technical solution, mapped directly to what we do in practice (even if its a bit off), and step through eBPF through my experimentation on supporting InterSystems IRIS Workloads, particularly on Kubernetes, but not necessarily void on standalone workloads.

eBee Steps with eBPF and InterSystems IRIS Workloads

We are constantly running into issues where there are billions of Orphaned messages in our system that cause problems, and we have to manually run a cleanup to fix performance issues.

 In the following article about orphaned messages... https://community.intersystems.com/post/ensemble-orphaned-messages it mentions either programmatically eliminating the Orphaned messages or using a Utility like Demo.Util.CleanupSet in ENSDEMO.

I have had it explained to me is basically all messages have to go somewhere, if they aren't then it creates orphaned messages. 

So how should I go about getting rid of

Welcome to the next chapter of my CI/CD series, where we discuss possible approaches toward software development with InterSystems technologies and GitLab. Today, we continue talking about Interoperability, specifically monitoring your Interoperability deployments. If you haven't yet, set up Alerting for all your Interoperability productions to get alerts about errors and production state in general.

Inactivity Timeout is a setting common to all Interoperability Business Hosts. A business host has an Inactive status after it has not received any messages within the number of seconds specified by the Inactivity Timeout field. The production Monitor Service periodically reviews the status of business services and business operations within the production and marks the item as Inactive if it has not done anything within the Inactivity Timeout period. The default value is 0 (zero). If this setting is 0, the business host will never be marked Inactive, no matter how long it stands idle.