Jaeger APM Trace Exploration

Basic accessibility

Basic accessibility attests the configured Jaeger Query API through its services request, independently of metric sources or an empty service list. Invalid configuration is unknown; confirmed API access failure is unavailable. Trace and workload health remain domain evidence.

TLS

TLS fields are grouped under Security > TLS. Connection endpoints, saved field names, defaults, sensitive handling and validation retain their behavior.

Use tls_ca_cert (PEM) to verify a Jaeger endpoint signed by a private CA. Existing saved ca_certificate values remain accepted. tls_server_name selects the certificate DNS name, and tls_client_cert plus tls_client_key supply mutual TLS credentials. tls_insecure_skip_verify keeps encryption but bypasses server verification and defaults to false.

The Jaeger Enterprise plugin connects one Konduo resource to one Jaeger Query HTTP endpoint. It lets operators move from an observed service to its operations and bounded trace search, then inspect an individual trace as a span timeline. The reference target is Jaeger v2.20.0 Query API v3.

This page describes application trace evidence. The plugin does not collect Prometheus metrics, calculate service-level percentiles or global error rates, manage sampling, or replace existing metric dashboards and alerts.

The resource manifest keeps the standard Prometheus linkage declaration required of a resource manager. This compatibility metadata does not make Prometheus an APM query dependency: the trace pages call only the configured Jaeger endpoint and do not add SPM, metric thresholds, or anomaly rules.

Quick start

1. Confirm that the Jaeger Query HTTP service is reachable from the Konduo plugin process. For Jaeger all-in-one the usual HTTP port is 16686.
2. Add a Jaeger resource and set query_endpoint to the Query service base URL.
3. Select none, bearer, or basic authentication. Use HTTPS whenever a credential is sent, and add the private CA PEM in ca_certificate when required.
4. Save the resource and run the connection check.
5. Open Services, choose an observed application service, and continue to Operations or Trace search. Select a trace row to open its timeline.

A successful connection check proves that the configured Query API answered. It does not prove that an application is healthy or that it is currently exporting and retaining spans.

Settings

Setting	Default and limits	Description
query_endpoint	http://localhost:16686	Required Query service base URL. Replace the development default with an address reachable from the plugin runtime.
auth_type	none	Authentication mode: none, bearer, or basic.
bearer_token	empty	Sensitive bearer credential.
username	empty	Basic-auth username.
password	empty	Sensitive basic-auth password.
ca_certificate	empty	PEM CA used to verify a private HTTPS endpoint.
timeout_seconds	10, range 1–60	Deadline for each Query API request.

The resource's saved configuration is authoritative. Search requests cannot change the target endpoint or credentials. Failed requests expose a sanitized error and do not include tokens or passwords.

Explore traces

Services lists service names present in Jaeger's retained trace index. Choose a service to narrow the next view. A missing application can mean that no retained sampled span identifies that service.name; it does not by itself mean the application is down.

Operations lists the operation name and span kind that Jaeger reports for the selected service. Continue from an operation to a trace search when a more specific result is useful.

Trace search supports these filters:

• service and optional operation;
• a lookback in minutes, default 60 and maximum 10,080;
• or an explicit RFC 3339 start and end time, supplied together, with the same seven-day maximum range;
• minimum and maximum duration in milliseconds;
• a result limit, default 50 and maximum 200;
• a flat JSON object of string attribute matches, up to 16 KiB and 32 entries;
• errors only.

The table shows trace ID, root service and operation, start time, trace duration, span count, error span count, missing-parent span count, and observed services. Trace duration is the interval from the earliest span start to the latest span end in that returned trace. Jaeger's duration search filters mean that at least one span matches the requested duration; they do not filter on a precomputed service percentile.

The result limit is sent to Jaeger as searchDepth. Some storage backends may treat search depth as an approximate bound. Errors only is applied by the plugin after Jaeger returns the bounded candidates, so an error trace outside that candidate set is not searched. Result metadata indicates when the bound was reached and when this post-filter was used.

Trace detail renders the selected trace as a timeline ordered by relative start offset. Each row shows its parent depth, service, operation, duration, span kind, OTLP status, and error or missing-parent markers. Attributes and events are bounded and redacted. A missing-parent marker means the parent span is absent from this returned trace; sampling, ingestion, retention, or an incomplete export may be responsible.

Trace detail rejects a trace with more than 5,000 spans and retains at most 1,000 events. Each span retains up to 64 attributes and each event up to 32; attribute string values are limited to 512 bytes. The summary reports event truncation. The waterfall shows the first 200 normalized spans by default, while the bounded span table remains available for individual row inspection.

When a trace ID is already known, enter its 16- or 32-character hexadecimal value in Trace ID to open the same detail view without running a search.

Interpret the evidence

The view covers stored traces returned by the current filters. Sampling, ingestion loss, Jaeger retention, storage search capability, query limits, and time filters can exclude application traffic. Do not treat returned counts as global request or error rates, and do not treat returned durations as a global latency distribution.

An error span is one whose OTLP status is explicitly ERROR. The plugin does not propagate a downstream error to another service's span. Investigate the timeline and redacted events to understand which instrumented component set the status.

Konduo authorizes this read surface at the resource instance and route level. There is no per-service allowlist inside the plugin. Anyone permitted to read the Jaeger resource can query the service and trace evidence available to the configured Jaeger identity. Use separate Jaeger endpoints or credentials when service-level isolation is required, and restrict resource access because application attributes can contain sensitive business context.

Troubleshooting

Symptom	Check
Connection check fails	Verify the saved base URL, network path, HTTPS certificate chain, auth mode, and timeout. The endpoint must expose Query API v3.
Services are empty	Confirm applications export OTLP traces to Jaeger, sampling retains spans, storage retention has not expired, and service.name is set.
Operations are empty	Select a service exactly as listed by Jaeger and confirm retained spans contain operation names.
Trace search is empty	Widen the time window, remove attribute and duration filters, and inspect whether the search bound was reached.
Trace ID is rejected	Enter only a 16- or 32-character hexadecimal trace ID, without separators or a URL.
Expected error trace is absent	Disable Errors only, increase the bounded limit if appropriate, and check whether Jaeger returned the trace among the candidates.
Trace has missing-parent markers	Check sampling and collector/export completeness; the detail response does not invent a parent that Jaeger did not return.
Attributes are hidden	Sensitive-looking keys and values are intentionally redacted, and oversized attributes/events are bounded.