AIOps relies on large volumes of operational data to detect issues, predict failures, and improve system reliability. It works by combining different types of IT data and using machine learning to identify patterns that humans may miss.
Key types of data used in AIOps
AIOps systems typically depend on three major data categories:
1. Logs
Logs are detailed, time-stamped records generated by applications, servers, and infrastructure.
They include:
- Application logs
- System logs
- Security logs
- Container and Kubernetes logs
Logs help AIOps understand what happened and why during an event.
2. Metrics
Metrics are numerical measurements collected over time.
Common examples include:
- CPU usage
- Memory utilization
- Disk I/O
- Network latency
- Request rate and error rate
Metrics help AIOps understand system performance trends and detect anomalies.
3. Events
Events represent state changes in systems or applications.
Examples include:
- Server restarts
- Deployment updates
- Configuration changes
- Alerts and incidents
Events help AIOps understand what changed in the system and when.
Other important data sources
Modern AIOps platforms also use:
- Traces (distributed tracing of requests across services)
- Topology data (how systems and services are connected)
- Configuration data (infrastructure and application settings)
- User experience data (latency from end-user perspective)
Which data sources are most important?
All three core types—logs, metrics, and events—are important, but they serve different purposes:
Metrics (most critical for detection)
Metrics are the most important for real-time issue detection because they are:
- Structured
- Continuous
- Easy to analyze for anomalies
They quickly show when something is going wrong.
Logs (most important for diagnosis)
Logs are the most important for root cause analysis because they provide:
- Detailed context
- Error messages
- Step-by-step system behavior
They explain why a problem happened.
Events (most important for correlation)
Events are key for understanding system changes, such as:
- Deployments causing spikes
- Config changes triggering outages
They help connect cause and effect.
How AIOps uses this data
AIOps processes this data to:
- Detect anomalies automatically
- Correlate incidents across systems
- Reduce alert noise (alert grouping)
- Predict potential failures
- Automate incident response
By combining all data types, AIOps builds a full picture of system health.
Simple summary
AIOps depends on logs, metrics, and events to monitor and improve IT operations. Metrics are best for detecting issues, logs are best for understanding root causes, and events are best for tracking system changes.